Cookie and tracker declaration
This technical inventory describes the browser storage and third-party connections currently implemented by this website.
The technical inventory is complete for the codebase. Its legal wording and the provider-specific retention periods marked below still require business/legal approval.
| Name | Provider | Purpose | Category | Expiry / retention | Recipients |
|---|---|---|---|---|---|
| bisous_cookie_consent | Bisous du Biscuit | Stores selected consent categories, timestamp, policy version, expiry and website language. | Strictly necessary | Maximum 180 days | Bisous du Biscuit |
| i18nextLng | Bisous du Biscuit / i18next | Remembers the visitor’s selected website language. | Strictly necessary | Until browser storage is cleared | Bisous du Biscuit |
| bisous_locale | Bisous du Biscuit | Makes the visitor’s selected website language available before the website application loads. | Strictly necessary | Maximum 1 year | Bisous du Biscuit |
| bisous-commerce-cart-token | Bisous du Biscuit / Shopify | Restores the encrypted reference to the visitor’s Shopify cart. | Strictly necessary | Token validity: 7 days; browser record is removed when rejected or the cart is cleared | Bisous du Biscuit and Shopify |
| bisous-checkout-attempt | Bisous du Biscuit / Shopify | Temporarily resumes an interrupted checkout handoff. | Strictly necessary | Until the checkout handoff is completed or cleared | Bisous du Biscuit and Shopify |
| __Host-bisous_guest_orders | Bisous du Biscuit | HTTP-only credential that gives a guest access to their own order portal. | Strictly necessary | 90 days | Bisous du Biscuit |
| bisous_pending_order_handoff | Bisous du Biscuit / Shopify | Keeps the one-time order handoff during the current browser session. | Strictly necessary | Browser session; handoff itself expires after 30 minutes | Bisous du Biscuit and Shopify |
| bisous-store-closed-popup:* | Bisous du Biscuit | Remembers that the temporary store-closed notice was dismissed. | Strictly necessary | Browser session | Bisous du Biscuit |
| access_token, refresh_token, state, pkce_code_verifier | Blitzware | Supports a visitor-requested account or CMS authentication session. | Strictly necessary | Until sign-out or the provider-defined token/session expiry (provider term requires legal confirmation) | Bisous du Biscuit and Blitzware |
| bisous_blitzware_session_expired, bisous_blitzware_auth_return | Bisous du Biscuit | Recovers and returns from a visitor-requested authentication flow. | Strictly necessary | Browser session | Bisous du Biscuit |
| Google Fonts stylesheet and font requests | Downloads the optional web typography selected in cookie preferences; no first-party cookie is created by this code. | Preferences | Network request only; Google’s server-log retention requires legal/provider confirmation | ||
| _ga, _ga_PB5MLQPSJP (and GA-generated _ga_* variants) | Google Analytics | Measures aggregated website usage after explicit analytics consent. | Analytics | Google Analytics default is up to 2 years; confirm the property’s actual retention setting before legal publication | |
| YouTube embedded-player storage (provider-defined names) | Google / YouTube | Plays CMS video content only after marketing consent. | Marketing | Provider-defined; exact production names and retention require a live provider audit/legal confirmation | Google / YouTube |
| Vimeo embedded-player storage (provider-defined names) | Vimeo | Plays CMS video content only after marketing consent. | Marketing | Provider-defined; exact production names and retention require a live provider audit/legal confirmation | Vimeo |
| Google Maps API requests and provider-defined storage | Google Maps | Displays the optional interactive contact map after marketing/external-media consent. | Marketing | Provider-defined; exact production names and retention require a live provider audit/legal confirmation | |
| Cloudflare Turnstile challenge storage (including cf_clearance when issued) | Cloudflare | Prevents automated abuse on forms. Loaded only where the protected form is requested. | Strictly necessary | Challenge/provider-defined retention; confirm the production Turnstile configuration | Cloudflare |