Cookie policy

Office cleaning inquiry — Google Ads Office Lead

If office inquiry measurement is enabled and you grant advertising consent, after the server saves a public office cleaning inquiry we may send Google Ads a technical inquiry identifier and a nominal measurement value of PLN 1. This is not the service price or payment confirmation. Inquiry contents, contact details and access tokens are not shared. Test and Sandbox inquiries are excluded.

A separate technical ledger prevents reporting the same inquiry again and is deleted after 180 days. We use the same Google Ads tag, advertising consent and nc_ads_paid_bookings_v1 sessionStorage protection as for paid-booking measurement. An office inquiry and a later paid booking are two distinct stages.

Paid booking — Google Ads conversion

If paid-booking measurement is enabled and you grant advertising consent, after a server-verified paid Przelewy24 booking confirmation we may send Google Ads the order identifier, full agreed net value after discounts and PLN currency. Paying the required advance can confirm the booking: the conversion value then represents the whole service, not just the advance. Name, email, phone, address and access token are not sent.

A technical ledger prevents reporting the same booking twice. It contains the order identifier, value, time and checked consent version, without linking the anonymous cookie-decision identifier. The maintenance job clears it after 180 days. nc_ads_paid_bookings_v1 in sessionStorage additionally prevents duplicates in the tab, operates only after advertising consent and is removed with the session or consent withdrawal. This measurement needs the customer to return to the public payment-result page; we do not automatically transmit data from the webhook or private order page.

Advertising measurement — Google Ads

Only after separate advertising-measurement consent do we start Google tag AW-18541997393. It uses gclid, gbraid and wbraid click identifiers and may set _gcl_* cookies on the service domain. The application sets a 180-day cookie limit; actual names, domains and durations must be checked in the browser and Google configuration after deployment. Before initial consent we do not configure Google Ads or send denial pings through its tag.

We grant ad_storage and ad_user_data only for selected advertising measurement. ad_personalization stays denied: no remarketing, Google Signals or enhanced conversions. Customer contact details are not sent. This is a base tag, not proof of purchase or automatic payment measurement. Google receives the data; processing and transfers: https://policies.google.com/privacy.

1. Categories and choices

NovaCleanly uses technologies necessary for login, security and ordering. Analytics is optional and disabled by default; Google Analytics does not start without current consent. The banner offers rejection, acceptance or selection of analytics. Google Ads measurement is a separate, optional category, off by default. Neither placing an order nor analytics-only consent enables advertising.

The permanent “Cookie settings” button reopens the choices. Withdrawal blocks subsequent application measurements and deletes accessible GA and _gcl_ cookies. Once Google Ads is loaded, withdrawal or private-area navigation reloads the page to stop the loaded tag. Private-area navigation alone does not delete cookies covered by a still-current consent. It does not undo data already sent. If the browser blocks storage, analytics is not enabled.

2. First-party technology inventory

nc_cookie_consent_v2 — localStorage, NovaCleanly, service domain. Choice version, random decision ID, time and categories; necessary to remember the decision. Valid for 180 days; expired choices do not authorise analytics. No analytics without a current decision. Minimal server evidence stores the ID, time, version and separate analytics and advertising-measurement choices, without an account or email link; retention 180 days.

lang — localStorage, NovaCleanly, preferred language; saved at user request until deleted in the browser. nova_order_verify_pending_v1 — localStorage, resuming order verification, application validity 10 minutes; does not contain the full order.

next-auth.session-token (including __Secure- prefixes and .0/.1 chunks), next-auth.csrf-token (__Host-) and next-auth.callback-url (__Secure-) — NovaCleanly/NextAuth, necessary for sessions, request protection and returning after login. Session token follows session validity, normally 30 days; CSRF and callback follow the browser session. Actual expiry is visible in the browser.

nc_order_view — NovaCleanly HttpOnly cookie for secure access to a specific order confirmation; no longer than the signed token validity, at most 24 hours. novacleanly_admin_mfa — HttpOnly cookie confirming administrator MFA, normally 12 hours.

visit:<path> — sessionStorage, NovaCleanly, only after analytics consent; prevents duplicate visit records in the same session. Deleted with the tab session. Not used for order access.

3. Google Analytics and external services

If GA4 is configured and consent is given: gtag.js from googletagmanager.com; _ga and _ga_<identifier> cookies, Google, statistics on the service domain. The application sets cookies for 180 days without automatic renewal on page views. Google Signals and ad personalisation are disabled. Additional GA features require a review of the actual account configuration.

Our measurement shares only permitted UTM labels and, after advertising consent, Google Ads click IDs gclid, gbraid or wbraid. It does not share other query parameters or order content; account, payment, worker, administration and order/quote-link areas are excluded from application measurement. Actual requests from all tools must be checked after configuration changes.

Przelewy24 operates after a deliberate transition to the payment provider and may use its own technologies on its domain. WhatsApp links open an external service and are not marketing consent. We do not load an embedded WhatsApp widget. External tools also follow their own policies.

This inventory is based on application code, not a full production scan. The administrator should check Network/Application after deployment, especially new widgets, maps, GTM/Ads and embedded media; a banner alone must not be assumed to ensure compliance.