Cookie Notice — MINOMO

What cookies are

Cookies are small text files that a website places in a user’s browser when they visit it. They are read automatically by the browser on subsequent requests to the same site and serve various purposes: keeping a login session active, remembering preferences such as language, or — in their more intrusive form — tracking a user’s browsing across multiple sites to build advertising profiles.

Cookies are distinguished primarily by duration:

• Session cookies: these exist only for the duration of the browser session. They are deleted automatically when the browser is closed.
• Persistent cookies: these have a defined expiry date and remain on the device even after the browser is closed, until they expire naturally or are deleted by the user.

And by origin:

• First-party cookies: placed directly by the website you are visiting, under its own domain.
• Third-party cookies: placed by a domain different from the website you are visiting — typically an external analytics, advertising, or social-media service embedded in the page.

Cookies and similar technologies

Beyond cookies in the strict sense, there are other client-side storage technologies worth distinguishing.

localStorage and sessionStorage: These are browser storage areas accessible via JavaScript. Unlike cookies, they are not sent automatically to the server with HTTP requests, although the app reads some of their content (for example the sign-in token) and sends it to our servers with your requests. In the app, localStorage holds:

• the access tokens of your session (on the web version, also the refresh token) and a copy of your profile (email, name, city, preferences), so that the app does not ask for them at every opening;
• the last position you used with MINA, and the city you chose. This position is kept until you clear the app’s data from your browser or device settings;
• your notification preferences, the proposals you have already seen or dismissed, and the state of some screens.

IndexedDB: A structured database in the browser. In the app it holds a backup copy of your device identifier, your profile and your access token (database minomo_backup), used to keep you signed in if the browser clears other storage.

Service Worker and Cache API: The Service Worker is a script that the browser runs in the background. The MINOMO PWA uses it to cache the files of the application (HTML, CSS, JavaScript, interface images) via the browser’s Cache API, so that the app opens quickly and can work offline. It contains no personal data.

In native apps for iOS and Android the system’s secure storage holds the device identifier and the refresh token.

All of this is needed to give you the service you asked for (staying signed in, using the app in your language and city). It is not used for advertising or profiling.

Why you won’t find a cookie banner on MINOMO

The absence of a banner is a deliberate choice, with a precise legal basis.

The applicable framework consists of:

• Directive 2002/58/EC (ePrivacy Directive), implemented in Italy by Legislative Decree 196/2003 as amended by Legislative Decree 101/2018;
• Regulation (EU) 2016/679 (GDPR);
• the Italian Data Protection Authority Guidelines of 10 June 2021 (Decision no. 231) — “Guidelines on cookies and other tracking tools”.

The Guidelines make it clear that prior user consent is required for placing or reading cookies and similar tools that are not strictly necessary for the operation of the service. Technical cookies and storage that are strictly necessary to make what the user has explicitly requested work — keeping the session active, remembering the chosen language, protecting the site from bot attacks — do not require consent. For these, it is sufficient to describe them in a notice, which is the document you are reading.

MINOMO sets only cookies and storage of a technical nature. There are no profiling cookies and no third-party cookies for advertising. Our audience measurement (Matomo, self-hosted) uses no cookies and no identifier. To keep it that way:

• the fonts of the site are served by MINOMO itself, not by a third party;
• the chat assistant (InfoPilot) and the Sign in with Google script are loaded only when you click on them.

Cookies and storage used by MINOMO

Below is the inventory, organised by domain.

Showcase website minomo.io

The showcase website does not set its own cookies. Cloudflare, which provides perimeter protection and CDN, may automatically place the following technical cookies only when its anti-bot protection is triggered (for example, during a challenge on a protected form):

Name	Purpose	Duration	Category	Legal basis	Party
__cf_bm	Cloudflare Bot Management. Distinguishes human traffic from automated traffic to protect forms and pages from abuse and attacks.	30 minutes	Strictly necessary	Art. 6(1)(f) GDPR — legitimate interest in platform security	Third party (Cloudflare, Inc.)
cf_clearance	Records the passing of a Cloudflare security challenge, preventing the challenge from being presented again for the duration of the cookie.	30 minutes	Strictly necessary	Art. 6(1)(f) GDPR — legitimate interest in platform security	Third party (Cloudflare, Inc.)

Cloudflare Turnstile — the anti-bot verification we use on the contact form in place of reCAPTCHA — does not set its own tracking cookies.

Chat assistant (InfoPilot). The chat assistant is not loaded when you open a page. Only if you click to open it, the script of the chat provider is loaded; from that moment the provider may use its own cookies or storage, as described in its own notice.

Outside these cases, browsing minomo.io does not place any cookies.

App app.minomo.io (also inside the iOS and Android apps)

Name	Purpose	Duration	Category	Legal basis	Party
minomo_device_id	Technical device identifier, valid across the minomo.io subdomains. It keeps your session active on that device and allows it to be revoked in the event of loss or device change. It is not an advertising identifier.	365 days	Strictly necessary	Art. 6(1)(b) GDPR — performance of a contract	First party (AVi Kairos Srl)
minomo_lang	Stores your language preference (it, en, ro).	1 year	Strictly necessary	Art. 6(1)(b) GDPR — performance of a contract	First party (AVi Kairos Srl)
minomo_visited	Remembers that you have already seen the welcome page.	365 days	Strictly necessary	Art. 6(1)(b) GDPR — performance of a contract	First party (AVi Kairos Srl)

The cookies carry the SameSite=Lax attribute: they are not sent in cross-site requests initiated by third parties. Local storage is described in the section “Cookies and similar technologies”.

Maps and other services called by the app. To show maps the app downloads images from CARTO and OpenStreetMap; for some functions it calls OSRM, OpenStreetMap Nominatim and Open-Meteo; the QR code of a loyalty card is generated by a QR image service. These services receive your IP address and the data needed for the request (for example the map area you are viewing); see the Privacy Policy. On the sign-in page, Sign in with Google loads a script from Google only when you click on it.

Panels (merchants, City Agents, Country Managers, distributors, municipalities, administration)

The panels are accessible only to authenticated users. They use these first-party cookies:

Name	Purpose	Duration	Category
Session cookie (…-session)	Keeps your working session open. It carries the HttpOnly and Secure attributes.	120 minutes	Strictly necessary
XSRF-TOKEN	Protects forms from forged requests.	Same as the session	Strictly necessary
minomo_2fa_trust_{id}	Remembers that you have already passed two-factor verification on this device.	30 days	Strictly necessary
staff_lang	Language of the app for the staff of merchants.	Persistent	Strictly necessary

Municipal pages

The public pages of municipalities that MINOMO runs on the municipalities’ own domains do not set cookies. See Municipal pages.

Third-party cookies for marketing or analytics purposes

We do not use any. No MINOMO domain loads third-party scripts that place cookies for advertising profiling, retargeting, behavioural analytics, or social tracking.

Audience measurement (Matomo, self-hosted, cookieless)

To understand how our pages and the app are used we run Matomo, an open-source analytics tool self-hosted on our own infrastructure (matomo.minomo.io):

• No cookies. Matomo runs with disableCookies: it does not write a cookie on your device.
• No account identifier. We do not pass your account identifier to Matomo: visits are not linked to your account and are not followed across your devices.
• First party only. The data stays on our servers. It is never sent to Google or any other third party.
• Aggregate purpose. We use it to produce aggregate statistics (page views, links tapped, referrers, approximate country or region, web or app), not to profile people.
• Do Not Track is not applied. If your browser sends a Do Not Track or Global Privacy Control signal, Matomo still measures the visit, within the limits described above.

The legal basis is our legitimate interest (Art. 6(1)(f) GDPR) in measuring and improving the service. You can object at any time by writing to [email protected].

What we don’t use

No MINOMO domain uses any of the following services:

• Google Analytics or Google Tag Manager in any configuration;
• Meta Pixel (Facebook/Instagram Pixel) or Facebook Conversions API;
• LinkedIn Insight Tag;
• TikTok Pixel;
• Hotjar, Mouseflow, FullStory, LogRocket, or any other session recording and heatmap tool;
• Mixpanel, Amplitude, Heap, or other product analytics tools based on individual tracking;
• retargeting or remarketing cookies from any advertising platform;
• third-party affiliate tracking pixels.

MINOMO’s business model is not based on behavioural advertising.

How to manage cookies in your browser

You can control, limit, or delete cookies at any time from your browser settings. Below are links to the official guides for the main browsers:

• Google Chrome: support.google.com/chrome/answer/95647
• Mozilla Firefox: support.mozilla.org — Enhanced Tracking Protection in Firefox
• Apple Safari: support.apple.com — Manage cookies in Safari
• Microsoft Edge: support.microsoft.com — Delete cookies in Microsoft Edge
• Opera: help.opera.com — Web preferences, cookies

For managing the app’s local storage (Cache API, IndexedDB, localStorage), the main browsers provide tools in the Developer Tools (DevTools), under Application > Storage, or in the site settings for the app.minomo.io domain.

What happens if you disable technical cookies: The cookies we use are strictly necessary. If you block or delete them:

• on the showcase website minomo.io you will notice no practical difference during ordinary browsing;
• on the app app.minomo.io you will not be able to keep an active login session between visits.

Changes to this Notice

When the inventory changes — because of new services, the removal of existing ones, or regulatory developments — we update this document and record the change in the change log below. If the change adds cookies that are not strictly necessary, we will notify you proactively with at least 30 days’ notice.

Change log

Version	Date	Main changes
3.2	7 October 2026	Corrected the inventory: what the app really keeps in local storage, cookie durations, panel cookies, the fonts served by MINOMO, the chat assistant and Google sign-in loaded only on click. Matomo: no account identifier, Do Not Track not applied.
3.1	17 June 2026	Added the first-party, cookieless audience measurement section (self-hosted Matomo), with its legal basis.
3.0	15 May 2026	First standalone version of the MINOMO Cookie Notice. Full inventory of cookies and local storage technologies, with explicit legal basis for the absence of a consent banner.
2.x	up to 14 May 2026	Legacy version inherited from the previous platform, no longer applicable.

Contact

For any questions about this Notice, the cookie inventory, or the exercise of GDPR rights:

• Privacy email: [email protected]
• Exercising your rights: minomo.io/en/legal/data-request/
• Postal address: AVi Kairos Srl — Strada Lungă 188, Corp C2, Ap. 2, Brașov 500051, România
• General enquiries: [email protected]

This Cookie Notice forms an integral part of MINOMO’s Privacy Policy.