How Alba365 Sunrise uses cookies and similar storage.
Effective: [PLACEHOLDER: effective date — set at counsel sign-off]
Draft — under legal review. This document is a working draft prepared from how the product operates; it has not yet been reviewed by counsel and contains placeholders (shown in brackets). It is not yet legally binding and will be finalised before launch.
We currently use only STRICTLY-NECESSARY cookies and functional local storage — the things the Service needs to sign you in, keep you signed in, and remember your interface preferences. We do not use advertising or tracking cookies.
| Name | Purpose | Duration | Type |
|---|---|---|---|
| NextAuth sign-in cookies (session, CSRF, and callback-URL; named “__Secure-”/“__Host-” prefixed over HTTPS) | Signs in and keeps workshop staff signed in; protects against cross-site request forgery. | Sign-in session up to 8 hours; the CSRF and callback-URL cookies last for the browser session | Strictly necessary |
| alba_portal_session | Keeps a customer signed in to the customer portal. | Up to 7 days | Strictly necessary |
| __stripe_mid, __stripe_sid | Set by Stripe on payment pages to help prevent fraud during a deposit payment. | __stripe_sid ~30 min · __stripe_mid ~1 year | Strictly necessary (payments) |
| Local storage (e.g. interface and navigation preferences, cookie-consent choice) | Remembers UI preferences and your cookie choice on this device; not sent to our servers. | Persistent (until cleared) | Functional |
Strictly-necessary cookies do not require consent because the Service cannot function without them. If we introduce analytics or marketing cookies in the future, we will ask for your consent first and will not set them until you agree — you will be able to accept or reject them, and change your choice at any time.
You can clear or block cookies in your browser settings, but blocking strictly-necessary cookies will prevent sign-in and payments from working. Your cookie-consent choice for any future non-essential cookies is stored on this device and can be changed at any time.
Questions about cookies: [PLACEHOLDER: privacy/DPO contact email] ([PLACEHOLDER: legal entity name]).