Sergio — Cookie & Device Storage Notice
Version: 1.1
Last updated: 12 October 2026
Effective date: 12 October 2026
This Cookie & Device Storage Notice explains how Antaris Labs SRL (Antaris, we, us) uses cookies and comparable technologies on sergiosommelier.com and related Sergio pages.
Important: In Belgium, the rules governing “cookies” also apply to comparable technologies that store information on, or access information from, a device. This can include local storage, session storage, browser cache, service-worker cache, pixels and fingerprinting. The name of the technology does not determine whether consent is needed.
This Notice supplements the Privacy Notice. It must be read with the live, route-by-route technical inventory and the active consent/settings interface.
1. Controller and contact
| Item | Details |
|---|---|
| Controller | Antaris Labs SRL, Avenue de Tervueren 242, box 005, 1150 Woluwe-Saint-Pierre, Brussels, Belgium |
| CBE/KBO enterprise number | 1036.755.202 |
| Privacy contact | privacy@sergiosommelier.com |
| Supervisory authority | Belgian Data Protection Authority, www.dataprotectionauthority.be |
2. How we classify technologies
2.1 Strictly necessary technologies
Some storage/access is strictly necessary to transmit a communication or provide a service that you explicitly request. We may use those technologies without asking for prior consent, but we still explain them here and process associated personal data under the Privacy Notice.
Examples can include a temporary language preference, an authenticated-session security token after you sign in, and a narrowly configured anti-bot challenge that you activate by submitting a sign-up or contact form.
2.2 Optional technologies
A technology that is not strictly necessary—such as analytics, marketing, behavioural profiling, cross-site tracking, optional offline caching or non-essential third-party resources—is not placed or accessed until you give the required prior consent. Consent is voluntary, specific, granular, active and can be withdrawn as easily as it is given.
We do not use advertising cookies or marketing pixels. We do not run non-essential analytics or behavioural tracking unless it has first been added to this Notice and activated through the consent interface.
3. Current storage and device-access inventory
The entries below describe the configuration as implemented on 12 October 2026. If the implementation changes, this inventory and any consent controls are updated before the change is released.
| Technology / possible identifier | Route and purpose | Category and legal handling | Intended duration | Data/recipient notes |
|---|---|---|---|---|
Language preference (browser local storage: sergio-landing-lang on the public website; sergio-staff-lang in /admin and /scan) | Remembers the language the visitor selected. Guest QR pages store nothing on the device: the guest picks a language on each visit | Strictly necessary functional storage: holds only the language code and is not used as an identifier or for analytics. Information is provided here; no opt-in. | Until the visitor clears their browser storage or selects another language | The value is en, fr or nl. It is not sent to Antaris. |
Authenticated administration session (browser local storage sb-cxfbiiovxqkiejquvjdm-auth-token in /admin and /scan; session storage sergio-ops-auth on the operator dashboard; session storage sergio_invite_pending while an invitation link is being completed) | Keeps a signed-in user authenticated and completes invitation links | Strictly necessary authentication/security storage. Information is provided here; no opt-in. | The session lasts until sign-out; its access token is short-lived and renewed automatically while the user stays signed in. Session-storage entries are cleared when the browser tab is closed | The session is issued by Supabase Auth (see the Privacy Notice). It is not used for analytics. |
| Cloudflare Turnstile / form-security challenge | Account sign-up on /contact only. The challenge is loaded when the person starts filling in the sign-up form, not when a page opens, and not for the “Talk to us first” form | Strictly necessary security access: loaded solely to protect the form the person chose to use, with no analytics, marketing or tracking use. Information is provided here; no opt-in on that limited basis. | The challenge token is valid for five minutes and is used once, for that sign-up | Cloudflare receives the IP address, browser and device security signals and the page origin. Its processing and safeguards are described in the Privacy Notice. |
| Consent preference (once optional technologies are used) | Records the choices made in the cookie/settings interface | Strictly necessary preference storage for proving and respecting a choice. It does not itself authorise optional processing. | No more than six months unless a different justified/verified period is stated | Stores consent preference/version only; must not be used for analytics or tracking. |
| Guest service worker and Cache Storage | Guest QR pages install no service worker and write nothing to Cache Storage. A visitor whose browser kept a worker from an earlier version receives a removal script that deletes those caches and unregisters itself | Not used | Not applicable | No device storage is written on guest pages. |
| Fonts and code libraries | Fonts and the JavaScript libraries Sergio’s pages use (the Supabase client and a QR-code library) are served from sergiosommelier.com itself. Rendering a page sends no request to a third-party font or code service | Strictly necessary resource fetch from Antaris’s own site: no cookie or device storage is set | Browser cache only | No third party receives these requests. |
No current optional analytics/advertising category
As of the last-updated date above, Antaris does not use optional analytics, advertising, social-media pixels, remarketing, cross-site tracking or behavioural-profiling technologies on Sergio public/guest pages. If Antaris introduces one, it will first update this Notice, describe the technology and recipient, provide a valid purpose-specific choice, and block it until consent where required.
4. Third-party resource requests and direct browser disclosures
A browser can contact a third party even when no conventional cookie is placed. For example, a remotely hosted font or code library may receive technical request data such as IP address, requested URL or referrer, browser/operating-system headers and cache information.
Antaris self-hosts its fonts and the JavaScript libraries its pages use, so rendering a Sergio page sends no request to a third-party font or code service. The one third-party resource is Cloudflare Turnstile on the sign-up form, described in section 3. These resources do not themselves set a Sergio cookie or write Sergio-controlled local or session storage.
If a third-party resource performs optional tracking, writes/reads device storage, fingerprints a device, or is not necessary for the requested page/service, Antaris will block it until the visitor gives the required consent. A remote resource will not be treated as strictly necessary merely because it is visually convenient.
5. Your choices and withdrawal
5.1 Necessary technologies
You can configure your browser to block/delete cookies and storage. Doing so may prevent language retention, sign-in, account security or the requested contact/sign-up form from working. Necessary technologies are not controlled through the optional-consent choice because they are needed for the relevant requested function.
5.2 Optional technologies
Where an optional technology is available, the consent interface will offer equally accessible controls to:
- Accept all optional technologies;
- Reject all non-essential technologies; and
- make granular choices by purpose.
Continuing to browse, scrolling, closing a banner, accepting the B2B Terms or leaving settings unchanged is not consent. Optional processing is off by default.
You can revisit and withdraw optional consent at any time through the Cookie settings control, which is shown persistently in the website footer or interface whenever an optional technology is enabled. Withdrawal stops future optional storage/access and, where technically possible, clears or disables related optional state. It does not make prior processing unlawful.
6. Managing storage in your browser
You can also manage or delete cookies/site data using your browser settings. Useful browser instructions are available from the browser provider, for example:
Deleting a browser’s site data does not delete data already held in Antaris’s systems. For information about personal-data rights, read the Privacy Notice or contact privacy@sergiosommelier.com.
7. Changes to this Notice
We may update this Notice when our technology, providers, purposes or legal requirements change. We will update the version/effective date and, where required, obtain a new choice before an optional purpose begins.