Cookie Policy
Version 2026-01
Unreviewed draft
This document was written internally and has not yet been reviewed by a lawyer. It describes what the system does today, but should not be treated as the final version.
Officera Cookie Policy
Version 2026-01
⚠️ DRAFT — DO NOT PUBLISH WITHOUT LEGAL REVIEW. This document was written from the actual behaviour of the system and has not been reviewed by a lawyer. It must be legally validated before going to production or being presented to customers.
1. What cookies are
Cookies are small text files a site stores in your browser. Among other things, they keep a
session signed in, remember preferences, or measure usage. This policy also covers equivalent
browser storage technologies such as localStorage and sessionStorage.
This policy covers two different contexts, which behave differently:
- the public website at
officera.pt; - the application at
application.officera.pt(and the internal backoffice atadmin.application.officera.pt).
2. Public website (officera.pt)
The officera.pt website is a static site. It sets no analytics, advertising, social media or personalisation cookies, and embeds no third-party trackers.
Because there are no non-essential cookies, no cookie consent banner is shown on the website.
[TO BE COMPLETED: if any analytics or marketing tool is later added to the website, this section stops being true and a prior consent mechanism becomes mandatory.]
3. Application (application.officera.pt)
The application uses only strictly necessary storage. Without it, the session cannot be kept signed in and the service cannot be provided.
3.1 Strictly necessary cookies
| Name | Purpose | Type and attributes | Lifetime |
|---|---|---|---|
officera_rt | Session refresh token. Allows a new access token to be obtained when the previous one expires, without forcing a new sign-in. | First-party cookie, HttpOnly, Secure, SameSite=Strict, path restricted to /api/v1/auth (and /api/v1/backoffice/auth in the backoffice), domain .application.officera.pt | Until the refresh token expires (30 days by default) or the session ends |
officera_tenant | Identifies the office the session belongs to, so that session refresh happens in the correct context. | First-party cookie, HttpOnly, Secure, SameSite=Strict, same path and domain as above | Same as officera_rt |
Because they are HttpOnly, these cookies are not accessible to page JavaScript.
These cookies are strictly necessary within the meaning of Article 5(3) of Directive 2002/58/EC (transposed by Article 5 of Portuguese Law 41/2004), so they do not require prior consent. They are not used for behavioural analysis or advertising.
3.2 Browser storage (not cookies)
| Item | Where | Purpose | Necessary? |
|---|---|---|---|
| Session access token and authentication state | Application memory / browser storage | Authorise API requests during the session | Yes |
| Language preference (PT/EN) | localStorage | Keep the chosen language between visits | Yes (functional user preference) |
| Monitoring session identifier (Grafana Faro) | Browser storage | Group errors and performance metrics from the same session | Not strictly necessary — see 3.3 |
3.3 Error and performance monitoring (Grafana Faro)
The application may integrate Grafana Faro, which collects JavaScript errors, browser performance metrics (Web Vitals), console logs and tracing data, and stores a session identifier in the browser. For authenticated users, the user identifier, email, office and roles are also associated.
This monitoring exists to detect and fix faults. It is not used for advertising and is not shared with third parties for that purpose.
[TO BE COMPLETED: confirm whether Grafana Faro is enabled in production. If it is, assess legally whether the collection should require prior consent inside the application, or whether it falls under the legitimate interest in keeping the service secure and functional, and adjust this section accordingly.]
4. Third-party cookies
Officera sets no advertising, social media or profiling cookies.
When the Customer is redirected to Stripe Checkout or to the Stripe billing portal, they are browsing pages hosted by Stripe, which applies its own cookie policies, including cookies needed for fraud prevention. See the Stripe cookie policy for more information.
5. How to control cookies
You can block or delete cookies in your browser settings. Note that if you block the cookies listed in section 3.1, you will not be able to stay signed in to the application and the service will stop working.
Chrome, Firefox, Safari and Edge all provide this control in their privacy settings.
6. Changes
This policy is updated whenever we change how we use cookies or browser storage. The version in force is identified in the header.
7. Contact
Questions about this policy: [TO BE COMPLETED: privacy contact email].
In the event of any discrepancy between this English version and the Portuguese version, the Portuguese version prevails.