Cookie Policy
This page lists everything Hilma Biocare stores on your device, what it is for, and how long it lasts. We do not use any third-party analytics or advertising cookies.
Strictly necessary
These are required for the shop to function and do not need your consent.
| Name | Purpose | Lifetime |
|---|---|---|
| cartId | Remembers the contents of your basket | 30 days |
authjs.session-token (__Secure-authjs.session-token over HTTPS) | Keeps you signed in — the same cookie is used for customer and staff accounts | 30 days |
authjs.callback-url (__Secure-authjs.callback-url over HTTPS) | Written when you sign in; records the page to return you to afterwards | Until you close your browser |
| cookie-consent | Remembers the choice you made on this page | 6 months |
| admin-active-store | Staff only — remembers which store a staff member is managing; never set for customers | 30 days |
| sidebar_state | Staff only — remembers whether the admin sidebar is open; never set for customers | 7 days |
One more cookie exists but is not listed above, because visiting the shop never produces it. Our sign-in system provides a set of built-in addresses under /api/auth/ which nothing on this site links to; opening one of them directly also sets a short-lived authjs.csrf-token (__Host-authjs.csrf-token over HTTPS), which guards against cross-site request forgery and lasts until you close your browser. Signing in through our own login form does not set it.
Set by your own actions
| Name | Purpose | Lifetime |
|---|---|---|
| preferred-currency | Stored when you switch between EUR and USD | 1 year |
| wishlist (local storage) | Products you added to your wishlist | Until you clear it |
| recently viewed (local storage) | Products you looked at, shown back to you | Until you clear it |
| support chat session (local storage) | Keeps the support conversation you started open. It holds a sign-in token for that conversation which stops working 30 days after it is issued; the stored entry itself carries no expiry date | Until the chat clears it — when you start a new conversation, or when the saved one is no longer accepted — otherwise until you clear your browser storage |
Analytics and marketing
We currently use none. No Google Analytics, no Google Tag Manager, no advertising pixels. The Inter typeface is served from our own servers, so loading a page sends no request to Google.
The choices in Cookie settings exist so that if we ever add such a tool, it cannot load unless you have allowed it first. Leaving both switched off changes nothing today.
Error reporting
We use Sentry to be told when a page breaks. It stores nothing on your device and we have disabled session recording.
Changing your mind
Use the Cookie settings link in the footer at any time. Withdrawing consent is exactly as easy as giving it. You can also delete cookies in your browser settings, though the shop will not remember your basket or keep you signed in afterwards.
Contact
Questions about this policy: support@hilmaeurope.com.