Cookie Policy
This is an English translation of a document drawn up in Polish and governed by Polish law. It is provided for information only: if the two versions differ, the Polish version prevails.
Contents
Version 1.1 · in force from: 11 October 2026 · last updated: 2026-10-11
This policy describes which cookies and similar technologies we use on the onerental.app websites and in the application, for what purpose, and how you can change your choices. It supplements the Privacy Policy.
1. Legal basis
Storing information on your device and gaining access to information already stored there requires your consent – in line with Article 361 of the Act of 12 July 2024, Prawo komunikacji elektronicznej (the Polish electronic communications law). The exception is files that are essential for providing the service you yourself request (e.g. keeping your logged-in session). If data from cookies constitutes personal data, the basis for processing it is your consent (Article 6(1)(a) GDPR) or our legitimate interest as regards essential files and security (Article 6(1)(f) GDPR).
We collect consent in a banner on your first visit; "Reject all" sits next to "Accept all", and in the settings every optional category starts switched off. Until you consent, only the essential categories store anything on your device. Google's tags load in Google Consent Mode with every analytics and advertising signal denied: they set and read no cookies and send Google only cookieless signals, described in § 5.4 of the Privacy Policy. Better Stack and Meta do not run at all. If we change the purposes or the providers described in the banner, we will ask you for consent again – a decision made under an earlier version of the banner stops applying.
2. Categories
| Category | What it is for | Consent required |
|---|---|---|
| Essential | logging in, session, security, remembering your consent choices, language | no |
| Functional | interface preferences (theme, most recently selected branch) | no |
| Analytics | visit statistics, user journeys, session recordings and error diagnostics, testing changes in the product | yes |
| Marketing / advertising | measuring campaign effectiveness, attribution of the visit source, remarketing | yes |
3. Specific files and tools
| Name / tool | Category | Who sets it | Storage period | Purpose |
|---|---|---|---|---|
__onerent.session_token and related | essential | OneRental (first party) | until logout / 30 days | keeping your logged-in session, protection against CSRF |
_or_consent | essential | OneRental | 180 days | remembering your choices in the consent banner, the banner version and the date of the decision |
_or_consent_sf, _or_consent_sf_<company> | essential | OneRental | 180 days | choice in the consent banner on a rental company's booking page, stored separately for each company |
NEXT_LOCALE | essential | OneRental | 12 months | remembering the language version |
__cf_bm, cf_clearance (Turnstile) | essential | Cloudflare | up to 30 minutes / 12 months | protecting forms against bots |
_or_attribution | marketing | OneRental | 90 days | remembering the visit source (UTM, referrer) for attribution |
_ga, _ga_* (Google Analytics through GTM) | analytics | up to 13 months | statistics of traffic and behaviour on the site | |
_gcl_au, _gcl_aw, _gcl_gb (Google Ads) | marketing | Google (on onerental.app) | up to 90 days | storing the ad click identifier, so a sign-up or enquiry can be attributed to the ad that led to it (conversion measurement) |
Google Ads cookies on Google's domains (e.g. IDE on doubleclick.net) | marketing | up to 13 months | remarketing and ad personalisation – only with consent to ad personalisation | |
| Umami (self-hosted instance) | analytics | OneRental | no cookies | visit statistics without identifiers on the device |
| Vercel Analytics, Speed Insights | analytics | Vercel | no cookies | visit statistics and measurement of page performance |
| Better Stack (JS tag) | analytics | Better Stack | session identifier for the visit | reporting errors in the browser, session recordings, performance metrics, event statistics |
_fbp, _fbc | marketing | Meta | up to 90 days | measuring campaign conversions, remarketing |
The Better Stack script is not downloaded until you consent to the analytics category – before consent your browser does not connect to Better Stack at all. For logged-in users we attach to the session the account identifier, the first and last name, the e-mail address and the language of the interface, and – in a company's panel – the company's identifier, name and plan and the user's role in that company, so that we know whose session a report or a recording concerns. Password fields and fields with document and card data are excluded from recordings.
The table describes the current state. If we launch a new tool, we will update it before switching that tool on.
4. How to change your consent
- The footer of every page contains a "Cookie settings" link – it opens a panel where you can switch individual categories on or off. The change takes effect immediately, withdrawing consent is just as easy as giving it.
- You can also manage cookies in your browser settings: delete stored files or block them from being stored. Blocking essential files will make it impossible to log in to the application.
- Withdrawing consent does not affect the lawfulness of processing carried out before its withdrawal.
Consent register. Every decision made in the banner or in the cookie settings on your account is also saved on our server, so that we can demonstrate when and to what you consented, or when you withdrew consent (Article 7(1) GDPR). The entry covers: the choice in each category, the banner version and a hash of its content, the date of the decision, the page on which it was made, the visitor identifier stored in the browser (if one exists) and – when you are logged in – your account identifier. We do not save the IP address or browser data in the entry. We keep entries for 3 years from when they were saved, and then delete them.
5. Similar technologies
Besides cookies we use localStorage and sessionStorage (interface preferences, a buffer for an unfinished reservation form) and pixels in e-mail messages that report the opening of a message – to the extent covered by your marketing consent. With consent to marketing, Google Ads may keep the ad click identifier in localStorage as well as in the _gcl_* cookies. With consent to the analytics category, the Better Stack script additionally reads browser and device properties (among others screen resolution, browser version, time zone) in order to recognise the session, and records the course of the visit as a recording. The rules for access to these mechanisms are the same as for cookies.
6. Recipients of data from cookies
Data from analytics and marketing files goes to the providers listed in the Subprocessor list. Some of them are entities outside the EEA – the bases for the transfer are described in § 6 of the Privacy Policy.
7. Contact
Questions about cookies: privacy@onerental.app or support@onerental.app.