Cookie Policy

3buddy is a restaurant technology and ordering platform operated by Rexett AB, a company registered in Sweden.

This Cookie Policy explains how we use cookies and similar technologies on 3buddy websites, applications and related services.

It should be read together with the 3buddy Privacy Policy and 3buddy Terms of Use.

1 Who is responsible?

The data controller for cookies used by 3buddy for its own purposes is:

Rexett AB
Pumpgatan 1
417 55 Göteborg
Sweden

Organisation number: 559453-1856
Email: privacy@3buddy.io
Website: https://3buddy.io

2 What are cookies and similar technologies?

A cookie is a small text file stored on your device when you visit a website.

3buddy may also use similar technologies, including:

• Browser local storage
• Session storage
• Security tokens
• Device or session identifiers

These technologies can be necessary for the service to work, or they can be used for optional purposes such as analytics or marketing.

Cookies and similar identifiers can constitute personal data when they can be linked to an identifiable individual. Where that happens, the Privacy Policy also applies.

3 How we use cookies

We use cookies and similar technologies to:

• Make the website and applications work
• Keep you signed in
• Remember language and cookie preferences
• Keep a shopping cart or delivery details while you order
• Protect accounts and payments
• Remember that you accepted these legal terms where required
• Understand how the service is used, if you allow analytics cookies
• Support advertising or campaign measurement, if you allow marketing cookies

We do not use optional analytics or marketing cookies unless you have given consent, or another lawful basis applies.

4 Cookie categories

3buddy groups cookies into three categories. You can see the same categories in our cookie banner and cookie settings.

Necessary cookies

These are required for 3buddy to function. They cannot be switched off in our cookie settings.

They may be used for:

• Security
• Authentication and login
• Session management
• Language selection
• Shopping cart and checkout
• Order and booking flows
• Cookie-consent storage
• Fraud prevention
• Other essential platform functions

Legal basis: these are used because they are necessary to provide the service you request, or because they are required for security.

Analytics cookies

Where enabled, analytics technologies may help us understand:

• How visitors use 3buddy
• Which pages or features are used
• Technical performance
• General usage patterns

These cookies are optional. They are used only if you accept them.

At the date of this policy, 3buddy may store your analytics preference, but we do not currently run a third-party analytics tracker unless one is later enabled and listed below or in an updated version of this policy.

Marketing cookies

Where enabled, marketing technologies may be used to:

• Measure campaigns
• Understand whether an offer or page was useful
• Show more relevant content or advertising

These cookies are optional. They are used only if you accept them.

At the date of this policy, 3buddy may store your marketing preference, but we do not currently run third-party advertising pixels unless one is later enabled and listed below or in an updated version of this policy.

5 How we collect your consent

When you first visit a 3buddy public page, we show a cookie banner.

You can:

• Accept all — allow necessary, analytics and marketing cookies
• Decline — allow only necessary cookies
• Customize — choose analytics and/or marketing cookies

Necessary cookies are always on so the site can work.

You can change your choice later through Cookie settings in the footer.

We store your choice in your browser so that we can respect it on later visits. That stored preference is itself a necessary record of your consent.

If you do not make a choice, we will continue to show the banner and will not enable optional analytics or marketing cookies.

You may withdraw consent at any time. Withdrawal does not affect processing that was lawful before you withdrew consent.

6 Cookies and storage we use

The exact names can change when we update the platform. The list below describes the main types used by 3buddy.

Necessary

• NextAuth / Auth.js session cookies — keep restaurant staff or admin users signed in. Duration: session or up to the login period. Type: first-party cookie.
• buddy_customer_session — keep a customer signed in after email-code login. Duration: up to 30 days. Type: first-party HTTP-only cookie.
• 3buddy_checkout_draft — remember an unpaid checkout so the cart can be restored if you leave Stripe without paying. Duration: up to 24 hours. Type: first-party cookie.
• Language / locale setting — remember Swedish or English. Duration: session or persistent, depending on browser. Type: first-party cookie or URL setting.
• CSRF / security tokens — protect login and forms against misuse. Duration: session. Type: first-party cookie.
• 3buddy_cookie_consent — remember your cookie choices. Duration: until you change or clear it. Type: local storage.
• Shopping cart storage — remember items in an online order. Duration: until the cart is cleared or you remove site data. Type: local storage.
• Checkout contact draft — remember name, phone, email, allergy choices and legal acceptance while you order. Duration: until the cart is cleared or you remove site data. Type: local storage.
• Delivery address draft — remember a delivery address while you complete an order. Duration: until cleared or you remove site data. Type: local storage.
• Login or signup draft — keep an email-code login or restaurant signup in progress if you reload the page. Duration: until the flow is finished or the tab is closed. Type: session storage.
• Legal-consent record — remember that a customer has accepted the Privacy Policy and Terms of Use on this device. Duration: until you clear site data. Type: local storage.

Analytics

Used only if you accept analytics cookies.

• Analytics preference in 3buddy_cookie_consent — stores whether you allowed analytics. Duration: until you change it. Type: local storage.
• Future analytics cookies or tags — measure usage and improve the service if a provider is later enabled. Duration: as set by the provider. Type: first-party or third-party.

No third-party analytics provider is currently active by default.

Marketing

Used only if you accept marketing cookies.

• Marketing preference in 3buddy_cookie_consent — stores whether you allowed marketing. Duration: until you change it. Type: local storage.
• Future marketing cookies or pixels — measure campaigns or show more relevant offers if a provider is later enabled. Duration: as set by the provider. Type: first-party or third-party.

No third-party advertising pixel is currently active by default.

7 Third-party cookies

Some 3buddy features open or use third-party services. Those services may set their own cookies.

Examples include:

• Stripe — when you pay for an online order or gift card, Stripe Checkout may set cookies needed to process the payment securely
• Email or authentication providers — if used to deliver login codes or protect accounts
• Maps or location services — if a map or address lookup is shown
• Hosting or security providers — if needed to deliver or protect the website

We do not control cookies set by third parties on their own domains.

If you start a payment, Stripe processes payment information according to its own terms and privacy policy.

8 Legal bases

Depending on the cookie, we may rely on:

• Necessity / performance of a contract — for cookies required to log in, keep a cart, complete checkout, keep a session secure or provide the page you asked for
• Consent — for optional analytics and marketing cookies
• Legitimate interests — only where permitted, for example limited security or abuse-prevention measures that are not optional marketing

Where consent is required, we will ask for it before using those cookies.

9 What information cookies can involve

Depending on the cookie, we may process:

• Session or account identifiers
• Language preference
• Cookie-consent choice
• Cart or checkout state
• Technical information such as browser type, device type or approximate time of use
• Information needed to keep a login secure

We do not use cookies to sell customer personal data.

More detail about personal data is in the 3buddy Privacy Policy.

10 How long cookies are kept

Retention depends on the cookie:

• Session cookies are usually deleted when you close the browser
• Persistent cookies or local storage remain until they expire, until the purpose ends, or until you delete them
• Customer login cookies may last up to 30 days
• Cookie-consent records are kept so we can respect your choice
• Cart and draft data are kept only as long as needed to complete or recover the relevant flow

If you delete site data in your browser, these items are usually removed from that device.

11 How to manage cookies

Through 3buddy

Use Cookie settings in the footer of public 3buddy pages.

You can:

• Allow analytics cookies
• Allow marketing cookies
• Keep only necessary cookies

Through your browser

You can also block or delete cookies in your browser settings. The steps depend on the browser.

If you block necessary cookies, parts of 3buddy may stop working. For example, you may not be able to stay logged in, keep a cart, or complete checkout.

12 Restaurant websites and restaurant cookies

3buddy is used by restaurants. A restaurant may also have its own website, marketing tools or cookie practices outside 3buddy.

This Cookie Policy covers cookies used by the 3buddy platform.

If a restaurant uses additional tools on its own website or in its own marketing, that restaurant is responsible for providing its own information where required.

13 International transfers

Some technology providers may process cookie-related information outside Sweden or outside the EU/EEA.

Where that happens, we will only do so where permitted by applicable data protection law, for example through an adequacy decision or Standard Contractual Clauses.

More information is in the Privacy Policy.

14 Your rights

Where cookies involve personal data, you may have rights under GDPR, including the right to information, access, rectification, erasure, restriction, objection and, where processing is based on consent, the right to withdraw consent.

To exercise these rights, contact:

Email: privacy@3buddy.io

You also have the right to lodge a complaint with Integritetsskyddsmyndigheten (IMY): https://www.imy.se/

15 Changes to this Cookie Policy

We may update this Cookie Policy if we change the cookies we use, add a new provider, change the consent tool, or need to reflect legal requirements.

The latest version will be published on this page.

If we start using a new optional analytics or marketing provider, we will update this policy and, where required, ask for consent before those cookies are used.

16 Contact

Rexett AB / 3buddy
Pumpgatan 1
417 55 Göteborg
Sweden

Organisation number: 559453-1856
Email: privacy@3buddy.io
Website: https://3buddy.io

17 Summary

• Necessary cookies are always used so 3buddy can work.
• Analytics and marketing cookies are optional and require your consent.
• You can change your choice in Cookie settings.
• Stripe and other third parties may set their own cookies when you use their services.
• This policy should be read together with the Privacy Policy and Terms of Use.