1 · What cookies are
Cookies are small text files that a website stores in your browser. Browser storage (localStorage and sessionStorage) works in a similar way. For simplicity, this policy calls all of them cookies and the same rules apply to them.
The website subvy.cz and the SUBVY mobile app are operated by SUBVY s.r.o., registered office Komunardů 32, 170 00 Prague 7, Czech Republic, company ID 12345678. How we process personal data in general is described in the privacy policy.
2 · When we need consent
We store necessary cookies, without which we can't provide a service you have explicitly requested (signing in, security, payment, showing the chosen language), without consent. This is permitted by Section 89(3) of the Czech Electronic Communications Act and Article 5(3) of the ePrivacy Directive. We process personal data in them because it is necessary to perform the contract and, for security, on the basis of legitimate interest.
We store optional cookies only with your prior consent (Article 6(1)(a) GDPR). No optional category is switched on in advance and nothing optional is stored until you decide. Closing the page or the banner without a choice is not consent.
3 · Categories
Necessary: signing in to your account, protection against forged requests, payment security, the selected business account, the chosen language for the current visit, registration in progress and storing your cookie choice.
Preferences (optional): remembering your choices between visits, namely the language, app appearance (light or dark mode, font size) and dismissed notices. Without consent these choices only last until the browser is closed.
We don't use analytics or advertising cookies and we don't track you across other websites. If we ever wanted to use them, we would first ask for new consent.
4 · List of cookies
The table lists all cookies and browser storage entries used by the SUBVY website. Sign-in cookies have the prefix __Secure- or __Host- on secure connections in production.
Necessary
Signing in, security, payments and storing your cookie choice. The website doesn't work without them, so they can't be switched off and don't require consent.
| Name | Set by | Purpose | Storage period | Type |
|---|---|---|---|---|
| subvy_consent | SUBVY | Your cookie choice (random consent ID, version, date and chosen categories), so the banner isn't shown on every visit. | 12 months | Cookie |
| authjs.session-token, __Secure-authjs.session-token | SUBVY | Signing in to your account (encrypted session token). Signing in isn't possible without it. | 30 days | Cookie |
| authjs.csrf-token, __Host-authjs.csrf-token | SUBVY | Protection of sign-in against forged requests from other websites. | Until the browser is closed | Cookie |
| authjs.callback-url, __Secure-authjs.callback-url | SUBVY | The page to return to after signing in. | Until the browser is closed | Cookie |
| authjs.pkce.code_verifier, authjs.state, authjs.nonce | SUBVY | Securely completing sign-in with Google or Apple (only while signing in). | 15 minutes | Cookie |
| subo_active_provider | SUBVY | Which business account is currently open (for users with several accounts). | 30 days | Cookie |
| subo_mfa_pending | SUBVY | A sign-in with two-step verification in progress, until you enter the code from your app. | 5 minutes | Cookie |
| subo_reauth | SUBVY | Confirmation with your password or code before a sensitive action (for example deleting your account or setting up payouts). | 5 minutes | Cookie |
| NEXT_LOCALE | SUBVY | The chosen website language for the current visit. | Until the browser is closed | Cookie |
| __stripe_mid, __stripe_sid | Stripe | Fraud protection for card payments. Set by Stripe only on pages with a payment form. | 1 year (__stripe_mid), 30 minutes (__stripe_sid) | Cookie |
| subo_onboarding_prefill, subo_provider_onboarding_draft | SUBVY | Registration in progress, so entered details aren't lost between steps. | Until the browser tab is closed | Session storage (sessionStorage) |
| subo_app_bar_dismissed | SUBVY | Hiding the mobile app bar after it has been closed. | Until the browser tab is closed | Session storage (sessionStorage) |
| subo_admin_invite_token | SUBVY | Keeps an administrator team invitation until the invitee signs in. | Until the browser tab is closed | Session storage (sessionStorage) |
Preferences
Remembering choices between visits: language, app appearance and dismissed notices. Without consent, choices only last until the browser is closed.
| Name | Set by | Purpose | Storage period | Type |
|---|---|---|---|---|
| NEXT_LOCALE | SUBVY | The chosen language for future visits too. | 12 months | Cookie |
| subo_settings_appearance_v1 | SUBVY | App appearance (light or dark mode, font size, density) for future visits too. | Until consent is withdrawn or the data is cleared in the browser | Browser storage (localStorage) |
| subo_mobile_promo_dismissed_v1 | SUBVY | Remembering that the mobile app offer has been closed. | Until consent is withdrawn or the data is cleared in the browser | Browser storage (localStorage) |
5 · Giving, changing and withdrawing consent
On your first visit a banner shows the buttons “Accept all”, “Reject optional” and “Settings”. Rejecting is as easy as accepting, and in the settings you can choose by category.
You can change your choice or withdraw consent at any time with the button below (this page is linked as “Cookies” in the website footer) or in the app under Settings, Privacy section. After withdrawal we delete optional entries from persistent browser storage and your choices only last until the browser is closed. Withdrawal doesn't affect processing before it.
Consent is valid for 12 months. After that, or when we change the categories or purposes, we ask again.
We record every choice so that we can demonstrate it: a random consent ID, the version, the date, the chosen categories and where the choice was made (banner or settings), and for signed-in users the link to the account. We don't store your IP address or browser details for this. We keep the record while the consent is valid and for 3 years afterwards.
6 · Third-party services
Stripe (card payments): on pages with a payment form we load the Stripe script, which sets the cookies __stripe_mid and __stripe_sid to protect payments against fraud. When a payment is verified (3D Secure), Stripe and your bank may use their own cookies on their domains under their own policies.
Google and Apple: if you sign in with Google or Apple, we redirect you to their sign-in page, where their cookie policies apply.
Marketplace map: your browser downloads map tiles from MapTiler or, as a fallback, OpenFreeMap. No cookies are set, but the tile provider sees your device's IP address. If you allow the map to use your location, it is used only in the browser to zoom the map and is not sent to our server.
7 · Browser settings
You can also delete or block cookies in your browser settings. If you block necessary cookies, signing in and payments won't work.
8 · Mobile app
The SUBVY mobile app doesn't use cookies. It stores the sign-in token in the device's secure storage and app settings (language, appearance) in the app's storage. There are no analytics or advertising tools in the app. We send push notifications only if you allow them in your phone settings.
9 · Changes and contact
We may update this policy, for example when we add a new cookie. We will notify you of significant changes and ask for new consent for optional cookies.
Send questions about cookies and personal data to dpo@subvy.cz.