Strictly necessary storage
We use the following first-party cookies where they are necessary to provide a feature you requested, protect the service or remember your privacy choice:
auth: Signed-in session. It is HttpOnly, Secure in deployed HTTPS environments and normally lasts for the browser session, 7 days or 90 days when you choose to be remembered
refresh: Renews a signed-in session. It is HttpOnly and lasts for the browser session, 30 days or 90 days when you choose to be remembered
gs_csrf: Protects signed-in form submissions against cross-site request forgery. It lasts for 7 days
did: An opaque device identifier used for device recognition, security alerts and multi-factor authentication trust. It lasts for up to 1 year
mainstayReturn: Remembers the GoSavis Business page to return to after a cross-surface journey. It lasts for 1 day
gosavis_gate: Records access to a restricted pre-launch or preview environment when that gate is enabled. It lasts for 30 days and is not used on an ungated public environment
gs_consent: Stores your cookie choices across GoSavis subdomains. It lasts for 180 days, after which we ask again
gs_market: Remembers the country or region you chose, so every GoSavis page and app shows the same one. It lasts for 1 year
Drafts, work in progress and uploads
Session storage keeps the work in progress of a journey you started, such as a basket, a checkout, a form or post draft, or the seat or bay you picked, so a reload does not lose it. Local storage keeps a registration you have started and, for a business, which business and branch you are acting for. These records use descriptive GoSavis keys, are strictly necessary for the journey you asked for, and are not used for advertising or cross-site profiling.
IndexedDB holds media uploads still in progress; you can remove them by clearing GoSavis site data in your browser. Signing out clears authentication state.
Optional categories
Functional
With your permission, we remember choices you make on this device so they are still in place next time: your theme, language, region and location, display and layout settings such as a pinned side menu, and the accounts you have signed in with here. Functional also lets your browser keep the on-device search model, so search starts faster. These records use first-party browser storage with descriptive GoSavis keys, stay until you change the setting, withdraw your permission or clear browser data, and are not used for advertising or cross-site profiling. If you do not allow Functional, your choices still apply while the page is open but are not remembered.
External media
Videos from YouTube, Vimeo and TikTok remain behind a GoSavis placeholder until you allow External media. Loading one lets that provider receive your IP address, browser information, the page containing the media and any cookies or identifiers it controls. YouTube embeds use its privacy-enhanced domain, but the provider may still process technical information when the video loads.
Analytics
If Google Analytics is configured for the environment, it loads only after you allow Analytics. Google's advertising storage and personalisation remain disabled. Google Analytics may set _ga and a property-specific _ga cookie for up to 2 years to distinguish visits. We do not describe this data as anonymous, and we do not use your analytics choice as consent for advertising.
Marketing
We advertise GoSavis to businesses on TikTok. If you allow Marketing, the TikTok Pixel loads on our pages for businesses, the GoSavis Business information pages and the business sign-up form, so that we can measure whether our adverts lead businesses to join GoSavis. It does not load on our customer site, customer pages, bookings or checkout, or in your business account once you have signed up. TikTok sets the cookies _ttp and _tt_enable_cookie for up to 90 days, and ttclid, which records the advert you clicked, for 1 day. It also keeps tt_sessionId, tt_pixel_session_index, tt_appInfo and tt_adInfo in session storage, which your browser clears when you close the tab. TikTok receives your IP address, browser information, the address of the page, which sign-up buttons you choose and these identifiers. The Privacy Policy explains what we send TikTok when you create a business account or submit your business for review. Marketing is off until you allow it.
Services loaded when you request a feature
Some providers are contacted only when you request the corresponding feature. Google or Apple is contacted when you choose its sign-in button. Stripe is contacted when you open an online card-payment or payout-onboarding component. Cloudflare Turnstile is contacted when a protected form requires a security challenge. These services may use their own cookies or local storage to complete the requested authentication, payment or security operation.
Map pages and location search can contact Mapbox, OpenStreetMap tile services or Nominatim when you open a map, search for a place or ask the browser to use your location. Those providers receive the technical information necessary to return the requested map or result. The Privacy Policy explains the related personal-data processing.
Managing and withdrawing your choice
You can change your choice at any time using Cookie preferences. The controls use the same category names as this policy: Strictly necessary, Functional, External media, Analytics and Marketing. The available actions are Accept all, Reject non-essential and Choose preferences. When we add a category, we ask for your choice again.
Withdrawing consent takes effect at once: GoSavis deletes the Functional records, removes external media already loaded on the page, sends a denied consent update for analytics, removes the analytics cookies it can identify, tells TikTok to stop and removes the marketing cookies it can identify. Browser controls can block or clear all site data, but blocking strictly necessary storage will prevent sign-in, bookings and other secured features from working.
For more detail about personal information processed through these technologies, read our Privacy Policy.
Changes to this policy
We update this policy and the consent schema when the product or provider list changes. If we add a new optional purpose, provider or technology that is not covered by your existing choice, we will ask you again rather than treating an earlier choice as advance consent.