Cookie Policy

1. Controller and scope

The data controller is Wayora S.r.l., with its registered office at Via Altinate 125, 35121 Padua, Italy, tax code and VAT number 05799040281 (“Wayora”). Requests concerning this policy may be addressed to privacy@wayora.ai. The Data Protection Officer may be contacted at dpo@wayora.ai.

This policy concerns only the app.wayora.ai platform and does not describe the configuration of the separate corporate website wayora.ai. For purposes, legal bases, recipients, international transfers, retention of data on servers and data subjects' rights, please refer to the Privacy Policy.

2. Technologies and conditions of use

Cookies are information stored in the browser and sent again with subsequent requests according to their settings. Local storage (“localStorage”) retains data in the browser beyond an individual visit; session storage (“sessionStorage”) is normally limited to an individual tab. The rules governing access to information on a device also apply to technologies other than cookies.

Under Article 122 of Italian Legislative Decree No. 196/2003, storage or access strictly necessary to transmit a communication or provide a service expressly requested by the user does not require consent. Analytics tools that do not meet the conditions for exemption, profiling tools and other tools that are not strictly necessary require prior, informed, specific and withdrawable consent. A “functional” designation and legitimate interests do not replace that consent.

Sign-in and language cookies respectively enable authentication and display of the interface in the language used. The other technologies are described according to their actual function. Exemption from consent applies only to uses strictly necessary for the service requested and does not automatically extend to additional purposes.

3. Platform cookies

3.1. Sign-in cookies

Name: Authentication cookies, sb-* family

Purpose and information: Management of sign-in and sessions using identifiers and authentication information. The name includes the prefix sb-, the project identifier and the suffix -auth-token; it may be divided across several cookies with numbered suffixes such as .0 and .1. Relevant sign-in flows may also use the suffix -code-verifier for temporary sign-in verification.

Duration: A nominal duration of 24 months (730 days), subject to the retention limits applied by the browser. Expiry is renewed when the session is updated; the sign-out procedure removes authentication cookies. A cookie’s continued presence does not determine the validity of tokens, which may end earlier through expiry or revocation. The temporary verification cookie is removed when the relevant sign-in flow is completed.

3.2. Language

Name: NEXT_LOCALE

Purpose and information: Storage of the interface language.

Duration: 365 days from the last write by the language-selection or profile-synchronisation function. If set or rewritten automatically by the navigation system, it is a session cookie without a persistent expiry; browser restoration features may retain it when the browser is reopened.

The authentication and language cookies in this article are associated only with the platform host, app.wayora.ai, and the path /. They are not extended to the entire wayora.ai domain through the Domain attribute.

4. Local storage

The following entries are retained in the browser storage allocated to the platform. Variable parts of their names identify an itinerary, booking or account, as applicable.

4.1. Banner choice

Name: wayora_cookie_consent

Purpose and information: Choice made in the banner, with the value all or essential. Prevents the banner from being displayed again. The clarifications in Article 8 apply.

Duration: No automatic expiry; remains until site data is deleted.

4.2. Travel checklist

Name: Prefixes followed by the booking or itinerary reference: wayora.checklist. / wayora.checklist.itinerary.

Purpose and information: Status of items selected in the travel checklist.

Duration: No automatic expiry; remains until site data is deleted.

4.3. Traveller draft

Name: Prefix followed by the relevant identifier: wayora_traveler_draft_

Purpose and information: Draft traveller details, including any minors: title, first name, surname, date of birth, sex, contact details, nationality and residence. Allows completion of the form to be resumed. Does not contain passport details.

Duration: Valid for 24 hours from initial storage; removed when next read after expiry, when the booking is completed or when the user expressly signs out of the account.

4.4. Planning conversation

Name: wayora_intake_conversation

Purpose and information: Planning conversation identifier and storage date; does not contain message text. Allows the conversation to be resumed under the conditions of the feature.

Duration: Valid for 24 hours from initial storage of the same identifier; removed when next read after expiry, upon express sign-out, or when planning is completed or restarted.

4.5. Visitor theme

Name: wayora.theme.visitor.v1

Purpose and information: Visitor preference for the light, dark or system theme.

Duration: No automatic expiry.

4.6. Account theme

Name: Prefix followed by the relevant identifier: wayora.theme.account.v1.

Purpose and information: Theme preference associated with the account; may be synchronised with the account.

Duration: No automatic expiry; signing out does not delete this entry.

4.7. Booking attempt

Name: Prefix followed by the relevant identifier: wayora:checkout-attempt:

Purpose and information: Booking attempt identifier, a fingerprint of the submitted details and an expiry time, to recognise repeated submissions. Does not store traveller fields in plain text.

Duration: Valid for two hours, renewed on each use; replaced on the next use after expiry and removed when payment is completed or the order is recognised as already paid. Signing out does not remove it.

4.8. Notification invitation

Name: wayora.notifiche.invito

Purpose and information: Date of the last invitation to enable push notifications, to limit its repetition.

Duration: No automatic expiry. The 14-day period concerns when the invitation may be displayed again, not deletion of the data.

Expiry of an entry's validity does not cause timed deletion while the browser is closed: data may remain physically on the device until the feature reads or replaces it, or the user deletes it. Removal of the local copy does not delete data that may be retained on servers, which is governed by the Privacy Policy. Expiry of a session is not equivalent to expressly signing out.

5. Session storage, push notifications and cache

The entry with the prefix wy-notice: in sessionStorage records acknowledgement of an informational notice. Its name may contain an itinerary and notice reference. It remains for the tab session, according to browser behaviour, including any session restoration features.

Push notifications require permission from the browser or operating system. The subscription includes a technical delivery address and security keys; the relevant data is retained by the browser and registered with Wayora. Notifications are delivered through the browser’s infrastructure, with encrypted content during push transport. Wayora does not assign a fixed calendar expiry to the subscription: it remains usable while valid and authorised by the browser. Deactivation from the profile requests deletion of the subscription from the device and from Wayora; Wayora also deletes subscriptions reported as no longer valid by the service, those with ten consecutive failed sends and those associated with a deleted account. Revocation carried out directly in the browser may be detected by Wayora on the next attempted send.

The component receiving notifications (“service worker”) does not implement an application cache for offline access. The browser may nevertheless retain ordinary temporary copies of images, fonts and other resources according to cache instructions and its own settings. Interface and payment-form fonts are supplied through resources hosted by Wayora.

6. External services and browser connections

The platform integrates services for authentication and storage, payment and fraud prevention, mapping and place searches, image distribution and notification delivery. Loading external resources may disclose the IP address, browser information and data necessary for the feature to the recipient. A network connection alone does not, in itself, demonstrate that cookies are installed.

The payment form uses identifiers to process transactions and prevent fraud. The service documentation lists, among others, __stripe_mid with a nominal duration of one year, __stripe_sid of 30 minutes and m on the domain .m.stripe.com of two years. Actual use depends on the payment flow, the features used and browser settings; this information does not establish that all identifiers are installed in every session.

Mapping and place-search features load resources from the relevant external service. Some images may be requested directly from external sources when a copy hosted on Wayora’s behalf is unavailable. These requests disclose the IP address and technical information necessary for loading, but do not, by themselves, amount to the creation of cookies. Any access to existing identifiers depends on the service and browser settings.

7. Analytics, profiling and corporate website

The application configuration covered by this version does not include product analytics, session recording or behavioural advertising tools. This statement does not exclude technical data necessary for operation, security and error diagnosis, nor does it automatically give the same classification to processing carried out by external services.

The corporate website wayora.ai has a separate configuration and is outside the inventory in this policy, which concerns only app.wayora.ai.

8. Choices and consent

The choice recorded in the banner is stored on the device and prevents the notice from being shown again. In the current configuration, this choice does not change how integrated services are loaded and does not guarantee that non-essential services are blocked. The settings described in Article 9 remain available for managing cookies, local storage and notifications.

Tools requiring consent may be used only after a valid choice. Silence, continued browsing and merely scrolling the page do not constitute consent. Withdrawal does not affect the lawfulness of prior processing and must be as easy as giving consent. Any permission for push notifications is separate from cookie choices and from any consent to promotional communications.

9. Device management and rights

Browser settings allow cookies and site data to be inspected, blocked and deleted. Deletion may require a new sign-in and cause preferences, drafts and checklists to be lost. Blocking necessary technologies may prevent use of the relevant features. Signing out of the account alone does not delete all the information listed in this policy.

Push notifications may be disabled through the feature available in the profile and through browser or operating system settings. Signing out does not ensure that the device subscription is deleted through every sign-out route. On a shared device, users should therefore also check those settings.

Data subjects may exercise the rights provided for in Articles 15-22 of Regulation (EU) 2016/679 to the extent applicable, by contacting privacy@wayora.ai or dpo@wayora.ai, and lodge a complaint with the Italian Data Protection Authority or the competent supervisory authority. Full details are provided in the Privacy Policy.

10. Updates and reference language

The version date appears at the beginning of this policy. Any changes to technologies, purposes or applicable conditions are reflected by updating this policy and, where necessary, requesting consent again.

The Italian text is the reference version. In the event of discrepancies between translations, the Italian text prevails, without prejudice to the user's rights and any applicable mandatory provisions.