Legal documents
Cookie policy
This page lists the cookies and similar technologies BauBauCar uses on the site, what they do, how long they last and how you can change your choices at any time.
Last updated: 28 October 2026
1. Who uses cookies
The controller is Wikilab Sas (REA RC-167401, VAT IT02408430805), which runs BauBauCar. Contact details and your rights are in the privacy notice.
This policy covers cookies and similar technologies, meaning information stored on or read from your device: cookies, the browser's local storage and session storage, and signals sent by third-party scripts.
2. How we classify them
- Necessary: they make the site and the services you ask for work (sign-in, security, language, payment). They do not need consent (art. 122 of the Italian Privacy Code and the Garante guidelines of 10 June 2021).
- Analytics and performance: they measure how the site is used and how it performs. Cookies in this category are set only with your consent.
- Marketing and advertising: no advertising or remarketing tool is active on BauBauCar today. The category exists in the banner because any future use will need your consent.
- We do not use profiling cookies.
3. Necessary cookies
BauBauCar sets them on its own domain. The __Secure- and __Host- prefixes in some names mark cookies sent only over a secure connection.
| Name | Purpose | Duration |
|---|---|---|
| baubaucar_cookie_consent | Remembers your cookie choices | 182 days |
| NEXT_LOCALE | Remembers the language you chose | Until you close the browser |
| __Secure-authjs.session-token | Keeps you signed in | 30 days, renewed while you use the site |
| __Host-authjs.csrf-token | Protects sign-in from forged requests | Until you close the browser |
| __Secure-authjs.callback-url | Remembers the page to return to after signing in | Until you close the browser |
| __Secure-authjs.pkce.code_verifier, __Secure-authjs.state, __Secure-authjs.nonce | Protect sign-in with Google, Apple or Facebook | 15 minutes |
| bbc-sign-up-terms | Remembers that you accepted the terms while you finish signing up | 24 hours |
| admin-theme | Remembers the theme of the administration area (administrators only) | 1 year |
4. Data stored in the browser
Some preferences stay only in your browser and are not sent to our servers.
| Name | Purpose | Duration |
|---|---|---|
| theme (local storage) | Remembers the light or dark theme | Until you clear the site data |
| baubaucar.transport-request-draft.v1 (session storage) | Keeps the draft of your transport request while you fill it in | Until you close the tab |
| admin-theme, admin-sidebar-expanded (local storage) | Administration area preferences (administrators only) | Until you clear the site data |
5. Analytics and performance
Google Analytics 4 uses Consent Mode v2 in advanced mode. The tag loads before you choose: without consent it sets no cookies and only sends Google cookieless technical signals (for example the page visited, browser type, time of the visit, consent state), which Google uses in aggregate to estimate statistics. With consent it uses the cookies listed below.
Google signals and ad personalisation are off, the tag is not loaded in the administration area and events contain no e-mail addresses, coordinates or request and booking identifiers.
Vercel Speed Insights measures page speed without cookies and starts only after consent; we strip parameters from the addresses it sends.
| Name | Provider | Purpose | Duration |
|---|---|---|---|
| _ga | Google Ireland Ltd | Tells visitors apart under a pseudonym | 2 years |
| _ga_[ID] | Google Ireland Ltd | Keeps the measurement session state | 2 years |
6. Third-party services used during the service
- Stripe: on the payment page Stripe.js sets the __stripe_mid (1 year) and __stripe_sid (30 minutes) cookies and uses its own cookies on Stripe domains to prevent fraud and complete the payment. They are needed to pay and are governed by Stripe's cookie policy.
- Cloudflare Turnstile: protects the transport request, transporter application, support and content report forms from abuse. It sets no cookies on our domain (we do not use pre-clearance mode with the cf_clearance cookie); Cloudflare processes the technical data the check needs.
- Sign-in with Google, Apple or Facebook: when you choose one of these providers, their cookies stay on their domains and follow their policies.
7. How to manage your choices
- On your first visit the banner asks you to accept or reject optional cookies, with buttons of equal prominence, or to choose by category.
- You can change your mind at any time with the button on this page or the "Cookie preferences" link at the bottom of every page. Withdrawal applies from then on.
- We ask again after 182 days or when the tools we use change significantly.
- You can also block or delete cookies in your browser settings; if you block the necessary ones, sign-in and payment may not work.
- Rejecting optional cookies does not limit your use of BauBauCar.
8. Changes and contacts
We update this page when the cookies or tools we use change; the date at the top shows the last change.
For questions or to exercise your rights, use the contacts in the privacy notice.