Iterum · Cookie policy
Cookies and similar technologies
Iterum uses cookies to remember language, maintain a session and store the choice made in the banner. Optional browser analytics and marketing categories follow that choice. If you choose both categories, we may retain for a limited period a category for the public entry page, a coarse referral class and the entry day to measure your account's funnel path; for these three new dimensions, the browser context expires after 30 days and does not retain the full URL or referrer. They stay in Iterum's funnel rather than being sent to Meta; account-linked server attribution is pseudonymous in the funnel record, follows its existing expiry and withdrawal rules, and is not promised to be anonymous. You can withdraw the choices in cookie preferences; clearing data linked to an account requires that we can recognise you as the account holder. Analytics events sent by the server, if any, are separate from the browser cookie choice.
Preferences
In the banner you can reject optional categories, choose them separately and change your choice. NEXT_LOCALE stores language, iterum_locale and iterum_theme store the language and theme (system, light or dark) you choose by hand, and cookie_consent stores the preference; each has a configured lifetime of 365 days.
Loyalty card from a venue's QR code
When you add a loyalty card by scanning a venue's QR code (or tapping its NFC tag), the technical cookie iterum_card remembers on this phone which card you received: scan the same QR again and you get your card back instead of a new one. It holds only the card code, applies only to that QR code, is not shared with third parties and lasts 365 days.
The venue's QR and tag
When you receive the card, the technical cookie iterum_tp_… remembers on this phone which loyalty card you hold at that venue, so scanning the venue's QR or tapping its tag recognises your card instead of creating a new one. It holds only the card code, is sent only to iterum.fidus.media, is not shared with third parties and lasts 365 days. If a scan or a tap does not recognise the phone, the technical cookie iterum_tap_pending keeps it for 10 minutes, the time to create your card.
Meta Pixel on Iterum
With marketing consent, Meta Pixel may receive a campaign-page visit and a confirmed trial start. After a new subscriber's first successful nonzero automatic subscription payment, our server may send Meta a Purchase event with the amount, currency, hashed account email, checkout browser user agent and available Meta browser or click identifiers. A previous cookie choice must be renewed for this server reporting. If you reject or withdraw consent, we stop new browser events and remove unsent server attribution and queued events for your signed-in account. You can change your choice in cookie preferences.
Google Ads demo and trial measurement
If you allow marketing cookies and arrive from a Google ad, the Google Ads tag can read the ad click identifier and store attribution cookies. For trial measurement, we use the landing time saved in your browser for up to 30 days. When you confirm a demo booking or start a trial that Stripe has verified with a plan and valid payment method, we send Google Ads an event with an opaque identifier to prevent double counting. We do not send your name, phone number, email, form answers or payment details. You can withdraw consent in cookie preferences.
How Google uses data from partner sites
Session recording (OpenReplay)
Only if you choose analytics cookies, on Iterum's home page, guides and public information pages and on the demo page (iterum.fidus.media/demo) we record how you use the page: clicks, taps, scrolling, pointer movements, pages viewed and any technical errors (without the content of requests), to see where the page is unclear and improve it. We use OpenReplay, software we install and run ourselves on our own server in the European Union (ux.fidus.media); like any web server it also receives the IP address and the browser and device type, from which it derives the country and approximate area. Whatever you type into fields (name, phone, email, business) is masked in the browser and never recorded, and so are the demo texts that repeat your details; we do not record the personal appointment link or ad click identifiers. On the loyalty card, enrolment, sign-up and sign-in pages, the demo appointment page and the legal pages this recording is never active; the business panel follows the section below. Visits that come from an ad on Facebook or Instagram are kept apart from other site visits: to tell them apart the browser looks, once on arrival, at the page and the address parameters, and the click identifier is not recorded. In the browser OpenReplay uses local storage: __openreplay_uuid (a random device identifier, until withdrawal) and __openreplay_token, __openreplay_token_version, __openreplay_tabid, __openreplay_pageno and __openreplay_iterum_project (the current session and the kind of visit, until the tab is closed). Recordings are deleted automatically after 30 days at most. If the browser sends Do Not Track or Global Privacy Control we do not record. If you withdraw consent in the preferences, recording stops at once and we delete this data from the browser. A cookie choice made before this section was published does not turn recording on: a new choice is needed.
Session recording in the panel
In the Iterum panel, after sign-in, we use the same OpenReplay to record how owners, managers, staff and administrators use the panel (clicks, taps, scrolling, pages viewed, browser errors and failed requests, without their content), for support, to find and fix errors and for product quality. It is based on our legitimate interest (Art. 6(1)(f) GDPR), is described in the privacy notice and does not depend on the analytics cookie choice. Whatever is typed into fields and the email addresses and numbers shown on the pages are masked in the browser, and the pages and lists with the business's customers are hidden entirely. In the panel OpenReplay uses only the tab's storage: __openreplay_token, __openreplay_token_version, __openreplay_tabid and __openreplay_pageno, deleted when the tab is closed; it stores no permanent device identifier. Recordings stay on our own server in the European Union (ux.fidus.media) and are deleted after 30 days at most. If the browser sends Do Not Track or Global Privacy Control we do not record.
The Italian version prevails.