Cookie Policy and Similar Technologies
Last reviewed: 25 August 2026.
The public In Situ 360 website uses browser storage needed to remember language and cookie choices. Optional first-party analytics and approximate IP geolocation are activated only after analytics consent. The current audited code does not use behavioural-advertising or marketing cookies.
1. Data controller
- Controller: INSITU360, S.L.
- Tax ID: B70687991.
- Address: Calle Pujades, 158 BIS-3ª - 08005 - Barcelona (Spain).
- Privacy/contact email: support@in-situ360.com.
- Phone: +34 666445481
2. What are cookies and similar technologies
Cookies are small files stored on your device when you visit a website. We may also use similar technologies such as browser local storage (localStorage), session identifiers, tracking pixels, or equivalent tools that store information or access information already stored on your device.
In this policy, we use the expression “cookies and similar technologies” to refer to all of them.
3. Categories we use
a) Strictly necessary storage
- vt_consent (localStorage): records the current cookie choice and policy version so the banner is not shown on every visit.
- preferred-language (localStorage): remembers the language deliberately selected by the visitor.
- Temporary security, routing or authentication storage used to deliver a page or a user-requested authenticated action.
Strictly necessary storage is not used for advertising and is available without optional consent only to provide the requested site function, record the choice or protect the service.
b) Optional analytics and measurement
When analytics is accepted, the site may create vt_vid, vt_sc and vt_ft in localStorage and vt_geo in sessionStorage. It may send first-party measurement events to the In Situ 360 Supabase backend and request approximate country, region and city data from ipapi.co.
- Pages visited, entry and exit, time, active time, scroll depth and selected interactions.
- Referrer, campaign parameters, browser, operating system, device type, language, time zone, screen/viewport and connection category.
- Performance, client-side errors, approximate IP-derived location and a pseudonymous visitor/session identifier.
These technologies remain off before consent and after rejection or withdrawal.
c) Advertising or marketing
The current audited website does not activate behavioural-advertising, remarketing or marketing cookies. If this changes, the banner, inventory and this policy must be updated before those technologies are enabled where consent is required.
4. Legal basis for use
Strictly necessary cookies and technologies are used because they are essential for the technical operation of the website or to provide user-requested services.
Analytics, measurement, marketing, or equivalent non-essential technologies are used only if the user provides consent through the banner or settings panel available on website access.
5. Giving or refusing consent
The first layer offers equally available controls to accept optional analytics or reject it. Settings explain the essential and analytics categories. Closing, scrolling or continuing to browse is not treated as consent, and optional analytics remains disabled until an affirmative choice is stored.
6. Changing or withdrawing consent
Use Cookie settings in the website footer at any time. Rejecting analytics stops new optional measurement and removes the website's analytics identifiers from local/session storage where technically available. You can also clear site data in browser settings. Withdrawal does not affect processing that was lawful before withdrawal.
7. Duration
- vt_consent and preferred-language: until the visitor changes the choice or clears site data; a new consent decision may be requested when the policy version changes.
- vt_geo: for the current browser tab session.
- vt_vid, vt_sc and vt_ft: until analytics is rejected/withdrawn or site data is cleared.
- Server-side analytics records: for the limited period needed for statistics, security, troubleshooting and legal claims under the controller's reviewed retention schedule.
8. Providers
- INSITU360, S.L. consent system: stores the visitor's choice.
- Supabase: receives and stores first-party analytics events after consent.
- ipapi.co: returns approximate IP-based location after consent.
Provider processing and any international transfer must follow the Privacy Policy and the applicable contractual or legal safeguards. External links chosen by a visitor may apply their own cookies after navigation to the third-party site.
9. Current technology inventory
The identifiers listed in sections 3 and 7 are the current application-controlled inventory found in the audited source code. Authentication or payment pages may also use storage that is strictly necessary to complete a user-requested secure session. The inventory must be reviewed whenever a new SDK, analytics tool, advertising service or embedded third-party content is introduced.
Technical / necessary
- vt_consent — consent choice and version.
- preferred-language — selected display language.
- Short-lived security, routing or authentication state required by a requested flow.
Analytics / measurement
- vt_vid — pseudonymous visitor identifier.
- vt_sc — visit counter.
- vt_ft — first campaign attribution.
- vt_geo — session cache of approximate IP-derived location.
- First-party Supabase analytics events generated only after consent.
Marketing
Not currently used in the audited website.
Consent, withdrawal and scope of this policy
Technologies strictly necessary to provide a requested service are distinct from those used for optional purposes. The optional analytics and approximate geolocation described in this policy require prior consent where applicable law requires it. Continuing to browse, closing a notice or accepting the general terms does not replace a valid choice.
You may withdraw consent without affecting the lawfulness of earlier processing. Withdrawal must stop future processing that depends on that consent. Clearing browser information does not automatically delete records already received by our systems; you may email support@in-situ360.com to exercise rights concerning those records.
Analytics identifiers, IP addresses and approximate location may be personal data even if they do not include your name. Using first-party analytics does not automatically make that data anonymous or exclude the involvement of providers.
This policy describes storage and technologies in the web environment to which it refers. It should not be read as a statement about every SDK, permission or processing activity in the mobile application. Information about additional processing must be provided in the relevant context before it takes place where required by law.
10. More information on data protection
For more information about how we process personal data, please see our Privacy Policy.