Cookie Policy
Last updated: 11 May 2026
This Cookie Policy explains what cookies and similar technologies we use on our website and platform, why we use them, and how you can control them. It supplements our Privacy Policy at /legal/privacy. We apply Article 11.7a of the Dutch Telecommunications Act (Telecommunicatiewet) and the ePrivacy Directive (2002/58/EC), in line with the GDPR.
1. What cookies are
Cookies are small text files placed on your device by websites you visit. Similar technologies include local storage, session storage and pixel tags. In this Policy, “cookies” refers to all such technologies.
Cookies can be “first-party” (set by us directly) or “third-party” (set by a third party we have integrated into the site). They can be “session” cookies (deleted when you close the browser) or “persistent” cookies (kept for a defined period).
2. Categories we use
Strictly necessary cookies (always on)
These cookies are required for the site and the platform to function. They are not used for analytics or advertising and are exempt from the consent requirement under Art. 11.7a(3) of the Dutch Telecommunications Act and Art. 5(3) of the ePrivacy Directive.
| Name / purpose | Type | Retention |
|---|---|---|
| Session / authentication — keeps you signed in while you use the platform | First-party | Session, up to 30 days for “remember me” |
| CSRF token — protects forms against cross-site request forgery | First-party | Session |
| Locale preference (NEXT_LOCALE) — remembers your chosen language (EN / NL / DE) | First-party | 12 months |
| Theme preference — remembers your light / dark mode choice | First-party (local storage) | Until cleared by you |
| Consent record — stores your cookie preference so we don't ask again | First-party (local storage) | 12 months |
Analytics cookies (consent required)
We use Google Analytics 4 (GA4) to understand how the site is used (page views, sessions, navigation paths, basic device and browser information). GA4 cookies are only set after you give consent through the cookie banner. We use Google Consent Mode v2 with default-denied settings, so until you grant consent no analytics cookies are written and no analytics events are sent.
IP addresses are anonymised by GA4 by default. We do not enable Google signals or ad personalisation. We do not link GA4 data to other Google services for advertising. Data may be transferred to the United States; the recipient (Google LLC) is certified under the EU–US Data Privacy Framework, and the EU-facing controller-counterparty is Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland).
| Name / purpose | Type | Retention |
|---|---|---|
| _ga — distinguishes unique users (Google Analytics) | Third-party (Google) | Up to 2 years from last visit |
| _ga_<container-id> — used by Google Analytics 4 to maintain session state | Third-party (Google) | Up to 2 years from last visit |
You can withdraw consent at any time from “Cookie settings” in the footer. Withdrawing consent stops the setting of new analytics cookies; previously set GA4 cookies remain on your device until they expire or you clear them in your browser. To delete them immediately, use your browser's site-data settings.
Marketing cookies
We do not use marketing or advertising cookies. We do not embed third-party advertising trackers, social-media pixels or retargeting tags on this site.
3. Your choices
When you first visit our site, we display a banner that explains the categories above. Because we currently only set strictly necessary cookies, the banner asks you to acknowledge the notice. If and when we add non-essential cookies, the banner will let you accept all, reject non-essential cookies, or choose by category — and you can change your choice at any time from the “Cookie settings” link in the footer.
You can also manage cookies through your browser settings (block, delete, or be warned before a cookie is set). Disabling strictly necessary cookies will break parts of the site, such as the ability to sign in.
4. Personal data and international transfers
Cookies may involve the processing of limited personal data (for example, an IP address inferred from the request, or an identifier in a session cookie). For information on legal bases, recipients, international transfers, retention and your rights, please read our Privacy Policy at /legal/privacy.
5. Updates
We may update this Cookie Policy from time to time, including when we add or remove technologies. The “Last updated” date above shows when it was last changed. For material changes, we will request renewed consent where required by law.
6. Contact
Questions about cookies and tracking can be sent to info@phytomaps.com.