This Cookie Policy explains how Tosiu uses cookies and similar technologies on our marketing site at tosiu.com and on our platform at app.tosiu.com. It should be read together with our Privacy Policy. The controller is I/E TOSIU (Georgia, identification number 304829112), contact@tosiu.com.
This policy does not cover the booking websites our customers (the transfer companies) run on the platform. Each of those sites has its own cookie information and its own consent banner, under the responsibility of the company that runs it. If you are visiting a transfer company's booking site made with Tosiu, please read that company's own cookie and privacy policies.
What cookies are
Cookies are small text files stored on your device when you visit a website. We also use similar technologies: browser storage (sessionStorage, localStorage) and tracking pixels. For simplicity, we refer to all of them as "cookies" below. The list is complete: nothing is stored in your browser by tosiu.com or app.tosiu.com that is not in these tables.
Cookie categories
- Strictly necessary: required for the site to work or to remember a choice you made (session, security, language, your consent). They cannot be turned off and need no consent.
- Technical audience measurement: our own first-party measurement of how the site is used, with a truncated IP address, no browser string, no cross-site identifier and no sharing. Under the Italian Garante's guidelines of 10 June 2021 (section 7.2) and the ePrivacy rules it is treated as technical and needs no consent; it is described here for transparency.
- Analytics: third-party tools that help us understand how visitors use the site. Only active with your consent.
- Marketing and advertising: tools that measure our advertising and let ad platforms show relevant ads. Only active with your consent (the one cookieless Google signal that is also sent with "Analytics" alone is described under the tables below).
Cookies we use
Strictly necessary
| Name | Site | Purpose | Duration | Provider |
|---|---|---|---|---|
| PHPSESSID | tosiu.com | Anonymous session that carries the security token of the forms (CSRF protection) | Session | Tosiu |
| PHPSESSID | app.tosiu.com | Your login session on the platform (renewed on every visit) | 30 days | Tosiu |
| remember_token | app.tosiu.com | Keeps you logged in across browser sessions | 30 days | Tosiu |
| tosiu_lang | tosiu.com | Remembers the language you chose, so the home page opens in it | 1 year | Tosiu |
| tosiu_geo | tosiu.com | Your country code, resolved once from your IP address on our server; decides the first language when your browser's language is not one the site offers, and whether the cookie card must be shown | 30 days | Tosiu |
| tosiu_consent | tosiu.com | Your cookie choices (analytics yes/no, marketing yes/no) and when you made them | 12 months | Tosiu |
| guest_lang | app.tosiu.com | Your language on the login page before you sign in | 1 year | Tosiu |
| Cloudflare Turnstile | tosiu.com, app.tosiu.com | The bot check that protects the registration and contact forms and the login page. Its script is loaded on every page of tosiu.com, so Cloudflare receives your IP address and browser data when a page loads; it may store a technical challenge identifier in the Cloudflare frame | Session | Cloudflare, Inc. |
Technical audience measurement (no consent needed)
| Name | Site | Purpose | Duration | Provider |
|---|---|---|---|---|
| tosiu_sid (sessionStorage) | tosiu.com | A random identifier that groups the page views of one visit for our own statistics. It is not a cookie, it is never sent to a third party, and it disappears when you close the tab. The server stores the pages viewed, clicks, on the registration form which fields were started (never what was typed) and the errors shown, scroll depth, time spent on each page and which of its sections came into view, whether and how quickly the cookie card was answered and which of its two layouts was shown, a light activity signal (that the page is in use, with a count of clicks), screen size, device and browser family, country and a truncated IP address, for 365 days | Until the tab is closed | Tosiu |
| tosiu_attr (sessionStorage); tosiu_first (localStorage, only after consent) | tosiu.com | The page you arrived on, the site that sent you and the campaign parameters of the link (utm, keyword match type, campaign id), sent to us only if you register, so that we know which campaign brought the registration (Privacy Policy, section 3.1). The ad click identifier of Google or Meta in the link (gclid, gbraid, wbraid, fbclid) is kept only after you accept marketing cookies, and is then used as described for them below. tosiu_attr is not a cookie and it disappears when you close the tab. Only if you accept analytics or marketing cookies, the same record is also kept as tosiu_first, so that a registration made on a later visit can still be linked to the campaign that first brought you; a newer ad click replaces it and it is deleted when you withdraw your consent. Without consent nothing is kept beyond the tab | Until the tab is closed (tosiu_attr); 90 days (tosiu_first) | Tosiu |
Analytics (consent required)
Used on tosiu.com only, loaded only after you accept the "Analytics" category.
| Provider | Cookies | Purpose | Duration |
|---|---|---|---|
| Google Analytics 4 (Google Ireland Ltd / Google LLC) | _ga, _ga_* | Understand traffic and usage patterns | Up to 2 years |
| ContentSquare (ContentSquare SAS, France) | _cs_id, _cs_s, _cs_c, _cs_vars, _cs_ex | Aggregate UX analytics, heatmaps, navigation patterns | Up to 13 months (_cs_id); 30 minutes (_cs_s) |
Marketing and advertising (consent required)
Used on tosiu.com only, loaded only after you accept the "Marketing and advertising" category.
| Provider | Cookies | Purpose | Duration |
|---|---|---|---|
| Google Ads (Google Ireland Ltd / Google LLC) | _gcl_au, _gcl_aw; _gcl_ls (localStorage) | Measure whether a registration, a contact or a demo request followed one of our ads; remarketing: Google may show our ads again to people who visited tosiu.com, who stay in that audience for up to 540 days | Up to 90 days (cookies) |
| Meta Pixel and Meta Conversions API (Meta Platforms Ireland Ltd) | _fbp, _fbc; fr on facebook.com; lastExternalReferrer, lastExternalReferrerTime (localStorage) | Facebook and Instagram ad measurement and attribution; remarketing: Meta may show our ads again to people who visited tosiu.com, who stay in that audience for up to 180 days; Meta may also show them to people who interacted with our Facebook page, Instagram account or ads on its platforms (an audience Meta builds from its own data, independent of the cookies of this site), for up to 180 days. A contact or a demo request is reported to the Pixel as an event with no form content. When you register, our server also sends Meta the same registration event the Pixel sends (Conversions API): the event identifier and time, the page address, your IP address and browser string, the _fbp and _fbc values and the price of the plan; no name, e-mail address or phone number | Up to 90 days (_fbp, _fbc); 90 days (fr); until deleted (localStorage) |
Google Analytics 4 and Google Ads are delivered by one Google tag. If you accept only the "Analytics" category, Google's library also sends Google Ads one page-view signal per page: without cookies, with the ad click identifier removed and marked as not consented for advertising (Google Consent Mode), carrying the page address, your browser data and, like any request, your IP address. If you accept only the "Marketing and advertising" category, Google Analytics stays switched off and ContentSquare is not loaded.
These providers may set additional cookies under their own control from their own domains. Their policies: Google, Meta, ContentSquare, Cloudflare. Google and Meta are in the United States: the transfer relies on the EU-US Data Privacy Framework and the Standard Contractual Clauses (Privacy Policy, section 6).
We do not load TikTok, LinkedIn, Hotjar, Clarity or any other analytics or advertising script on tosiu.com, and app.tosiu.com loads no analytics or advertising script at all. If we add a new non-essential provider, we update this policy and ask for your consent again before activating it.
Managing your consent
In the countries where the law requires it (the European Economic Area, the United Kingdom, Switzerland, Norway, Iceland, Liechtenstein and Brazil; and wherever we cannot tell where you are), a card appears on your first visit with the choices "Reject", "Customise" and "Accept all": accepting and refusing are always two equal buttons; customising is a third equal button or a link, depending on the layout of the card. While we compare two layouts (at the bottom of the page, or in the centre with the page waiting behind it), different visitors can see a different one; the layout is chosen from the session that already exists, without any new cookie. Nothing from the analytics or marketing categories loads before you decide; no box is pre-ticked; "Reject" is one click, like "Accept all"; your choice is kept for 12 months and you are not asked again before that. You can change or withdraw it at any time from the "Cookie settings" link in the footer of every page, or with the button below. When you switch a category off, its cookies and storage entries are deleted from your browser and the page is loaded again without its scripts. Elsewhere in the world the site treats analytics and marketing cookies as accepted, in line with local law; the footer link is then hidden, and you can still block cookies in your browser.
Browser-level controls
Independent of our card, most browsers let you block or delete cookies. Blocking all cookies may break parts of the site (in particular the login to the platform). Consult your browser's help pages for instructions: Chrome, Firefox, Safari, Edge. Google also offers a browser add-on that blocks Google Analytics everywhere.
Changes to this policy
We update this Cookie Policy when we add or remove a cookie or a provider. The "Last updated" date at the top always reflects the current version. If we add new non-essential cookies, we ask for your consent again.
Contact
Questions about cookies or your data? Email contact@tosiu.com or use the contact form.
