What is a cookie and what is it for?
A cookie is a small text file that a website places in your browser (Chrome, Safari, Firefox, Edge…) to remember information between visits or pages.
On Viatous, some cookies are required for sign-in and payment. Umami separately measures site traffic without using cookies. On the web version only, Google Ads, Meta and TikTok may set or read advertising identifiers only after your consent.
This policy describes the categories used, their purposes, lifetimes and legal bases. It applies to www.viatous.com and separately explains the mobile application context.
Full transparency. Before your choice, no advertising code is loaded and no advertising event is sent. Refusal does not prevent browsing, registration, participation or payment.
Cookies set by Viatous
The cookies used depend on your actions: sign-in, advertising choice or return from Google. Some are used before sign-in is complete. The advertising attribution cookie remains optional.
| Name | Purpose | Duration |
|---|---|---|
token | Maintain your signed-in session. | 15 minutes |
refreshToken | Renew your session without immediately asking for your password again. | 60 days |
_gac | Complete the return from Google sign-in, then be deleted after reading. | 60 seconds |
viatous_google_state | Verify that the Google return matches a sign-in started in your browser. | 10 minutes |
viatous_ad_consent_v1 | Remember your acceptance or refusal and allow Viatous to verify it when processing requests. | Choice validity: 180 days |
viatous_ad_source | Only with advertising consent, temporarily preserve the originating page during Google sign-in. | 10 minutes |
viatous_brand_delivery | Secure the temporary portal session used by the brand to arrange and confirm product handover. | 30 minutes of inactivity, up to an absolute limit of 8 hours |
viatous_brand_benefits | Secure the temporary portal session used by the brand to manage its offers and partner codes. | 30 minutes of inactivity, up to an absolute limit of 8 hours |
In production, session cookies are sent over a secure connection and the main session tokens are not accessible to page scripts. These safeguards do not mean that all cookie contents are encrypted or that every cookie has identical protections.
Local storage (non-cookie)
Your browser may also remember information in local storage or storage limited to a tab. Viatous uses it for:
- your advertising choice and its date, in
viatous_cookie_consent_v1; - language, sign-in state and the displayed account type;
- a referral code or return destination during sign-in;
- your sound preference and dismissal of some activity information;
- the reference and amount of a withdrawal request, to retrieve its status and avoid unintended repetition.
- a temporary
viatous:partner-benefit-claim:<offerId>identifier, associated withclaim_request_id, to prevent one benefit claim from consuming gems twice or assigning two codes; it is removed after a successful claim or when the tab is closed.
These items have different lifetimes: some are cleared after use, others when the tab closes, while others remain until replaced or deleted in your browser settings. Your advertising choice is valid for 180 days.
Mobile application: sign-in tokens are kept in application storage and removed on sign-out or session revocation. Web advertising tracking is disabled in the native application and in embedded pages opened for that purpose.
Some information, such as sign-in tokens, a referral code or a withdrawal reference, is transmitted to Viatous when needed for the requested service. This storage does not, by itself, constitute an advertising profile.
Security, payments and third-party services
Google sign-in (optional)
The “Sign in with Google” button redirects you to accounts.google.com. Cookies set on that domain are governed by Google's policies.
Stripe payments
On a payment page, Stripe.js may set __stripe_mid (up to 1 year) and __stripe_sid (about 30 minutes) to secure the transaction and prevent fraud. These cookies are necessary for the requested payment and are not used for advertising.
Optional advertising measurement
Only after consent, Google Ads, Meta and TikTok may set or read measurement identifiers such as _gcl_*, _fbp, _fbc, _ttp or _tt_enable_cookie. Their exact names may change depending on the browser and provider documentation. Google Ads currently measures authorised public pages, campaign views, registrations, web card checkout starts and confirmed paid participations. Meta and TikTok may also connect an ad visit or click to a registration, checkout start or paid participation.
No loading before consent. Advertising code and related server calls remain inactive until the advertising category has been accepted.
Cloudflare protection
Cloudflare and its Turnstile check help protect the site and participation flows from automated access and abuse. Depending on the protections triggered, security cookies such as __cf_bm or cf_clearance may be used. Their presence and lifetime depend on the check and configuration applied; they are not used for advertising measurement. Turnstile does not systematically set a clearance cookie.
A technical device fingerprint may also be calculated to limit abuse involving registration or participation. It is separate from advertising identifiers.
Optional advertising, never data resale
Viatous never sells or rents your personal data. With your prior consent, the web version may activate Google Ads to measure authorised public pages, campaign views, registrations, web card checkout starts and confirmed paid participations, Meta Pixel and Conversions API, and TikTok Pixel and Events API to measure page views, campaign views, registrations, checkout starts and paid participations.
Depending on the event and available information, those services may receive the visited URL, campaign identifier and name, category, amount and currency, a deduplication event ID, click or browser identifiers, IP address, user agent and, for matching, hashed contact data such as email, phone number, first name, last name, country or an internal identifier.
Umami separately measures site traffic without using cookies. The anti-fraud device fingerprint is also separate and is never used for ad targeting.
Refusing advertising trackers does not prevent browsing, registration, participation or payment. It only disables personalised advertising measurement.
Legal basis and consent
Cookies needed for sign-in, security, remembering your choice or a requested payment enable those functions. Strictly necessary trackers may be used without prior advertising consent.
Google Ads, Meta and TikTok advertising trackers and transmissions require your prior consent. You can accept or refuse in the banner, then change your decision through “Manage cookies”.
Umami is used separately to measure audience without advertising cookies. The absence of cookies does not by itself establish an exemption from consent: that depends on the information processed and the actual conditions of audience measurement.
Withdrawing consent stops advertising tracking for subsequent browsing. It does not automatically erase information already transmitted while your consent was valid. Contact us about requests relating to that data.
Manage your choices
The “Manage cookies” button and footer link let you access your advertising choice. You can refuse advertising trackers without losing access to browsing, registration, participation or payments.
When you withdraw consent, Viatous disables tracking through advertising tools and deletes advertising cookies on its domain that the application can access. Viatous cannot delete every cookie on provider domains; you can manage these through your browser.
Deleting the stored choice brings the request back on a later visit. Blocking all necessary cookies may prevent sign-in or disrupt payment.
Retention periods
Lifetimes for Viatous cookies appear in the table above. Acceptance or refusal is valid for 180 days from your decision. Validity is checked when the stored choice is read; an expired choice leads to a new request.
The 60-day lifetime concerns the renewal token issued: session renewal may issue a new token. Signing out removes the main session cookies. It does not necessarily delete your preferences, advertising choice or third-party cookies.
Provider cookie lifetimes depend on their settings and changes. The Stripe lifetimes above are separate from Viatous cookie lifetimes. For Cloudflare security cookies and advertising identifiers, also consult the provider’s information.
Updates to this policy
This cookies policy may be updated at any time to reflect a technical change (addition or removal of cookies), a regulatory change (CNIL, ePrivacy, GDPR evolutions) or an editorial change.
The version applicable at a given time is the one published at the date of your visit. The "Last updated" notice at the top of the page identifies the version in force.
Any change introducing a tracker subject to consent will result in an update to this policy and, where necessary, a new consent request before the tracker is activated.
Contact and complaints
For questions about cookies or your personal data, email [email protected]. Our Privacy Policy explains your rights and how to make a request.
You may also lodge a complaint with the CNIL.