Cookie Policy
Last updated: October 23, 2026
1. What cookies and similar technologies are
Cookies are small text files that a website can store in your browser when you visit a page. Besides cookies, we also use similar technologies that serve comparable purposes without being, technically, cookies — in particular your browser's storage (localStorage and sessionStorage), where identifiers or preferences can be saved on your device.
Some of them are strictly necessary to deliver the service you asked for. The others — traffic analytics, marketing, conversion measurement — are not. On this site SALON TRANSILVANIA has switched the consent banner off, so these others load without asking you first.
This policy explains exactly what we use on SALON TRANSILVANIA's booking site, for what purpose and for how long.
2. The categories of cookies and technologies we use
| Name | Provider | Category | Purpose | Storage duration |
|---|---|---|---|---|
| __Secure-next-auth.session-token | SALON TRANSILVANIA (first-party) | Strictly necessary | Keeps your sign-in session active (account/booking) | Session / up to 30 days |
| __Host-next-auth.csrf-token | SALON TRANSILVANIA (first-party) | Strictly necessary | Anti-CSRF protection when submitting forms and signing in | Session |
| cookie-consent-cmj2w4mlb0004fti9apf9cftw (in localStorage) | SALON TRANSILVANIA (first-party) | Strictly necessary | Remembers your consent choice and a random consent key (no personal data), so we don't ask on every visit; the same choice is recorded on the salon's server with the time and the banner version, never with your IP address | Persistent (until cleared) |
| thesalon_device_token (in localStorage) | SALON TRANSILVANIA (first-party) | Strictly necessary | Remembers this device so you skip SMS re-verification on your next booking | Persistent — up to 12 months, renewed on each booking |
| _pst (in sessionStorage) | SALON TRANSILVANIA (first-party) | Analytics | Session identifier for anonymous navigation and booking-funnel analytics | Session (cleared when the tab closes) |
| _pvid (in localStorage) | SALON TRANSILVANIA (first-party) | Analytics; ad attribution when you book | Device identifier to detect returning visitors. When you book, this device's visits to SALON TRANSILVANIA from the last 30 days are linked to the booking, only to learn which ad brought you; the link is deleted 30 days after the visit | Persistent (until cleared) |
| _putm (in sessionStorage) | SALON TRANSILVANIA (first-party) | Analytics | Stores the campaign source (UTM) for the session, for traffic attribution, and the ad-click identifier only while the marketing tags are allowed to run; turning Ads off deletes it | Session |
| _porigin (in sessionStorage) | SALON TRANSILVANIA (first-party) | Attribution — contains no identifier | Keeps where this visit came from — the campaign your own link already named in the web address (utm_source / utm_medium / utm_campaign / utm_content / utm_term), the referring host — and, when that host is an AI assistant, which assistant it is — the entry path and the salon's own public id (which names the salon, never you) — for the booking you are making, so the salon can tell which campaign, or which site, brought it. It is written when the link named a campaign, and equally when it named none and the site you arrived from is all there is to keep; when there is neither, nothing is written. It creates no identifier: two people arriving from the same ad store byte-identical content, it cannot be read on a later visit, in another tab or on another device, and it is sent nowhere except this salon's own booking form | Session (cleared when the tab closes) |
| _plpsd (in sessionStorage) | SALON TRANSILVANIA (first-party) | Analytics | Remembers how far down a campaign landing page you scrolled, so the same figure is not reported twice in one session. Holds a number between 0 and 100 and nothing else — no identifier. Written while the script above runs, which on this site loads without asking you first | Session (cleared when the tab closes) |
| primer:booking-consent:<id> (in sessionStorage) | SALON TRANSILVANIA (first-party) | Strictly necessary | Keeps, in this tab only, the handle for the booking you have just sent, so the confirmation page can offer you the marketing subscription for it. It exists only because you completed a booking, it is never written to anyone who did not, and closing the tab removes it | Session (cleared when the tab closes) |
| _pclk_cmj2w4mlb0004fti9apf9cftw (cookie) | SALON TRANSILVANIA (first-party) | Marketing | Remembers the latest Meta or TikTok ad-click identifier that brought you here and the last paid ad click (its source, campaign, ad, keyword and the time of the click), so that a booking you make later or in another tab can be credited to that ad and sent with it, as described below. Set by the salon's server when you arrive from an ad — the salon has switched the consent banner off on this site — and readable only by the server | 30 days from the last click, renewed by a new ad click |
| Google Analytics 4 (_ga, _ga_*) | Analytics | Aggregate audience statistics (pages viewed, duration, conversions) | Up to 24 months | |
| Google Ads (gtag.js, conversions) | Marketing | Advertising conversion measurement and remarketing | Up to 24 months | |
| Meta / Facebook Pixel (_fbp) | Meta Platforms | Marketing | Conversion measurement and custom audiences for Facebook/Instagram ads | Up to 3 months |
| Microsoft Clarity (_clck, _clsk) | Microsoft | Analytics | Records how visitors use the pages (clicks, scrolling) to improve the site | Up to 12 months |
Note: the third-party cookies and tags (Google, Meta, TikTok, Pinterest) are configured per salon. Not all of them may be active on this site — only those enabled by SALON TRANSILVANIA appear.
3. The _pvid and _pst device identifiers are non-essential
We want to be explicit: the identifiers _pvid (in localStorage) and _pst (in sessionStorage), together with _putm and the scroll watermark _plpsd, are NOT strictly necessary for the site to function. They are used for traffic and navigation analytics and, on this site, _pvid is also used when you book: the salon links this device's visits of the last 30 days to the booking, only to learn which ad brought you.
On this site SALON TRANSILVANIA has switched the consent banner off, so the script that creates and writes these identifiers to your device loads when a page opens, without asking you first.
_porigin (in sessionStorage) is also written: where this visit came from — the campaign your own link already named in the web address, or, when it named none, simply the site that sent you here (and, when that site is an AI assistant, which one) — kept for this tab only so the booking you are about to make can be credited to what actually brought you. It contains no identifier of any kind — see its row in the table above.
The strictly necessary technologies are marked as such in the table: your sign-in session, your consent choice itself, the device token that spares you an SMS, and primer:booking-consent:<id> — the handle for a booking you have just sent, which exists only because you sent it and which the tab removes when you close it.
4. Strictly necessary cookies (no consent needed)
The following technologies are indispensable for the site to work and for you to complete a booking securely. For these, the law does not require consent, and disabling them would prevent the service from functioning:
- Session cookie (__Secure-next-auth.session-token) — keeps you signed in while you use your account or complete a booking;
- Anti-CSRF cookie (__Host-next-auth.csrf-token) — protects forms against cross-site request forgery;
- Consent storage (cookie-consent-cmj2w4mlb0004fti9apf9cftw in localStorage) — remembers your own cookie choice so we don't ask again on every visit.
5. This site does not ask for consent
SALON TRANSILVANIA has switched the consent banner off on this site. The analytics and marketing tags listed above load when a page opens, without asking you first.
When you arrive from a paid ad, the salon's server remembers that ad in the _pclk_ cookie for 30 days. It keeps its source, campaign, ad, keyword and the time of the click and, for a Meta or TikTok ad, the click identifier too. A booking you make later can then be credited to it.
SALON TRANSILVANIA sends your booking and your completed visit to Meta from its server. It does not ask for your consent first. SALON TRANSILVANIA S.R.L. answers for this choice.
With them go Meta's _fbp and _fbc cookies and your Meta ad click (with its time). Your IP address, your browser type and the address of the booking page go too.
Your phone number and a client code go as well, both irreversibly hashed. So do the service (as an identifier), the date, the value and whether the till confirmed the visit.
The server never sends your name, your email or the other pages you visited. It deletes what it took from your browser at most 30 days after the visit.
If you have refused marketing messages from SALON TRANSILVANIA, nothing is sent. If this browser refused “Ads” back when this site asked, nothing from this browser is sent.
Every other completed visit reaches Meta too: one booked by phone or at the salon, or from a browser that refused “Ads”. It carries only your phone number and a client code, irreversibly hashed.
When you book, the salon links your earlier visits from this device in the last 30 days to the booking. It does so only to learn which ad brought you. Nothing from those visits is sent to any platform.
To object, write to SALON TRANSILVANIA using the details below. You can also clear this site's cookies and storage in your browser settings.
6. Who receives the data
Ad platforms: Google and Meta. On this site their tags load when a page opens, without asking you first; what the salon's server sends, and to which of them, is described above. For collecting and sending the data and for measurement, SALON TRANSILVANIA S.R.L. and each platform are joint controllers; once received, the platform processes it as an independent controller.
Statistics tools: Google and Microsoft. On this site their tags load when a page opens, without asking you first; they receive what their tags collect on this site, to count and analyse visits.
The value of a completed visit is the amount the salon earned from it, taken from the payment recorded at the till when there is one, otherwise from the booking's price; we do not send what other products you bought.
This site and its booking system are run for SALON TRANSILVANIA by WISE PEOPLE S.R.L. (Primer), as its data processor.
7. Who we are and how to contact us
This booking site is operated by:
- SALON TRANSILVANIA S.R.L.
- Company ID: 37525956
- Strada Republicii 105
- România
- Email: [email protected]
- Phone: 0770976325