Cookie Policy

1. What Are Cookies

Cookies are small text files placed on your device when you visit a website. They help the site remember your preferences and enable certain functionality. We mainly use the cookies necessary to operate the Orderoo platform, plus first-party ad measurement cookies that are set only when the link you arrive through carries the Meta click id (added by Facebook and Instagram to links such as ads).

2. Cookies We Use

Strictly Necessary Cookies — these cannot be disabled as they are required for the platform to function:

• Authentication cookie — keeps you signed in. Set by NextAuth.js. Persistent: expires up to 12 months after sign-in, or when you sign out. Scoped to .orderoo.gr, so your sign-in is shared across all store subdomains.
• CSRF token — protects form submissions from cross-site request forgery attacks. Session-scoped.
• Cookie notice & app preferences — remembers that you have seen our cookie notice. Together with your shopping cart, selected delivery address and typed location, this is stored in your browser's local storage (not a cookie) so the app works; it stays on your device until you clear it.
• Preferences — remembers your language choice (the oo_locale and NEXT_LOCALE cookies) and, in the admin app, your sidebar state, to keep the interface consistent across visits.

Ad measurement cookies (first-party) — set only when the link you arrive through carries the Meta click id, which Facebook and Instagram add to links such as ads:

• Ad measurement — remember which ad you came from (the oo_av, oo_avp and oo_fbc cookies), so the store can measure the visits, sign-ups and orders its ads bring. If you are already signed in, or sign in or place an order within 7 days, the visit is linked to your account; if you have ordered from that store, or sign up on its page during that visit, its staff see your name and your phone number or email in the ad's report, together with whether you added to cart, signed up or ordered. The cookies stay on the web address where you arrived and are never sent to any other address; they expire after 7 days and contain no IP address. If the store has turned on Meta conversion measurement, an order that carries the Meta click id (oo_fbc) is reported to Meta with that id, an order reference, the order value and currency, your browser's user agent, and your email and phone number in hashed (SHA-256) form.

Third-Party Cookies — set by services we integrate with:

• Google OAuth — if you sign in with Google, Google may set cookies on their domain to manage authentication. Governed by Google's Privacy Policy.
• Stripe — Stripe may set cookies for fraud prevention during checkout. Governed by Stripe's Privacy Policy.

3. What We Do Not Use

We measure page views with Vercel Web Analytics, which is cookieless: it stores nothing on your device, does not identify you individually, and does not track you across other websites. Apart from the ad measurement described above, no third-party advertising cookies or tracking pixels are placed on your device, and we never sell data to advertisers.

4. Your Rights Under GDPR

Strictly necessary cookies do not require your consent under Article 6(1)(b) GDPR (necessity for performance of a contract) and the ePrivacy Directive. You may still disable cookies via your browser settings, but this will prevent you from using the platform.

If you are in the EEA you have the right to access, correct, or request deletion of personal data processed in connection with cookies. Contact us at privacy@orderoo.gr to exercise these rights.

5. How to Manage Cookies

You can control cookies through your browser settings. Most browsers allow you to block or delete cookies. Note that blocking necessary cookies will prevent you from logging in to the platform.

• Chrome: Settings → Privacy and security → Cookies
• Firefox: Settings → Privacy & Security → Cookies and Site Data
• Safari: Preferences → Privacy → Cookies
• Edge: Settings → Cookies and site permissions

6. Contact

Data controller: Δημήτριος Χρηστάκης (Hexaigon Solutions), ΑΦΜ 167755989, Athens, Greece. Contact: privacy@orderoo.gr