Cookies and similar technologies
Last updated 2026-01-01 · Version 1 · Controller: StrandaData, Norway
| Cookie / key | Category | Purpose | Retention | Set by |
|---|---|---|---|---|
| lf_cookie_consent_v1 | Strictly necessary | Stores your cookie choices so we do not ask again on every page. | 12 months (browser local storage) | LOSTandFOUND.no |
| sb-*-auth-token | Strictly necessary | Keeps a property or administrator signed in to their account. | Session / until sign-out | Supabase (our hosted backend) |
| __stripe_mid / __stripe_sid | Strictly necessary | Fraud prevention and secure card payments during checkout. | 30 minutes – 12 months | Stripe Payments Europe |
| lf_prefs | Preferences | Remembers interface choices such as language, region and list settings. | 6 months | LOSTandFOUND.no |
| Aggregated usage measurement | Statistics | Counts page views and completed return steps in aggregate so we can improve the flow. Only set if you consent. | Up to 13 months | LOSTandFOUND.no |
| Campaign measurement | Marketing | Not currently in use. If we ever add advertising measurement it will only load after your explicit consent. | n/a | n/a |
1. What this policy covers
This policy explains our use of cookies and equivalent technologies — local storage, session storage, pixels and device identifiers — on LOSTandFOUND.no and any subdomain we operate. It applies worldwide and is written to meet the EU/EEA ePrivacy Directive and GDPR, the Norwegian Electronic Communications Act, the UK PECR and UK GDPR, the California Consumer Privacy Act as amended (CPRA), Brazil's LGPD and comparable consent rules elsewhere.
2. Consent is asked for first
No cookie or storage entry other than the strictly necessary ones listed below is written before you make a choice. Refusing is as easy as accepting: the banner offers 'Reject non-essential' with equal prominence, and closing the banner is treated as a refusal. We do not use cookie walls, pre-ticked boxes or implied consent from scrolling.
3. Withdrawing or changing consent
You can change your choices at any time using the 'Cookie settings' link in the footer of every page, or by clearing site data in your browser. Withdrawal takes effect immediately for future processing and does not affect the lawfulness of processing carried out before withdrawal.
4. Transfers and processors
Strictly necessary cookies may be set by our hosting, authentication and payment processors acting under written data processing agreements. Where personal data leaves the EEA it is transferred under the European Commission's Standard Contractual Clauses together with supplementary safeguards.
5. Do Not Track and Global Privacy Control
We honour the Global Privacy Control (GPC) signal as a valid opt-out of any sale or sharing of personal information under US state privacy laws. We do not sell or share personal information, and we do not use cross-context behavioural advertising.
6. Children
The service is not directed at children under 16. We do not knowingly set non-essential cookies on devices we know to be used by a child.
7. Changes and contact
When we add a new cookie category or a new processor, consent is requested again and the version of this policy is incremented. Questions about cookies can be sent to privacy@lostandfound.no — the controller is StrandaData, Norway.