1. Current V1 position
The current Costa Guest application code does not intentionally deploy advertising cookies, behavioural tracking pixels or non-essential analytics cookies. We currently use technical storage needed for language preference, authentication/session continuity and security.
Because the current inventory is limited to technical/necessary storage, Costa Guest does not need to force an advertising-style consent banner merely to browse the site. If non-essential analytics, personalisation or advertising technology is added, it must remain disabled until the required consent mechanism is available.
2. Current storage inventory
The current first-party inventory includes:
- cg_locale — first-party functional/technical cookie; remembers EN/ES/NL choice; maximum lifetime 12 months; SameSite=Lax; not used for advertising.
- Authentication/session storage on account, business and Control Tower surfaces — technical browser storage managed by the Supabase authentication client to keep an authorised session. It is not used for advertising and is only relevant when an authenticated surface is used.
- Security and request state strictly necessary to protect or deliver a requested service, where technically required.
3. Third-party websites
When you follow a link to Stripe or to an activity, booking, transport or other third-party provider, that third party may use its own cookies or storage under its own policy. Those cookies are not set merely because a Costa Guest page contains an outbound link.
4. Future non-essential cookies
If Costa Guest introduces non-essential analytics, advertising or similar storage, users will receive clear information before it is set and, where required, be able to accept or reject it with equivalent prominence and configure preferences. Consent will be separable from acceptance of general terms and can be withdrawn as easily as it is given.
5. Browser controls
You can delete or block cookies/storage using your browser settings. Blocking technical storage can prevent language memory, authentication or other requested features from working correctly.
6. Contact
Questions about privacy or storage can be sent to privacy@costaguest.com.
Current functional browser storage — final V1 audit
In addition to the language and authentication storage described above, the definitive V1 code audit identified the following first-party functional/session storage. These items are used to deliver requested features or maintain short-lived workflow state; they are not advertising or cross-site tracking identifiers.
- costa_guest_day_places_v1 — localStorage used by the day-planning basket. It stores destination slugs and bounded canonical Place UUIDs (maximum 12 per destination); no account is required and it is not intended to contain names, email addresses or other direct personal data.
- costa-guest-conversation-token — sessionStorage random UUID used to maintain a Concierge conversation within the browser session and isolate request/history state. It expires with the browser session and is not an advertising identifier.
- costa_guest_pending_invite and costa_guest_pending_invite_mode — sessionStorage used only during an authorised team/property invitation flow. The invite value is capability-sensitive workflow state; URL parameters are removed after capture and the stored state is cleared after successful completion.
- costa-guest-billing-return:* — sessionStorage one-time marker used to avoid repeated reloads after returning from a billing flow. It is session-scoped operational state, not analytics.
- Supabase authentication storage — technical session/authentication material managed by the Supabase client on authenticated surfaces. It exists to maintain authorised access and must not be repurposed for advertising or behavioural profiling.
Traffic analytics browser storage
The first-party traffic analytics layer described in the Privacy Notice does not set an analytics cookie and does not write localStorage or sessionStorage for visitor identification.