Legal

Cookie Notice

Last updated: 16 July 2026

⚠️ Template — pending legal review

The cookie list is accurate for what the app currently does. Before onboarding paying customers, run the wording through Termly or a lawyer. If you later add analytics or ads, update this list and switch the banner to a consent banner with a reject option.

What we use cookies for

GICATI uses only strictly necessary cookies — the kind that keep you signed in and remember what language you chose. We do not use advertising cookies, third-party analytics cookies, or tracking pixels.

Because we only use necessary cookies, we do not need to ask your permission to set them. If we ever add optional cookies (analytics, ads), we will show a proper consent banner with a “reject” option and update this notice.

Exactly what we set

Cookie	Purpose	Lasts	Set by
`sb-*-auth-token`	Keeps you signed in to /admin, /pos, or /super. Required for authenticated pages to work.	7 days (renewed on activity)	Supabase (via the app)
`pay4_lang`	Remembers your menu language choice (English, Arabic, Kurdish, Turkish).	1 year	GICATI (in-browser only, not a cookie technically — stored in localStorage)
`pay4_cookie_notice`	Remembers that you dismissed the cookie notice banner.	1 year	GICATI (localStorage)

Third parties

Cookies set by our infrastructure providers (only when you use those parts of the platform):

Supabase — authentication tokens (only after you sign in). See their privacy policy.
Vercel — anti-bot session cookie for hosting. See their privacy policy.
Cloudinary — no cookies from us, only image hosting.

Turning cookies off

You can clear or block cookies in your browser settings, but if you block the Supabase session cookie you will not be able to sign into /admin, /pos, or /super. Nothing on the public site (menus, /for-restaurants, /events) requires cookies to view.

Contact

Questions about cookies? Email hello@gicatipos.com.