Cookie Policy
This Cookie Policy explains how Wallymanager uses cookies and similar technologies when you visit or use our service.
1. What cookies are
Cookies are small files that a website or an application may store on your device. Similar technologies are local storage, session storage, Service Worker, Cache Storage, software identifiers, scripts and web beacons. In this Policy we use the general term “cookies and similar technologies”.
2. Who uses these technologies
These technologies are used by „Уолимениджър“ ЕООД / „Wallymanager“ LTD, UIC: 208882840, address: 1A Skopie Street, floor 4, apt. 16, Yuzhen district, Plovdiv 4003, Republic of Bulgaria, as well as by a limited number of external providers, where this is necessary for sign-in, security, payments or another requested feature.
3. Categories of technologies
The cookies and similar technologies used fall into the following categories:
| Category | Purpose | Examples | Consent |
|---|---|---|---|
| Strictly necessary | operation of the account, sign-in, security, session persistence, protection against abuse, payment, PWA/offline shell | JWT token and account identifier in localStorage; Google OAuth token; wm_cookie_consent; return‑url; wm_plan_selection_pending in sessionStorage; Service Worker and Cache Storage; Google reCAPTCHA v3; Google Identity Services; Stripe Checkout; session identifier | no consent is required where they are strictly necessary for the requested service |
| Functional | storing the User’s direct choices — interface language, last selected tab, receipt-OCR locale preference and installation as an application; and correctly displaying the specific dashboard screen, savings fund or goal-achieved modal that the User is already viewing, without repeating the same motivational content within the same day — all necessary to provide the specifically requested feature or screen | language; wm_finance_selected_tab; wm_planning_selected_tab; receipt:lastLocale; Web App Manifest for installation as an application; wm.quote.dashboardDismissedDate; wm.quote.fundDismissedDate; wm.quote.dashboardLastShown | no consent is required. The values for interface language, tab, OCR locale and installation as an application store the User’s own direct choice and are strictly necessary to provide the requested feature. The dates for motivational/quote content (wm.quote.*) reflect static, local content with no backend, no personalisation and no profiling; the data does not leave the User’s device, is not shared with third parties and contains no identifier linking different sessions or devices — it serves solely to correctly display the specific view the User is already looking at (dashboard, savings fund or goal-achieved modal), without repeating the content within the same day, which is a technical necessity for rendering the requested page rather than a marketing or tracking mechanism. |
| Analytics | measuring traffic, errors, feature usage and improving the service | Google Analytics 4, provided by Google Ireland Limited: _ga and _ga_ (followed by a stream identifier) cookies with a 2-year lifespan; a client identifier generated by Google's script; screens visited; traffic source (UTM parameters), stored in the browser's session storage under the key wm_utm_params until the end of the session; device type and browser; approximate location by IP address | prior consent is required, unless the law permits otherwise |
| Marketing | advertising, remarketing, campaign measurement, profiling for advertising | Meta Pixel, provided by Meta Platforms Ireland Limited: _fbp and _fbc cookies with a 3-month lifespan (_fbc is set upon a visit via an advertising link); the “registration”, “trial started” and “purchase completed” events. Meta Conversions API: the same purchase events, sent from the Provider's server to Meta, with an email address hashed by SHA-256 as the identifier for matching and deduplication against the browser event (hashing does not constitute anonymisation) | prior consent is required |
4. Google reCAPTCHA and Google Sign-In
Google reCAPTCHA v3 and Google Identity Services may be loaded on the sign-in and registration pages. The purpose is protection against bots and abuse and facilitating sign-in with Google. When making a payment, the User may be redirected to a hosted Stripe payment page. These external services may process technical data and set their own cookies or identifiers, including on their own domains, in accordance with their own rules.
5. Analytics and marketing
We use the following analytics and marketing technologies. Each of them is loaded and activated only after your prior consent for the respective category. Google Analytics 4, provided by Google Ireland Limited — for measuring visits, feature usage and the user's path through the application. Activated only with consent for the “Analytics” category. With your separate consent for marketing technologies, we use Meta Pixel and Meta Conversions API, provided by Meta Platforms Ireland Limited, to measure the performance of advertising campaigns, remarketing and the advertising purposes permitted in the consent. Activated only with consent for the “Marketing” category. For the corresponding jointly determined collection and transmission of data, „Уолимениджър“ ЕООД and Meta Platforms Ireland Limited act as joint controllers. We are responsible for the information and choices within Wallymanager, for collecting and demonstrating consent, and for the integration settings. The allocation of the remaining obligations is described in the applicable joint-controller arrangement (see the Meta Business Tools Terms, https://www.facebook.com/legal/technology_terms, and the Controller Addendum, https://www.facebook.com/legal/controller_addendum). You may exercise your rights against either joint controller. In server-side transmission to Meta, a hashed value of the email address may be sent via SHA-256 to match the event to a user. This does not constitute anonymisation. The purchase event relates to a Wallymanager subscription. We do not transmit the content of your personal financial log, receipts or AI requests for advertising purposes. Data in Google Analytics 4 is stored for 14 months from collection — see section II.8. Consent for the “Analytics” and “Marketing” categories is given and withdrawn separately for each. Consent for one category does not constitute consent for another. The “Strictly Necessary” category does not require consent, since it is necessary to provide the requested Service. Google and Meta process the transmitted data under their own privacy policies and data processing terms. The transmission includes a transfer to the USA under the conditions described in section II.7 of this Privacy Policy. You can withdraw your consent for analytics or marketing separately at any time via the banner and the Account → Privacy & Consent settings. After withdrawal we stop any new transmission for the respective purpose, including transmission from our server, and remove the relevant identifiers that are under our control. Withdrawal does not affect the lawfulness of processing carried out before it. For data already transmitted, you may exercise the applicable rights, including the right to erasure; this is separate from the removal of identifiers from the device.
6. Managing your preferences
You can manage the optional cookies through the consent banner or through the privacy settings section: Account → Privacy & Consent. Withdrawing consent must be as easy as giving it. Strictly necessary technologies cannot be switched off through the banner, because without them the Service cannot operate securely or as requested by you.
7. Browser settings
Most browsers allow cookies to be deleted or blocked. If you block strictly necessary technologies, part of the Service may not work correctly, including sign-in, protection of the account, payments or the saving of settings.
8. Updates
We will update this Policy in the event of changes to the technologies used, the providers, the purposes or the legal bases. Before introducing any new analytics or marketing tool, a technical review of the cookies and similar technologies actually set should be carried out.
9. Contact
For questions regarding cookies and similar technologies: „Уолимениджър“ ЕООД / „Wallymanager“ LTD, email: support@wallymanager.com, contact point for the protection of personal data: support@wallymanager.com.
For any questions about cookies and similar technologies, please contact our data-protection contact point at support@wallymanager.com.