Cookie Policy · Wallymanager

1. What cookies are

Cookies are small files that a website or an application may store on your device. Similar technologies are local storage, session storage, Service Worker, Cache Storage, software identifiers, scripts and web beacons. In this Policy we use the general term “cookies and similar technologies”.

2. Who uses these technologies

These technologies are used by „Уолимениджър“ ЕООД / „Wallymanager“ LTD, UIC: 208882840, address: 1A Skopie Street, floor 4, apt. 16, Yuzhen district, Plovdiv 4003, Republic of Bulgaria, as well as by a limited number of external providers, where this is necessary for sign-in, security, payments or another requested feature.

3. Categories of technologies

The cookies and similar technologies used fall into the following categories:

Category	Purpose	Examples	Consent
Strictly necessary	operation of the account, sign-in, security, session persistence, protection against abuse, payment, PWA/offline shell	JWT token and account identifier in localStorage; Google OAuth token; wm_cookie_consent; return‑url; wm_plan_selection_pending in sessionStorage; Service Worker and Cache Storage; Google reCAPTCHA v3; Google Identity Services; Stripe Checkout; session identifier	no consent is required where they are strictly necessary for the requested service
Functional	storing the choice made by the User — language and interface state — so that the Service is provided in the form in which it was requested	language; wm_finance_selected_tab; wm_planning_selected_tab; receipt:lastLocale; wm.featurePromotion.ackQueue; wm.quote.dashboardDismissedDate; wm.quote.fundDismissedDate; wm.quote.dashboardLastShown; Web App Manifest for installation as an application	no consent is required — these values store the User’s own choice and are necessary in order to provide the Service in the form in which the User has requested it
Analytics	measuring traffic, errors, feature usage and improving the service	Google Analytics 4, provided by Google Ireland Limited: _ga and _ga_ (followed by a stream identifier) cookies with a 2-year lifespan; a client identifier generated by Google's script; screens visited; traffic source (UTM parameters), stored in the browser's session storage under the key wm_utm_params until the end of the session; device type and browser; approximate location by IP address	prior consent is required, unless the law permits otherwise
Marketing	advertising, remarketing, campaign measurement, profiling for advertising	Meta Pixel, provided by Meta Platforms Ireland Limited: _fbp and _fbc cookies with a 3-month lifespan (_fbc is set upon a visit via an advertising link); the “registration”, “trial started” and “purchase completed” events. Meta Conversions API: the same purchase events, sent from the Provider's server to Meta, with an email address irreversibly hashed by SHA-256 as the identifier for matching and deduplication against the browser event	prior consent is required

4. Google reCAPTCHA and Google Sign-In

Google reCAPTCHA v3 and Google Identity Services may be loaded on the sign-in and registration pages. The purpose is protection against bots and abuse and facilitating sign-in with Google. When making a payment, the User may be redirected to a hosted Stripe payment page. These external services may process technical data and set their own cookies or identifiers, including on their own domains, in accordance with their own rules.

5. Analytics and marketing

We use the following analytics and marketing technologies. Each of them is loaded and activated only after your prior consent for the respective category. Google Analytics 4, provided by Google Ireland Limited — for measuring visits, feature usage and the user's path through the application. Activated only with consent for the “Analytics” category. Meta Pixel and Meta Conversions API, provided by Meta Platforms Ireland Limited — for measuring the performance of advertising campaigns, remarketing and forming advertising audiences. Activated only with consent for the “Marketing” category. Meta Conversions API sends purchase data directly from our server to Meta; the email address is transmitted only in an irreversibly hashed form (SHA-256) and is used solely to match the event. Consent for the “Analytics” category and consent for the “Marketing” category are given and withdrawn separately. Consent for one category does not constitute consent for the other. Google and Meta process the transmitted data under their own privacy policies and data processing terms, including transfer to the USA under the conditions described in the “International Transfers” section of our Privacy Policy. You can withdraw your consent at any time via the consent banner or through the privacy settings in your profile: Account → Privacy & Consent. After withdrawal, no new data is sent to the respective provider, and identifiers already set are removed from your device.

6. Managing your preferences

You can manage the optional cookies through the consent banner or through the privacy settings section: Account → Privacy & Consent. Withdrawing consent must be as easy as giving it. Strictly necessary technologies cannot be switched off through the banner, because without them the Service cannot operate securely or as requested by you.

7. Browser settings

Most browsers allow cookies to be deleted or blocked. If you block strictly necessary technologies, part of the Service may not work correctly, including sign-in, protection of the account, payments or the saving of settings.

8. Updates

We will update this Policy in the event of changes to the technologies used, the providers, the purposes or the legal bases.

9. Contact

For questions regarding cookies and similar technologies: „Уолимениджър“ ЕООД / „Wallymanager“ LTD, email: support@wallymanager.com, contact point for the protection of personal data: support@wallymanager.com.

For any questions about cookies and similar technologies, please contact our data-protection contact point at support@wallymanager.com.