Cookie Policy – MAM
Last updated: [[EFFECTIVE_DATE]]
This Policy explains how MAM uses cookies, browser local storage and comparable technologies on its website, web-based interfaces and, where applicable, web pages displayed inside mobile applications. It applies to visitors and to Employer, Employee, Private, Partner, Merchant Cashier and Administrator users when accessing the relevant interfaces.
It complements the Privacy Policy and should be read alongside the Terms and Conditions. Accepting the Terms, acknowledging the Privacy Policy and choosing optional cookies are separate actions.
1. Controller and contact details
For technologies managed directly by MAM, the controller is [[CONTROLLER_LEGAL_ENTITY]], whose registered address is [[FULL_REGISTERED_ADDRESS_AND_COUNTRY]]. For questions about cookies, privacy choices and personal data, contact [[MONITORED_PRIVACY_EMAIL]]. Certain optional external services may process data under their own privacy notices and legal responsibilities.
2. Cookies, localStorage, sessionStorage and similar identifiers
A cookie is a small piece of information stored by a browser that can be sent to the relevant domain on subsequent requests. localStorage allows a browser to retain settings or identifiers until removed; sessionStorage generally retains them for the current tab or browsing session. Technologies can be first-party or associated with an external service. They may contain identifiers relating to identifiable people and should not automatically be regarded as anonymous.
Accessing or storing information on a user's device is governed by applicable ePrivacy rules and, where personal data is involved, the GDPR. Legal classification depends on the purpose and functionality, not simply the technical name used.
3. Categories, purposes and permission requirements
- Strictly necessary technologies: authentication, session continuity, fraud prevention, security, transaction integrity, navigation and preferences explicitly requested by the user, such as their preferred language. Within the applicable strictly necessary exemption, prior consent is not required, although transparent information must be provided.
- Optional analytics technologies: if introduced, these may measure website/app usage and interface performance. They must satisfy applicable requirements and, where no exemption applies, be enabled only following valid user choice.
- Optional advertising or profiling technologies: if introduced, these may measure advertising campaigns or personalise advertising, including through outside providers. They are not required for core MAM functionality and require prior consent where legally applicable; additional operating-system permissions may be necessary on iOS.
Status of the reviewed version: the presence of “Analytics” and “Marketing” options in the cookie banner does not establish that such tools are in use. No specific Google Analytics tag or advertising pixel was found in the reviewed web application source. MAM's internal operational and financial analytics (for example, wallets, reserves, transactions and business dashboards) should not be confused with behavioural advertising tracking. The live inventory must be revised if tags, SDKs or providers change.
4. MAM technologies identified in the web application
The table distinguishes actual HTTP cookies from values held in browser local or session storage. These identifiers were found in MAM's application code; a live browser/domain audit is still required to identify any additional infrastructure-managed identifiers.
| Name or identifier | Technology and operator | Purpose | Duration or criterion |
|---|---|---|---|
sidebar_state | First-party cookie, path / | Remembers whether the navigation sidebar is expanded or collapsed. | Up to 7 days from setting, unless removed earlier. |
mam_lang | MAM localStorage | Stores the chosen EN/IT language and supports local number/date presentation. | No automatic expiry was found in the reviewed code; remains until replaced or deleted. |
mam_cookie_consent_v1 | MAM localStorage | Stores category-level choices made in the banner and the timestamp of the choice. Recording a preference does not mean all optional categories were accepted. | No automatic expiry was found in the reviewed code; remains until replaced or deleted. |
mam_partner_referral | MAM sessionStorage | Temporarily keeps Partner invitation/referral context during sign-up. | Browser-tab session, with application removal after completion or invalidation where applicable. |
app-mfa-pkce:… | MAM sessionStorage | Temporarily holds a PKCE cryptographic verifier for an authentication step. | Browser-tab session or removal when the authentication flow completes, depending on the flow. |
| Infrastructure-managed session and authentication identifiers | Cookies and/or storage managed by Base44 | Login, session continuity, security and abuse prevention. | Depends on the provider's effective session configuration; [[VERIFY_AUTH_COOKIE_NAMES_DOMAINS_AND_DURATION]]. |
5. External providers and redirects
Some MAM features allow interaction with external providers. Those providers may use their own cookies or other identifiers on their respective domains or hosted pages, as needed and under their own notices:
- Base44 and infrastructure providers: application hosting, authentication, sessions and MAM backend features. The exact infrastructure-managed identifiers need live browser verification.
- Google: when you choose Google sign-in, the browser may visit Google domains and use their security and sign-in mechanisms. Google Privacy Policy.
- Stripe: when you start checkout, subscriptions, connected-account verification or payments, Stripe-hosted pages or tools may employ their own mechanisms for secure payment processing and fraud prevention. Stripe Privacy Policy.
This list describes integrations used in MAM flows; it does not assert that every listed provider installs a specific third-party cookie on every visit. Before public release, the actual cookie names, domains, providers and lifetimes must be checked: [[VERIFIED_THIRD_PARTY_INVENTORY]]. Facebook/Meta, Google Analytics and other advertising-network cookies are not described as active without technical evidence.
6. Banner and choices
On a first visit to public-facing pages, if no stored choice exists in the current browser, MAM shows “Accept all”, “Reject non-essential” and “Manage preferences”. “Analytics” and “Marketing” are off by default; strictly necessary functionality stays enabled. Merely browsing, scrolling or reading a policy is not agreement to optional storage.
Choices are currently stored locally in the browser rather than automatically shared across all devices or user accounts. Any actual optional tracking implementation must honour these choices before it loads: recording a selection in a banner is not, on its own, permission to install optional identifiers.
7. Rejecting, changing and withdrawing choices
You can reject non-essential cookies using the initial banner. If the banner is no longer displayed after a saved choice, the reviewed web version currently allows you to clear MAM website data in your browser settings and reload the page to display the banner again. This can sign you out and remove other local preferences. If the version you are using offers a persistent cookie-preferences control, you may instead use it directly.
You may also contact [[MONITORED_PRIVACY_EMAIL]] to exercise applicable rights. Deleting MAM browser data does not automatically remove cookies held on other providers' domains or delete data held in your MAM account. Withdrawing consent does not invalidate processing lawfully performed before withdrawal, but further processing based on that withdrawn consent must cease.
8. Browser and operating-system settings
You can inspect, block or remove cookies using your browser settings (for example, Chrome, Safari, Firefox, Edge or a webview browser). Exact steps vary by product and version. Blocking strictly necessary cookies or clearing website storage may log you out, remove preferences or affect requested features.
Operating-system permissions (such as advertising identifiers, cross-app tracking, notifications or Merchant cashier camera access) are separate from cookie preferences. When applicable, iOS and Android permissions must be requested and managed through the appropriate system mechanisms; accepting this Policy does not grant those permissions.
9. Mobile apps, webviews and embedded content
The same web pages, when opened within an app or webview, may use browser-style cookies and storage. Native components and SDKs can instead rely on secure storage or other device identifiers. Information about data categories, permissions, purposes and recipients appears in the Privacy Policy and, where relevant, in the disclosures required by the Apple App Store and Google Play. Store declarations must match the features and SDKs of the actual released app.
10. Lifetimes, retention and renewed choice
Some values exist for one session; others remain for a defined period or until manually cleared, as described above. The reviewed MAM implementation has no automatic renewal deadline for mam_cookie_consent_v1; a periodic renewal interval must be configured before public release: [[COOKIE_PREFERENCE_RENEWAL_INTERVAL]]. New choices may be needed when purposes or involved third parties change materially, in line with applicable law.
When cookie or similar identifiers are associated with a person, any separate server-side retention of that personal data follows the purposes and retention information in our Privacy Policy; it need not be the same as the lifetime of the identifier stored on your device.
11. Personal data, safeguards and international transfers
Identifiers, IP addresses, device data and diagnostic logs may be personal data. Processing, external recipients, security safeguards, any transfers outside the EEA and data-subject rights are discussed in our Privacy Policy. The existence of a foreign service provider does not alone establish that data travels to a particular country: destinations and safeguards must be verified for the services actually used.
12. Children and optional technologies
MAM does not intend to use profiling technologies specifically to target children. Eligibility and minimum-age requirements are covered by the Terms and Conditions and the Privacy Policy. Any future child-directed functionality would require a specific assessment of the applicable protections and consent requirements.
13. Updates to this Policy
This Policy may be revised as the app, providers, storage mechanisms or applicable requirements change. The current version is available at /cookies. Where required, users will receive additional information and be asked to make new choices. The technical inventory should be maintained using browser/network checks against actual release builds.
14. Contacts and supervisory authorities
For questions about cookies and personal data: [[CONTROLLER_LEGAL_ENTITY]] — [[MONITORED_PRIVACY_EMAIL]]. You may also contact the competent data protection authority, including the Spanish Data Protection Agency (AEPD) or the Italian Data Protection Authority (Garante), depending on the relevant jurisdiction.