1. What cookies and local storage are
A cookie is a small text file that a website stores in your browser. Local storage is a similar technique that lets a website remember settings in your browser. Both stay on your own device. This policy covers both.
2. What we use
| Name | Type | Purpose | Duration |
|---|---|---|---|
| authjs.session-token | Cookie | Keeps you logged in to the dashboard and scan page | Up to 7 days |
| authjs.csrf-token | Cookie | Protects login forms against cross-site request forgery | Browser session |
| authjs.callback-url | Cookie | Returns you to the right page after logging in | Browser session |
| mezatap_impersonate | Cookie | Set only for MezaTap support staff when they view a shop's dashboard to help that shop | 30 minutes |
| mezatap.locale, mezatap.auth.locale | Local storage | Remembers your language | Until you clear it |
| mezatap.auth.email | Local storage | Remembers the email address you last logged in with on this device, so you only need to type your password | Until you choose "Not you?" or clear it |
| mezatap.scan.prefs | Local storage | Remembers on the scanning device which branch is selected and whether sound and vibration are on | Until you clear it |
| mezatap-cookies | Local storage | Remembers whether you accepted or rejected optional ad pixels | Until you clear it or open Cookie settings |
| mezatap.utm | Local storage | Remembers utm_source and utm_campaign from the link you opened, until you create a shop | Up to 90 days, or until signup |
| mezatap_utm | Cookie | The same campaign parameters, kept if local storage is unavailable | Up to 90 days, or until signup |
| mezatap-dash-nav-collapsed | Local storage | Remembers whether the dashboard menu is collapsed | Until you clear it |
| mezatap:card:(shop) | Local storage | Remembers the link to your web card on this device | Until you clear it |
On secure connections, the login cookies carry the prefix `__Secure-` or `__Host-`. These are technical variants of the same cookies.
3. Bot protection
Our sign-up, login, and join forms use Cloudflare Turnstile to check that a real person is using the form. Turnstile runs in a frame from Cloudflare and processes technical signals from your browser only for this security check. It does not use your data for advertising. See the Cloudflare privacy policy.
4. Optional advertising pixels
If you choose Accept, and only then, we may load the Meta Pixel and the TikTok Pixel. Each pixel loads only when its id is configured for this website. They can receive the page address and the fact that a shop account was created (a CompleteRegistration event). Page views are also sent when you move between pages inside the site.
If you choose Reject, or if you have not chosen yet, we do not add those scripts and we do not send those events. You can change your choice from Cookie settings in the site footer.
Meta Platforms, Inc. and TikTok then process that visit under their own policies: the Meta Privacy Policy and the TikTok Privacy Policy.
5. Campaign link
When the address you open contains `utm_source` or `utm_campaign`, we store those two values in local storage (`mezatap.utm`) and in a first-party cookie (`mezatap_utm`). We keep them for up to 90 days, or until you create a shop, whichever comes first. On signup we copy them onto the shop account and remove them from the browser. We use them to see which of our own ads the shop came from.
6. What we do not use
- No Google Analytics or other analytics tools
- No session recording
- No advertising pixels other than the optional Meta and TikTok pixels in section 4
- No other cross-site tracking
Our error monitoring (Sentry) does not place cookies.
7. Apple Wallet and Google Wallet
When you add a card to Apple Wallet or Google Wallet, you use a service of Apple or Google. Their own privacy and cookie policies apply to that step.
8. Legal basis
Under article 11.7a of the Dutch Telecommunications Act, cookies that are strictly necessary for a service you request do not require consent. The login cookies and similar items in section 2 fall into that category.
Optional pixels run only with your consent (GDPR article 6(1)(a) and the Telecommunications Act). You can withdraw that consent at any time from Cookie settings. Withdrawal stops further pixel events. It does not undo events already sent.
Campaign parameters are stored on the basis of our legitimate interest in measuring our own advertising (GDPR article 6(1)(f)). You can delete them in your browser. Where personal data is involved in the necessary cookies, we rely on our legitimate interest in a working and secure service. See our Privacy Policy.
9. How to delete or block them
You can delete cookies and local storage at any time in your browser settings, and you can block cookies. Choosing Reject, or clearing this site's data, stops the optional pixels. If you block the necessary cookies, you cannot log in to the dashboard, and the website will forget your language.
10. Changes
Optional Meta and TikTok pixels run only after you accept them, and this policy describes that choice. Questions? Email info@mezatap.com.