The essential ones, and the rest.

Without these the site doesn't work. They keep you signed in, remember your language and your basket, and store your cookie choice. They don't ask for permission because they're technically necessary.

Help us understand which pages get read, where people get stuck and what needs improving. They only load after you accept. We use two tools. Vercel Speed Insights measures Core Web Vitals in aggregate, without persistent cookies. PostHog, hosted in the European Union, records pageviews and usage events and stores an identifier in your browser. If you're signed in, it links those events to your account through an internal identifier, never through your name or email. Vercel Web Analytics is disabled. We don't use Google Analytics, and we don't sell this data.

They only load after you accept this category. We use the Meta pixel (Facebook and Instagram) to know whether our ads bring visits and purchases. It records the product pages viewed, the products added to the basket, the start of checkout, the value of a completed purchase and the submission of a producer application, and stores an identifier in your browser (the _fbp and _fbc cookies). With the same consent, the purchase and the application are also sent to Meta from Lavora's servers (Conversions API), with your email and phone in an irreversibly encrypted form (hashed), the _fbp and _fbc cookie identifiers, your IP address and your browser. This lets us measure our ads even when the browser blocks the pixel, and Meta counts each event only once. We never send your name or your address. The pixel does not run in your account or on personal links (orders, reviews, gift vouchers). Lavora and Meta are joint controllers for this collection. What Meta does with the data afterwards follows Meta's privacy policy. You can withdraw your consent at any time, and the Meta cookies are deleted. With renewed marketing consent, OpenAI also receives public-page and product views and confirmed purchases to measure ChatGPT ads. Server-side purchases include the EUR amount, an event identifier, available click and browser references and the normalized email hashed with SHA-256. This integration does not send names, addresses, phone numbers or IP addresses. If automatic matching is enabled in Ads Manager, the Pixel may include hashed form information as described by OpenAI. Withdrawing consent stops browser events and removes __oppref and __obref. References retained for an order with checkout consent are erased after successful delivery and within 8 days at most.

Some features rely on external services that store data in your browser. Stripe (secure payment), Cloudflare Turnstile (anti-spam protection on forms), and Google Maps (address autocomplete). These are functional, not used for advertising, and are listed in the table below.

Not everything we store is a cookie. A cookie travels with every request to the server and has an expiry date. Local storage stays only in your browser, never travels to the server, and remains until you clear it. We use both. The table below says which is which.