Cookie and Local Storage Policy
About this translation: This English text is a translation of the Turkish original, provided for information only. The Turkish version is the binding text and prevails in the event of any discrepancy. This translation is pending legal review.
Data Controller: PROTOOLBAG YAZILIM TEKNOLOJİLERİ A.Ş., Bilişim Vadisi, Gülbahçe Mah. İçmeler Cad. No:14/1 İç Kapı No: B05, Urla / İzmir, Türkiye · info@protoolbag.com
Scope: The Protoolbag SaaS application portal — app.pms.protoolbag.com and sister platform hosts (§1–§4) and the marketing website protoolbag.com (§5).
1. Summary — The Application Portal Does Not Use Cookies
The Protoolbag application portal does not use cookies and contains no third-party trackers, analytics pixels or advertising technology.
The portal uses only strictly necessary, first-party functional browser storage (localStorage and IndexedDB) required for the service to work. This storage remains on your device for the purposes of maintaining your session, remembering your language/theme preference and keeping a local cache for performance — it is not shared with third parties and is not used for marketing/profiling purposes.
For such strictly necessary functional storage, no separate consent banner is required under the applicable regulations.
2. Functional Storage Items We Use
| Key / Item | Type | Purpose | Retention |
|---|---|---|---|
sb-supabase-auth-token |
localStorage | Session/authentication token (Supabase Auth) | For the duration of the session / deleted on logout |
language |
localStorage | Interface language preference | Persistent (until the user changes it) |
app-appearance-settings |
localStorage | Theme / appearance settings | Persistent |
ptb_selected_org_id |
localStorage | Selected organisation context | Persistent |
onboarding_completed |
localStorage | Completion status of the onboarding flow | Persistent |
| Application cache (IndexedDB) | IndexedDB | Local data cache for performance (e.g. translation/asset cache); time-limited (~1 hour TTL) | Automatic expiry / clearing |
The authentication token is kept in the browser's local storage (
localStorage), not in a cookie.
3. Why There Is No Consent Banner
- All the items listed are strictly necessary / functional in nature; the service cannot work without them (session, language, basic cache).
- There is no storage for marketing, advertising or cross-site tracking purposes.
- No third-party scripts / trackers are run; the portal's content security policy (CSP) also technically prevents this by allowing only scripts loaded from our own domain.
4. Managing Your Preferences
You can clear local storage/IndexedDB in your browser settings; however, this will end your session and reset your preferences. When you log out within the application, the authentication token is cleared.
5. Marketing Website — protoolbag.com
§1–§4 describe the application portal. Unlike the portal, the marketing website (protoolbag.com, English pages at protoolbag.com/en) uses optional analytics and loads Google reCAPTCHA v3 for bot protection on the contact/demo form. On the first visit, the site uses only the strictly necessary items below; analytics is loaded only after your explicit consent. The site has no tags for advertising or marketing purposes.
5.1 Strictly necessary items (no consent required)
| Key / Item | Type | Party | Purpose | Retention |
|---|---|---|---|---|
ptb_web_consent |
localStorage | First party (Protoolbag) | Your cookie preference: which optional category (analytics) is permitted, the notice version to which the preference belongs and the time of the preference | Until you change it or delete your browser data; when the notice version changes, your preference is asked again |
ptb_web_consent_id |
localStorage | First party | A randomly generated preference number for your browser that does not contain your identity; used only to link your preferences together in the consent record (§5.3) | Until you delete your browser data |
ptb_web_theme |
localStorage | First party | Light/dark theme choice (only if you changed the theme manually) | Persistent (until you change it) |
ptb_web_utm |
sessionStorage | First party | Campaign parameters (utm_*) in the link through which you came to the site; transmitted with the form only if you submit the contact/demo form |
Deleted when the tab is closed |
web.pricing.v1 |
sessionStorage | First party | A temporary copy of the public price list (so that it is not downloaded again between pages); contains no personal data | Deleted when the tab is closed |
Google reCAPTCHA v3 cookies / local storage (e.g. _GRECAPTCHA) |
Cookie / localStorage | Third party (Google) | Security: protecting the contact/demo form against automated submissions (bots); for this reason it is treated as a strictly necessary item and cannot be switched off in the preferences. The script is not loaded when the page opens; it is loaded only when you first focus on a field in the form. The use of reCAPTCHA is indicated in the form below the submit button | Determined by Google (see the Google Privacy Policy) |
Legal basis (reCAPTCHA): Legitimate interest in protecting the form against automated and malicious submissions (KVKK Art. 5/2-f). When reCAPTCHA is used, the IP address and browser/device information are transmitted to Google (USA); this transfer is carried out in accordance with the conditions laid down in KVKK Art. 9. Google's processing terms: Google Privacy Policy and Google Terms of Service.
5.2 Analytics (optional — only with your consent)
| Key / Item | Type | Party | Purpose | Retention |
|---|---|---|---|---|
Google Tag Manager (GTM-N7XWL7ZH) |
Script | Third party (Google) | Loads the analytics tags | — |
_ga, _ga_* (Google Analytics) |
Cookie | Third party (Google), on the protoolbag.com domain |
Visit and page view statistics | Google Analytics defaults (_ga at most 2 years) |
- Cookie notice: On the first visit, three equally weighted options are offered: "Accept all", "Reject" and "Manage preferences". "Manage preferences" opens the category panel: Necessary (always on, cannot be switched off) and Analytics (off by default; activated only if you switch it on). "Reject" leaves only the strictly necessary items.
- Analytics is off by default. Google Tag Manager is loaded only after you have explicitly permitted analytics; it is not loaded at all on the first visit or after choosing "Reject".
- Google consent mode: Before Google Tag Manager is loaded, the page sets Google's consent mode signals to "denied" by default. When you permit analytics, only the analytics storage signal becomes "granted"; the advertising storage, advertising data and personalisation signals always remain "denied".
- The site's content security policy (CSP) allows only the Google Tag Manager, Google Analytics and reCAPTCHA addresses; no advertising or other third-party trackers are loaded.
- Withdrawing consent: The "Cookie preferences" link at the bottom of the page reopens the notice at any time. When you switch off analytics, the site deletes Google Analytics' first-party cookies (
_ga,_ga_*,_gid,_gat*) both for the domain you are on and for the parent domain (.protoolbag.com), and then reloads the page; the analytics tags are not run again. Data held by Google on its own domains is outside the scope of this deletion; for such data, Google's tools and your browser settings apply. - Your preference is kept in your browser (
ptb_web_consent), and each preference is also entered in the consent record in §5.3.
5.3 Consent record
In order to be able to show when and to what extent your consent was given or withdrawn, each of your preferences (acceptance, rejection, custom preference, withdrawal) is stored on our servers as a consent record.
- Information stored: the random preference number (
ptb_web_consent_id), the status of each category (necessary / analytics), the type of preference (accept all, reject, custom preference, withdrawal), the notice version and the version of this policy, the page language, the address of the page on which the preference was made (without query parameters), an irreversible one-way digest (SHA-256) of the browser information and the time of the record. - Not stored: No IP address, name, e-mail address or other information directly identifying you is recorded; browser information is not stored in plain form.
- Retention period: Records are deleted 3 years after they are created.
- Access: The record is not public; it is used only for the purpose of proving consent and is not used for marketing or profiling purposes.
- Legal basis: Fulfilment of our legal obligation to prove that consent was obtained (KVKK Art. 5/2-ç).
- Failure to send the record (e.g. a connection error) does not prevent your preference from being applied; your preference remains valid in your browser.
5.4 Personal data submitted with the form
The processing of the information you enter in the contact/demo form is the subject of the KVKK Privacy Notice, not of this policy.
6. Changes
This policy is updated as the storage behaviour of the portal or the website changes and is published at /legal/cookie-policy (in the application portal and at protoolbag.com/en/legal/cookie-policy). When the website section (§5) changes, visitors are asked for their preference again.
Version history
| Version | Date | Change |
|---|---|---|
| 1.0 | 6 November 2026 | Initial publication |
| 1.1 | 6 November 2026 | Website (§5): cookie notice with three equally weighted options and a category panel, Google consent mode, server-side consent record (§5.3; no IP, 3-year retention), preference number and price list cache storage items; visitors are asked for their preference again |