Cookies and Similar Technologies Policy
UNPUBLISHED DRAFT · legal-review-2026-10-22 · For legal review; not an active consent mechanism. Open decisions: ../REVIEW-NOTES.md. Translations do not certify national compliance; no prevailing language has been designated.
C01. Who and what was reviewed
Proposed provider: [ФИРМА], company identification number [ЕИК], [СЕДАЛИЩЕ И АДРЕС], represented by [ПРЕДСТАВИТЕЛ], VAT number [ДДС НОМЕР, АКО Е ПРИЛОЖИМО]. Contacts: [КОНТАКТЕН ИМЕЙЛ] and [КОНТАКТ ЗА ЛИЧНИ ДАННИ]. This inventory comes from a targeted frontend code review on 2026-10-22. It is not a full production network audit and does not verify backend cookies, CDN, payment or mapping technologies.
C02. Types and necessity
HTTP cookies, localStorage and sessionStorage are different technologies; terminal-access rules may cover all of them. Authentication, a shopping cart and a requested language choice serve functional purposes; any consent exemption requires assessment of the specific necessity and duration. Persistent convenience, a push preference or an external SDK is not automatically classified as strictly necessary. Analytics and marketing are separate from delivery of an expressly requested service.
C03. Established inventory
| Name/pattern | Technology and purpose | Established duration |
|---|---|---|
crafterics_locale | Selected-language cookie; Path=/, SameSite=Lax; no Domain, Secure or HttpOnly in the frontend value | Max-Age=31536000 seconds (365 days), written on language change |
crafterics_access_token, crafterics_refresh_token | localStorage for access and session refresh | No frontend TTL; removed on the relevant clearing operation; token validity is separate |
crafterics_active_tenant, crafterics_admin_active_location_id | localStorage for active business and location | No frontend TTL; removed when the session is cleared |
crafterics_cart_id | localStorage for cart identity | No frontend TTL; clearing exists in code |
crafterics:storefront:{hostname}:location, crafterics:storefront:{hostname}:{locationId}:cart | localStorage for host-scoped location and cart | No frontend TTL; removal operations exist |
crafterics_order_confirmation_snapshot | sessionStorage for latest order confirmation | Tab session or explicit clearing; not a backend retention period |
crs.customerRating.v1, crs.customerRatingVisit.v1, crs.customerRatingClosed.v1 (prefixes) | Session storage for order/visit rating proof and state | Tab session/clearing; token validity is separate |
crafterics_staff_push_subscribed, crafterics_staff_push_context, crafterics_cust_push_*, crafterics_cust_push_synced_*, crafterics_push_locale_pending | localStorage for push choice, context and language synchronisation | No confirmed common TTL; not an analytics consent record |
No arbitrary external cookie names have been added. Persistent browser storage remains until code/user deletion or browser policy removes it; this does not establish a justified retention period.
C04. Authentication and external services
Customer API requests use credentials: include and PIN login uses withCredentials; backend cookie names, durations and attributes are not visible in this frontend and must be checked. A Paddle SDK is available for SaaS checkout. Google Maps loads when a delivery map is selected and configured. Clicking a map/payment function does not automatically give valid consent to every form of external tracking. A network inventory and legal classification are needed. Category YouTube URLs in the reviewed file are null; there is no evidence of an embedded YouTube player there. Twilio is a planned service.
C05. Analytics, marketing and consent
No analytics/marketing loader or consent manager was established in the reviewed legal/marketing/root provider files. This does not prove absence in production or unreviewed modules. If optional technologies are added, they must be blocked until a valid choice, with separate purposes, an equally accessible refusal and easy withdrawal. General acceptance of terms and browser notification permission do not replace required consent. This task adds no banner, scripts or activation.
C06. User controls
Language can be changed using the switcher. Stored data can be removed through browser settings; doing so may end a session or lose a cart. Push permission is also managed in the browser; deleting a local flag does not prove backend unsubscription. No general consent settings screen was established and no nonexistent settings link is supplied.
C07. Before publication
Confirm each technology's necessity and duration, backend cookies, external domains and behaviour before/after refusal and withdrawal on all relevant screens. Sources, evidence and limitations are in REVIEW-NOTES.md. Changes must be reflected before new purposes are activated.