Cookie Policy
Last updated: October 8, 2026
1. What cookies and similar technologies are
Cookies are small text files that a website can store in your browser when you visit a page. Besides cookies, we also use similar technologies that serve comparable purposes without being, technically, cookies — in particular your browser's storage (localStorage and sessionStorage), where identifiers or preferences can be saved on your device.
Legally, all of these technologies — cookies and any information read from or written to your terminal device through localStorage/sessionStorage — fall under the same rule: they may be used without consent only if they are strictly necessary to deliver the service you asked for. Anything else (traffic analytics, marketing, conversion measurement) requires your prior consent.
This policy explains exactly what we use on SALON TRANSILVANIA's booking site, for what purpose, for how long, and what requires consent.
2. The categories of cookies and technologies we use
| Name | Provider | Category | Purpose | Storage duration | Consent required |
|---|---|---|---|---|---|
| __Secure-next-auth.session-token | SALON TRANSILVANIA (first-party) | Strictly necessary | Keeps your sign-in session active (account/booking) | Session / up to 30 days | No |
| __Host-next-auth.csrf-token | SALON TRANSILVANIA (first-party) | Strictly necessary | Anti-CSRF protection when submitting forms and signing in | Session | No |
| cookie-consent-cmj2w4mlb0004fti9apf9cftw (in localStorage) | SALON TRANSILVANIA (first-party) | Strictly necessary | Remembers your consent choice and a random consent key (no personal data), so we don't ask on every visit; the same choice is recorded on the salon's server with the time and the banner version, never with your IP address | Persistent (until cleared) | No |
| thesalon_device_token (in localStorage) | SALON TRANSILVANIA (first-party) | Strictly necessary | Remembers this device so you skip SMS re-verification on your next booking | Persistent — up to 12 months, renewed on each booking | No |
| _pst (in sessionStorage) | SALON TRANSILVANIA (first-party) | Analytics | Session identifier for anonymous navigation and booking-funnel analytics | Session (cleared when the tab closes) | Yes |
| _pvid (in localStorage) | SALON TRANSILVANIA (first-party) | Analytics | Anonymous device identifier to detect returning visitors | Persistent (until cleared) | Yes |
| _putm (in sessionStorage) | SALON TRANSILVANIA (first-party) | Analytics | Stores the campaign source (UTM) for the session, for traffic attribution, and the ad-click identifier only while the marketing tags are allowed to run; turning Ads off deletes it | Session | Yes |
| _porigin (in sessionStorage) | SALON TRANSILVANIA (first-party) | Attribution — contains no identifier | Keeps where this visit came from — the campaign your own link already named in the web address (utm_source / utm_medium / utm_campaign), the referring host — and, when that host is an AI assistant, which assistant it is — the entry path and the salon's own public id (which names the salon, never you) — for the booking you are making, so the salon can tell which campaign, or which site, brought it. It is written when the link named a campaign, and equally when it named none and the site you arrived from is all there is to keep; when there is neither, nothing is written. It creates no identifier: two people arriving from the same ad store byte-identical content, it cannot be read on a later visit, in another tab or on another device, and it is sent nowhere except this salon's own booking form | Session (cleared when the tab closes) | No — written before consent; see the section below |
| _plpsd (in sessionStorage) | SALON TRANSILVANIA (first-party) | Analytics | Remembers how far down a campaign landing page you scrolled, so the same figure is not reported twice in one session. Holds a number between 0 and 100 and nothing else — no identifier. Written only after you accept analytics, together with the script above | Session (cleared when the tab closes) | Yes |
| primer:booking-consent:<id> (in sessionStorage) | SALON TRANSILVANIA (first-party) | Strictly necessary | Keeps, in this tab only, the handle for the booking you have just sent, so the confirmation page can offer you the marketing subscription for it. It exists only because you completed a booking, it is never written to anyone who did not, and closing the tab removes it | Session (cleared when the tab closes) | No |
| _pclk_cmj2w4mlb0004fti9apf9cftw (cookie) | SALON TRANSILVANIA (first-party) | Marketing | Remembers the latest ad-click identifier (TikTok, Meta or Google) that brought you here, so that a booking you make later or in another tab can be credited to that ad. Set by the salon's server only after you accept Ads, and readable only by the server; withdrawing Ads deletes it | 28 days, renewed by a new ad click | Yes |
| Google Analytics 4 (_ga, _ga_*) | Analytics | Aggregate audience statistics (pages viewed, duration, conversions) | Up to 24 months | Yes | |
| Google Ads (gtag.js, conversions) | Marketing | Advertising conversion measurement and remarketing | Up to 24 months | Yes | |
| Meta / Facebook Pixel (_fbp) | Meta Platforms | Marketing | Conversion measurement and custom audiences for Facebook/Instagram ads | Up to 3 months | Yes |
| TikTok Pixel | TikTok | Marketing | Conversion measurement and TikTok ad optimization | Up to 13 months | Yes |
| Microsoft Clarity (_clck, _clsk) | Microsoft | Analytics | Records how visitors use the pages (clicks, scrolling) to improve the site | Up to 12 months | Yes |
Note: the third-party cookies and tags (Google, Meta, TikTok, Pinterest) are configured per salon. Not all of them may be active on this site — only those enabled by SALON TRANSILVANIA appear.
3. The _pvid and _pst device identifiers are non-essential
We want to be explicit: the anonymous identifiers _pvid (in localStorage) and _pst (in sessionStorage), together with _putm and the scroll watermark _plpsd, are NOT strictly necessary for the site to function. They are used solely for traffic and navigation analytics.
Therefore, the script that creates and writes these identifiers to your device loads ONLY after you have given consent. Before consent, no _pvid, _pst, _putm or _plpsd is written to your browser.
The one NON-ESSENTIAL thing written before consent is _porigin (in sessionStorage): where this visit came from — the campaign your own link already named in the web address, or, when it named none, simply the site that sent you here (and, when that site is an AI assistant, which one) — kept for this tab only so the booking you are about to make can be credited to what actually brought you. It contains no identifier of any kind — see its row in the table above and the section below.
Everything else that is written without asking you first is strictly necessary and is marked as such in the table: your sign-in session, your consent choice itself, the device token that spares you an SMS, and primer:booking-consent:<id> — the handle for a booking you have just sent, which exists only because you sent it and which the tab removes when you close it.
4. Strictly necessary cookies (no consent needed)
The following technologies are indispensable for the site to work and for you to complete a booking securely. For these, the law does not require consent, and disabling them would prevent the service from functioning:
- Session cookie (__Secure-next-auth.session-token) — keeps you signed in while you use your account or complete a booking;
- Anti-CSRF cookie (__Host-next-auth.csrf-token) — protects forms against cross-site request forgery;
- Consent storage (cookie-consent-cmj2w4mlb0004fti9apf9cftw in localStorage) — remembers your own cookie choice so we don't ask again on every visit.
5. This site does not ask for consent
SALON TRANSILVANIA has switched the consent banner off on this site. The analytics and marketing tags listed above load when a page opens, without asking you first. Because no consent is recorded, nothing about your visit or your booking is sent from our server to any advertising platform. To object, write to SALON TRANSILVANIA using the details below, or clear this site's cookies and storage from your browser settings.
6. Who receives the data
Ad platforms (only if you accepted “Ads”): Google, Meta and TikTok. For collecting and sending the data and for measurement, SALON TRANSILVANIA S.R.L. and each platform are joint controllers; once received, the platform processes it as an independent controller. Basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time in Cookie settings.
Statistics tools (only if you accepted “Statistics”): Google and Microsoft. They receive what their tags collect on this site, to count and analyse visits.
This site and its booking system are run for SALON TRANSILVANIA by WISE PEOPLE S.R.L. (Primer), as its data processor.
TikTok
If you accept “Ads”, TikTok Pixel runs on this site.
The data: the cookie identifiers _ttp and ttclid, IP address, browser type, the page, the value and the service (as an identifier), and your phone number only in irreversibly encrypted (hashed) form. Purpose: measuring ads and showing them to interested people. SALON TRANSILVANIA S.R.L. and TikTok (TikTok Technology Limited, Ireland, and TikTok Information Technologies UK Limited) are joint controllers for collecting and sending this data and for measurement; afterwards TikTok processes it as an independent controller. We agreed that TikTok handles your data rights once it has received the data, and SALON TRANSILVANIA S.R.L. is responsible for informing you; essence of the arrangement: https://ads.tiktok.com/i18n/official/policy/jurisdiction-specific-terms. TikTok's legal basis and your rights towards TikTok: https://www.tiktok.com/legal/page/eea/privacy-policy/en. TikTok stores and accesses data outside the EEA as well (including the US, Singapore, Malaysia and China), under standard contractual clauses or adequacy decisions.
7. Who we are and how to contact us
This booking site is operated by:
- SALON TRANSILVANIA S.R.L.
- Company ID: 37525956
- Strada Republicii 105
- România
- Email: [email protected]
- Phone: 0770976325