Cookies and Similar Technologies Policy
Provisional inventory of storage and technical requests identified in ReviewFlow. Classification and published traffic require validation.
Provisional Early Access draft — not a final document or a declaration of legal compliance. “To confirm” and “To validate” items must be resolved before starting personal-data processing. Free use does not remove these obligations.
Scope and controller
This policy covers cookies and other ways to store or read information on a device. ReviewFlow is the service brand; controller identity and address for notices: to confirm. Contact: reviewflow.geral@gmail.com. No cookies observed in a test does not mean no personal-data processing.
Language preferences
localStorage: reviewflow:commercial-lang on commercial pages and reviewflow:lang in feedback store the selected language. The code sets no expiry; values may remain until cleared by the browser or user. To validate: necessity, grounds for storage/access and appropriate duration. A preference is not automatically classified as consent-exempt.
Authentication
The authentication client retains the account session in local storage and may refresh it. It supports authenticated access; actual token settings, any additional storage and duration need confirmation on the published service. No session identifiers or contents are reproduced in this policy.
Submissions and reading position
sessionStorage: reviewflow:submission:<restaurant>/<point> retains the attempt identifier; reviewflow:done:<restaurant>/<point> retains completion to prevent repeating a real submission. The isolated demo does not create these feedback markers or store responses. The router uses tsr-scroll-restoration-v1_3 for reading-position restoration, observed in the preview browser. This storage is intended for the tab session; browser session restoration may affect duration. The real flow also reads a legacy reviewflow:demo-from-home marker; no creation by current commercial pages was identified. To validate: necessity and maintenance of each key.
Cookies and unused components
No cookies were observed when testing public preview pages without authentication. A sidebar component in the code could store sidebar_state for seven days, but no uses were found on current pages. It is not presented as an active cookie. Verify hosting, session or security cookies on the published version and after authentication.
External requests and tracking
Google Fonts and Google Static receive requests to load Sora and Manrope and may receive IP addresses and connection metadata. Visual assets and hosting/error mechanisms need inclusion in the recipient review. No advertising pixels or explicit audience-analytics libraries were found in the inspected code; this does not establish an absolute absence of tracking on the published version.
Consent and controls
No optional-technology consent panel currently exists. Before activating non-strictly-necessary storage/access, assess Article 5 of Portuguese Law 41/2004 and implement prior consent where required. No banner was added without identifying a concrete need. Browser settings can manage cookies and storage; clearing data may end your session, reset language and remove duplicate-feedback markers. These controls do not replace consent where required.
Validation before the pilot
Confirm the published inventory with and without a session, token/cookie durations, necessity of each mechanism, providers and transfers, user information and any consent requirements. Technical storage durations above are code observations, not retention periods for data stored in the service.