Cookie Policy

Last updated: October 2026

1. What Are Cookies?

Cookies are small text files stored on your device (computer, tablet or mobile phone) when you visit a website. They let the site remember your actions and preferences for a period of time.

2. When Do We Use Analytics and Advertising Cookies?

Besides the necessary cookies, which are always on, we use two categories you can accept or reject separately: Analytics (Google Analytics) and Advertising (Google Ads and the Meta Pixel). When they load depends on where you are. In this policy, "Europe" means the European Economic Area (the European Union countries, Iceland, Liechtenstein and Norway), the United Kingdom and Switzerland. We know whether you are in Europe from the country our network provider derives from your IP address and, when we do not know it, from your browser's time zone.

In Europe

Analytics and advertising cookies only load if you accept them. The cookie notice asks you first, with "Reject all" and "Accept all" buttons that look the same, and with "Customize", to choose each category. None of them loads until you answer, and only the category you accept loads.

We use Google's consent mode (Consent Mode v2): before any Google tag we tell it that everything is denied, and then we grant only the categories you accepted. On the app.fidelip.com dashboard, even if you accept them, Google Analytics runs without Google Signals or ad personalization. The first-party attribution cookie fidelip_attr (the ad or AI assistant you arrived from, section 3) is only stored after you accept Advertising, and it is deleted if you reject it.

An acceptance given outside Europe with "Got it" (see below), or with the notice before this version, does not count in Europe: if you browse from Europe, we ask you again.

Outside Europe

In Mexico, the United States, Canada and every other country, analytics and advertising cookies are active from your first visit. On fidelip.com, id.fidelip.com, pos.fidelip.com and the app.fidelip.com dashboard, until you answer, a notice tells you so and lets you reject them (the "Reject" button), choose each category ("Customize", except on pos.fidelip.com) or close it and keep them on (the "Got it" button). If you do not reject them, we take it that you consent to their use (tacit consent). "Got it" only confirms that you read the notice: if you later browse from Europe, it does not count as consent.

If you reject a category, we switch it off on the spot and delete the cookies its tags had set, from the site you are on and from the fidelip.com domain: for Analytics, _ga, _ga_*, _gid and _gat*; for Advertising, _gcl_*, _gac_*, _fbp and _fbc, plus the _gcl_ls entry in local storage. "Reject" rejects both. From then on the rejected category does not load on any fidelip.com site for as long as your answer is kept (see section 4). Outside Europe, rejecting Advertising does not delete the fidelip_attr cookie or change the sign-up measurement we do from our servers (section 3.3 of the Privacy Notice).

On pos.fidelip.com, the page that sends business staff to download the app, we only use Google Analytics, and we never load it if you are in Europe, even if you accepted cookies on another of our sites.

On the Pages We Host for Businesses

Businesses that use Fidelip show their customers pages hosted on app.fidelip.com: sign-up for their loyalty card, their surveys and their vouchers. The data you give on them belongs to the business, which is its controller. Separately, outside Europe, Fidelip uses Google Analytics on those pages, for its own purposes, only to measure how the service is used:

• Without advertising features: no Google Ads, no Meta Pixel, no Google Signals and no ad personalization.
• With no codes, tokens or contact details in the addresses it sends to Google (see below).
• Never in kiosk mode (the business's counter tablet), where the notice does not appear either.
• Never on the pages of a business in Europe or for a visitor who is in Europe: no analytics or advertising cookie loads there, and no notice appears.
• Never if you rejected analytics cookies on any of our sites.

Until you answer, a short notice in the page's language tells you so, with a button to reject it and a link to this policy. Closing that notice only hides it: it does not count as an answer on any of our sites. The customer portal (cliente.fidelip.com) uses no analytics or advertising cookies.

Addresses We Send to Google

In every country, the page addresses we send to Google never carry codes, tokens or contact details. On all our sites, before sending the address of the page and of the page you came from:

• We remove every parameter except campaign parameters (utm_source, utm_medium, utm_campaign, utm_term and utm_content) and ad click identifiers (gclid and fbclid).
• We remove everything after the # sign.
• We replace a survey's token, a voucher's code and a personalized page's code with a generic placeholder (for example, /survey/:token).

In addition, on id.fidelip.com the invitation (/setup) and sign-in (/login) pages remove the invitation token and the email address from the address bar as soon as they read them.

The Meta Pixel reads the page's address and the referring page's address straight from the browser, so we do not use it when either of them carries any of that data.

3. Which Cookies Do We Use?

Strictly Necessary Cookies

These are essential for the site to work. Without them, some parts of the site would not work properly.

Functionality Cookies

These let us remember your preferences and personalize your experience.

Analytics Cookies (Analytics category)

We use Google Analytics to understand how users interact with our sites and to improve the experience. When it loads depends on where you are (section 2). Google may process this data outside the European Economic Area, in particular in the United States (section 6 of the Privacy Notice). More information in Google's privacy policy.

Advertising Cookies (Advertising category)

They tell us which ads lead to sign-ups and let us show Fidelip ads to people who have already visited the site. In Europe they only load if you accept Advertising; elsewhere, unless you reject it or your browser sends the Global Privacy Control signal (section 4). They never load on the pages we host for businesses. The Meta Pixel receives the page address (only when it carries no private data, section 2) and the events we send it, such as a page view or a sign-up; in Europe we switch off its automatic configuration, so it does not collect button clicks or page data on its own. Google and Meta may process this data outside the European Economic Area, in particular in the United States (section 6 of the Privacy Notice). More information: how Google uses advertising cookies and Meta's cookie policy.

First-Party Attribution Cookie

Third-Party Cookies on Their Own Domains

When their advertising tags load, Google and Meta may set or read cookies on their own domains. The third party sets them, under its own policies; we cannot read or delete them from our domain, but you can do so from your browser:

4. How Can You Control Cookies?

Changing or withdrawing your choice: on fidelip.com, id.fidelip.com and the app.fidelip.com dashboard, the "Cookie settings" link in the footer opens the settings, where you can accept or reject each category. You can also open them here: Cookie settings. Withdrawing consent is as easy as giving it and takes effect at once: we stop loading that category's tags and delete its cookies from our domain (section 2). We cannot delete the cookies Google and Meta keep on their own domains; you can do so from your browser.

Your choice is stored only in your browser, in the fidelip_consent cookie shared by fidelip.com and its subdomains; we do not store it on our servers. An acceptance lasts at most 12 months: after that, or sooner if the categories or the providers change, we ask you again in Europe. A rejection is kept: we renew it on every visit.

Earlier answers: if you answered the notice before this version, "Reject" counts as rejecting both categories, in every country. "Accept" or "Got it" counts for Analytics, and Advertising stays as your region allows: on outside Europe unless you reject it; in Europe we ask you again. Earlier acceptances stop counting on 22 September 2027 at the latest.

You can also control and delete cookies through your browser settings:

• Google Chrome
• Mozilla Firefox
• Safari
• Microsoft Edge

Note: Disabling certain cookies may affect how the site works.

Global Privacy Control (GPC): if your browser sends the GPC signal, we treat it, in every country, as an opt-out of the sale or sharing of personal information and of targeted advertising. The Advertising category stays off even if you click "Accept all": Google Ads and Meta Pixel tags do not load, Google Analytics runs without Google Signals or ad personalization, and we do not send your sign-up to Meta's Conversions API, even if you accepted cookies. Outside Europe, the first-party attribution cookie fidelip_attr is still stored when you arrive from an ad or an AI assistant (section 3). Google Analytics follows the rules in section 2: in Europe, only if you accepted it; elsewhere, unless you rejected it.

Do Not Track: our sites do not respond to browsers' "Do Not Track" signal, because there is no common standard for interpreting it. To reject analytics or advertising, use "Cookie settings"; the GPC signal turns advertising off, as explained above.

5. Local and Session Storage

In addition to cookies, we use the browser's storage to:

• Keep your session active and remember the selected business in the dashboard (access_token, selectedBusinessId)
• Save app preferences
• Improve performance by storing temporary data
• On id.fidelip.com, remember in that tab the invitation you are accepting (setup_invite_token, session storage), so that a reload does not lose it; it is deleted when you finish
• In the guided sign-up on id.fidelip.com, a random visit identifier (fidelip_crear_run, session storage) we use to measure, without name, email or phone number, how far the sign-up gets and which options are chosen; in Europe, only if you accepted Analytics
• On the pages we host for businesses, remember that you closed the cookie notice (customer_cookie_notice_closed, local storage); closing it does not count as an answer

Local storage works much like cookies, but it stays on your device until you delete it manually or clear your browser data; session storage is cleared when you close the tab.

6. Updates to this Policy

We may update this policy from time to time. Changes will be posted on this page with a new update date.

7. Contact

If you have questions about our cookie policy:

• [email protected]

8. More Information

To learn how we handle your personal data, see our Privacy Notice.