Cookie Policy

1. What cookies are

A cookie is a small text value stored by a browser and returned to a website with later requests. Similar local-storage technologies may serve related purposes. Cookies can be first-party, set by the site being visited, or third-party, set in the context of another provider.

The identifiers below do not themselves contain payment-card data or the text of intake answers. They may nevertheless be personal data when linked to an account, request or device and are protected as described in the Privacy Policy.

2. Strictly necessary BookFrom cookies

• Session cookie — the technical name depends on deployment and is commonly PHPSESSID. It maintains login state, language and the continuity of booking, OAuth and security flows. It is first-party, HttpOnly, SameSite=Lax, sent only over HTTPS in production and expires after up to 2 hours. The exact browser lifetime can end sooner when you sign out or close the relevant session.
• CSRF protection cookie — names begin with csrf-token_ on local HTTP or __Host-csrf-token_ on production HTTPS. It is a first-party, short-lived value used to prove that a state-changing form came from the same browser and to prevent cross-site request forgery. It is SameSite=Strict, Secure on HTTPS, readable by BookFrom's form-protection script and removed after the protected submission.
• bf_cookie_consent — remembers your accept/refuse choice, preference version and choice time for up to 180 days. It is first-party, SameSite=Lax, Secure on HTTPS and readable by the preference script. It does not contain your account identity.

These cookies are necessary for a service explicitly requested by the User, account authentication, transaction continuity and security. Blocking them can prevent login, payment preparation, account changes or form submission from working correctly.

3. Provider sites and redirects

When you choose a payment method, Google Login or Google Calendar connection, your browser may be redirected to Mollie or Google. Those providers may set cookies on their own domains for authentication, fraud prevention, preferences or other purposes determined by them. BookFrom cannot read or control cookies set solely on provider domains.

Review the provider's cookie and privacy information before continuing. Returning to BookFrom does not allow BookFrom to repurpose provider cookies for advertising.

4. Development-only tools

In a non-production development environment, Symfony debugging or profiling tools may use additional technical cookies or headers. Those tools are disabled for public production visitors and are not part of the production cookie set described above.

5. Managing cookies

You can inspect, delete or block cookies in browser settings. You can also sign out to end an authenticated session. Blocking all cookies will disable essential parts of BookFrom because the Platform cannot securely preserve authentication and multi-step transaction state without them.

Use “Reject optional”, “Accept analytics” or “Preferences” in the banner. The Analytics option is off by default. You can reopen “Cookie preferences” in the footer at any time and refuse optional cookies or save an updated choice. Withdrawal stops measurement, removes BookFrom Analytics cookies and reloads the page to unload the tag. Your choice is remembered for up to 180 days; after it expires or is deleted, we ask again. Essential cookies remain active.

6. Retention and changes

Cookie lifetimes are stated above. Server-side records associated with a cookie may follow the retention periods in the Privacy Policy and may be retained longer than the browser value where required for security, transaction evidence or law.

We may update this Policy when browser storage or providers change. The current version and effective date appear on this page. Material additions of optional storage will be presented before activation where consent is required.

Questions about cookies or privacy can be sent to armand@kirie.ro. Technical support is available at armand@kirie.ro.

7. Optional Google Analytics

Only after consent, BookFrom loads Google Analytics 4, provided by Google Ireland Limited, to measure visits to the landing page, published profiles, published services and legal pages. Google receives a pseudonymous browser identifier, public page address and title, a referring-site origin, browser/device information and technical request data. Google Analytics states that individual IP addresses are not logged or stored in GA4. Account pages, authentication, checkout, private booking links, intake answers, billing data, email addresses and URL query parameters other than the public language choice are not sent by our page-view implementation.

The first-party _ga and _ga_<measurement-id> cookies identify a browser and maintain session information. BookFrom configures a maximum lifetime of 180 days without automatic extension. Google Analytics event-level data is retained for 2 months; aggregated reports may remain longer. Consent is the basis for optional measurement. No Analytics script or measurement request is sent before acceptance or after refusal. Google may process data outside the EEA under the safeguards described in the Privacy Policy. For Google’s details see https://policies.google.com/privacy and https://support.google.com/analytics/answer/6004245.