This policy explains the storage technologies used by RentTrust during the Luxembourg pilot. It mirrors our preference-centre categories and data structures. Counsel must finalise controller identity before launch.
Consent manager
RentTrust provides a first-party consent banner and preference centre. Choices are stored locally and, where available, logged server-side in cookie_consent_events for audit evidence—without IP persistence.
Storage actually deployed
This inventory lists first-party cookies and storage used by the live product. Advertising and social trackers are not deployed.
| Name | Location | Duration | Category | Purpose |
|---|---|---|---|---|
| renttrust-locale | HTTP cookie | 1 year | Essential | Remember the language of the interface. |
| renttrust-theme / renttrust-theme | HTTP cookie and local storage | 1 year | Functional | Remember colour mode, only after functional consent. |
| renttrust-cookie-preferences-v2 | Browser local storage | Until you change it | Essential | Remember cookie choices and notice version. |
| sb-*-auth-token | HTTP cookie | Session / refresh token | Essential | Keep an agency or tenant session signed in. |
| rt_agency_mfa | HTTP cookie | 30 days | Essential | Confirm the agency authenticator step for this browser session. |
| rt_agency_device | HTTP cookie | 30 days | Essential | Remember this browser after the agency authenticator, so the code is not asked on every visit. |
| rt_welcome | HTTP cookie | Up to 2 minutes | Essential | Play a one-time workspace welcome after sign-in, then expire. |
| rt_tenant_onboarding | HTTP cookie | 1 year | Essential | Remember that this tenant finished first-run onboarding. |
| rt_analytics | HTTP cookie | 1 year | Analytics | Signed httpOnly cookie that authorizes optional click_events after you opt in. |
| cookie_consent_events | EU-region server store | Audit retention schedule | Essential | Server copy of consent choices without IP addresses. |
| click_events via /api/track | EU-region server store | 13 months proposed | Analytics | Signed httpOnly cookie that authorizes optional click_events after you opt in. |
Essential
Language of the interface, session continuity, security, a short post-login welcome, tenant first-run onboarding, and the consent record itself.
Functional
Optional convenience preferences, including colour mode. Disabled and not stored until you opt in.
Analytics
Optional first-party events via /api/track into click_events, authorized by the rt_analytics cookie after you opt in. Coarse geography only; no advertising identifiers.
Advertising and social
Not deployed. Categories remain locked off in the preference centre.
Changing your mind
Use Cookie preferences in the footer at any time. Withdrawing analytics consent stops future optional events.
Engineering draft for CNPD-oriented evidence. Not a claim of certification or legal compliance.