Cookies

Short version: the booking widget sets no cookies, and the dashboard sets one.

The booking widget sets nothing

This is worth stating plainly because it is unusual, and because it decides whether a business needs a cookie banner on account of us. It does not.

The widget runs in an iframe, and the page inside it is served without a session, without cookies and without a CSRF token. That is not a stripped-down mode; it is how the surface was built. Third-party cookies are blocked inside an iframe by every browser that matters, so a flow depending on one would have been broken before it started.

The widget authorises its own requests with a short-lived token it holds in memory for the length of the visit. Nothing is written to the visitor's device, and nothing survives the tab being closed. Adding the widget to a website therefore adds no cookies to it, and no consent obligation on our account.

The dashboard sets one

Name	Purpose	Lifetime
lazavee-session	Keeps a signed-in person signed in, and carries the token that stops a third party from submitting forms on their behalf. Strictly necessary: without it there is no way to log in.	120 minutes of inactivity

It is marked HttpOnly, so no script can read it, and Secure in production, so it never travels over a plain connection. It is not used for analytics, profiling or advertising, and there is nothing to opt out of — refusing it means being unable to sign in.

What we do not do

• No advertising or cross-site tracking cookies, anywhere.
• No third-party analytics inside the booking widget.
• No fingerprinting in place of cookies.

The one piece of device information the widget does read is the browser's time zone, which is used to show appointment times correctly rather than guess. It is stored with the booking, not used to identify anybody.