3. Storage needed for the service you request
These records support authentication, security, your submitted choices and the request/order journey. They are set as the relevant feature is used, not necessarily on every visit. Names containing an asterisk or ellipsis represent a family of cookies; development versions may use a different prefix.
| Feature / record | Purpose | Lifetime |
|---|---|---|
| Account sign-inSupabase sb-…-auth-token cookies (including numbered chunks) and temporary sign-in verification storage | Keep you signed in and complete secure authentication when you use an account. | Auth cookies can persist for up to 400 days and be renewed; access tokens and server sessions can expire or be revoked earlier. Signing out removes the current browser’s authentication cookies. |
| Secure case and order accessvp_chat_*; vp_checkout_*; __Host-vp_customer_setup; __Host-vp_checkout_setup | Protect a conversation, recover an existing checkout and finish account setup. | Chat: up to 8 hours. Checkout receipt: up to 30 days. Initial account setup: up to 30 minutes. Verified checkout password setup: up to 1 hour. |
| Vehicle lookup__Host-vp_lookup_session; __Host-vp_vehicle_lookup_receipt | Protect the lookup you request and bind its result to your submission. | Lookup session: up to 24 hours. Result receipt: up to 30 minutes. |
| Uploads__Host-vp_media_draft; __Host-vp_media_upload_proof | Associate requested uploads with your draft and validate upload permission. | Draft: up to 7 days. Upload proof: up to 1 hour, within the draft lifetime. |
| Request and checkout draftsVinci request/checkout keys in sessionStorage and localStorage | Remember your entries during a visit, prevent duplicate submission and recover an existing order. | Session drafts normally last for the tab’s browser session. Local checkout recovery/idempotency entries may remain until removed by the application or you clear site data; they do not all have automatic browser expiry. |
| Your analytics choicevinci.analytics-consent.v1 in localStorage | Remember whether you allowed or refused analytics. Used for that choice, not advertising. | Up to 180 days; changing the choice replaces it. An expired record may remain stored until replaced, but it no longer permits analytics. |
| Protected preview access, where used__Host-vp_access and a short-lived access-error cookie | Remember authorised access to a password-protected preview. | Access: up to 7 days. Error message: up to 10 seconds. These are conditional on using the protected preview. |
Local storage does not have a browser-enforced expiry. An application may stop using a record when its internal expiry passes even though the record remains on the device. A cookie’s lifetime is also different from the time we keep a related order or invoice on our servers.
4. Security, fault reporting and requested media
Cloudflare Turnstile and our hosting/security services process technical device and network information to check that requests are legitimate and protect the service. This is separate from optional advertising. The particular challenge can vary; we do not treat every Cloudflare cookie used on other websites as a cookie used by Vinci Parts. See Cloudflare’s privacy policy.
Sentry receives filtered technical error and diagnostic reports; session replay is disabled. It is not our advertising tracker. We assess security and fault-detection technology by its actual purpose and necessity; optional behavioural tracking or replay would require a separate review and choice before activation. Provider connections still involve technical data such as an IP address.
Images and requested video may be delivered through Bunny and private storage services. Necessary delivery or playback processing is separate from using viewing activity for marketing. Opening an external WhatsApp, payment or other provider page subjects that visit to the provider’s own storage information and choices.
6. Planned Meta Pixel: a separate marketing choice
Meta Pixel is planned for advertising measurement and consented advertising audiences. It is not installed by this policy and no Meta marketing consent is currently collected by our analytics banner. Allowing analytics will not turn it on.
Before enabling it, we will add a separate optional marketing control, identify the Meta cookies and lifetimes actually used, explain the relevant recipients and controller arrangements, and verify refusal and withdrawal. Meta technologies may use identifiers such as _fbp and _fbc and associate selected actions with a Meta account; these are prospective examples, not a claim that those cookies are currently set here.
No Meta script, pixel request, identifier storage or advertising event will be permitted before the required marketing consent. Private case pages, contact/vehicle data, messages and uploaded evidence are outside the proposed advertising event scope. Any future server-side advertising integration must meet the same consent and transparency requirements.