Cookie Policy

1Who we are

This website and the Ruta service are provided by:

Name: Vladyslav Smirnov, sole trader (empresario individual / autónomo)
Tax number (NIE): Z0736209F
Address: calle Tribunal de les Aigues 2, Catarroja, Valencia, 46470, Spain
Email: info@rutaspain.com

We trade under the brand name Ruta. In this policy, "Ruta", "we" and "us" mean the person and business above. "You" means anyone who visits our website or uses our service.

2What this policy covers

This policy explains what we store on your device, why, for how long, and who places it. It covers our two sites:

rutaspain.com — the landing page, where you are reading this.
app.rutaspain.com — the product: the assistant, your account and payment.

"Cookies" here means more than cookies. The rule that applies to us (Article 22.2 of the Spanish Law 34/2002 on information society services, which applies the EU ePrivacy rules) covers anything stored on or read from your device. That includes cookies and also your browser's local storage. Ruta uses both, and this policy lists both.

How we handle your personal data is explained in the Privacy Policy. Who we are and how you may use the site is set out in the Legal Notice.

3The short answer

We do not track you. There is no analytics tool, no advertising tag, no social-media plug-in, no chat widget and no captcha anywhere on our sites.
We store only what the service needs to work. Everything is listed in section 4. The law does not require consent for storage that is strictly necessary to provide a service you explicitly asked for, and nothing on our list goes beyond that. That is why you do not see a cookie banner.
Nothing is sent to anyone else just because you opened a page. The page, its fonts and everything on it come from our own domain. A third party is contacted only when you do something that needs it: sign in, or pay. Section 6 says who and when.
We still have to tell you what is stored. This page is that.

4What we store on your device

Seven items can end up on your device. None is placed for advertising, none is shared with anyone, and none identifies you by name.

ItemTypePlaced byPlaced whenKept forWhat it doesWhy no consent is needed

1. chat_session_idLocal storageRutaWhen you send your first message in the chat. Never on page load.30 days from the moment the conversation starts. It stops being honoured then, and it is removed the next time you open the site after that.Keeps the messages you send in one conversation on our server instead of starting a new one on every reload, and lets us attach that conversation to an account you create from this browser within the 30 days.It is needed to deliver the conversation you asked for. It identifies no person, it is not used to profile you, and it is shared with nobody.

2. chat_session_expires_atLocal storageRutaAt the same moment as item 1.The same 30 days as item 1. Removed together with it.Records the date on which item 1 stops being honoured, so that an old identifier is discarded rather than reused.Same as item 1.

3. NEXT_LOCALECookieRutaOn your first visit, holding our default language (Ukrainian). Rewritten when you choose a language.1 year from the last time it was written.Shows every page in one language.It holds only a language code, so that the interface you are using stays in one language. It identifies no person and is shared with nobody.

4. sb-naogordoadvfhdnbidyi-auth-token (may be split into parts whose names end in .0, .1)CookieSupabase, our sign-in provider, on our behalfWhen you sign in, or when you confirm a new account.Until you sign out. If you do not sign out, it is renewed while you use the service and expires 400 days after the last renewal.Keeps you signed in and proves to our server that a request comes from you.Signing in is a service you explicitly asked for, and the law exempts what is needed to provide it.

5. sb-naogordoadvfhdnbidyi-auth-token-code-verifierCookieSupabase, on our behalfWhen you start creating an account or ask to reset your password.Until the link in our email completes that step from this browser. If it never does, 400 days from the moment it was set.Proves that the person opening the email link is the person who started the step from this browser.Security of an account step you explicitly asked for.

6. __stripe_midCookieStripe, our payment providerOnly when you accept the paid offer and the payment form opens.1 year.Fraud prevention on the payment you are making.You asked to pay, and protecting that payment against fraud is part of providing it.

7. __stripe_sidCookieStripeAt the same moment as item 6.30 minutes.Holds your checkout session together while you pay.Same as item 6.

About the conversation identifier (items 1 and 2). The date in item 2 is written once, when the conversation starts, and is never extended. Coming back does not restart the 30 days. Nothing runs on your device while you are away, so an identifier that has expired is removed the next time you open the site, not at the moment it expires. The identifier does not bring your conversation back on screen when you are not signed in. It keeps what you send in one conversation on our server, and it lets us attach that conversation to an account you create from the same browser within the 30 days. After the 30 days, your next message starts a new conversation with no link to the earlier one.

About the language cookie (item 3). It is set on your first visit with our default language, Ukrainian, so that every page you open is in the same language, and it is rewritten when you choose a language with the switcher. It holds nothing but a language code.

About the sign-in cookies (items 4 and 5). They are created on our own domain by the software of our sign-in provider, Supabase, on our behalf. Item 4 may be split into two or three parts, with names ending in .0, .1 and so on, when it is too long for a single cookie. Signing out removes item 4. Item 5 is removed when the link in our email completes the account or password step from this browser; if that never happens, it expires 400 days after it was set.

About the payment cookies (items 6 and 7). They are placed by Stripe, our payment provider, and only at the moment you accept the paid offer and the payment form opens. Opening the chat, asking questions, seeing the offer or declining it does not contact Stripe. The payment form is Stripe's own page shown inside ours. Inside that form, Stripe may also store items under its own domain (stripe.com), which Stripe lists in its own cookie policy at stripe.com/cookies-policy/legal. Your card details never reach us.

5The landing page

The landing page at rutaspain.com stores nothing on your device. Its language switcher is three links, not a remembered setting, and its fonts are part of the page. The items in section 4 are placed by the product at app.rutaspain.com.

6Who is contacted from your device, and when

Opening any page of our sites contacts our own servers and nobody else. Our sites are hosted by Vercel, whose servers deliver the pages to you. That is hosting, and the Privacy Policy explains it in its section on suppliers.

Beyond that, your browser contacts a third party only when you do one of these things:

When you…Your browser contactsWhy

Create an account, sign in, reset your password, or use the service while signed inSupabase, our sign-in and database providerTo check who you are and to keep you signed in

Accept the paid offerStripe, our payment providerTo show the payment form and take your payment

Links in the assistant's answers and on our pages to official websites take you there only when you click them. Those sites have their own policies.

7How to remove these items, and what happens if you do

You can delete cookies and site data for our sites at any time in your browser's settings (usually under Privacy, "Cookies and site data" or "Clear browsing data"), and you can set your browser to refuse them. The sites keep working. What changes:

Items 1 and 2 removed: your next message starts a new conversation, and what you said before can no longer be attached to an account you create later.
Item 3 removed: the site shows Ukrainian again until you choose a language.
Item 4 removed: you are signed out, and you sign in again.
Item 5 removed before you open the email link: the account-creation or password-reset link will not work from this browser. Start the step again.
Items 6 and 7 removed during a payment: the payment form may need to load again.

If your browser blocks storage entirely, the assistant still answers you, but your messages are kept together only while the tab stays open.

8What you said is kept on our server, not on your device

The items above are only pointers. The conversation itself is stored on our server, and the Privacy Policy is the document that governs it. Because this is the page a visitor reads to find out how long we keep what they said, here is the summary:

A conversation you have without an account is kept for 90 days from its first message. Then a job that runs every night deletes it, with every message in it. Until then it is held on our server, and our staff can read it in our database for the purposes the Privacy Policy describes.
Between day 30 and day 90 nobody can claim the conversation any more, because the identifier on your device has expired, but the conversation is still held by us until the 90 days end.
A conversation attached to an account is not affected by this. It follows the retention rules in the Privacy Policy.
We cannot act on a request about a conversation you had without an account. Nothing we hold ties such a conversation to a person: no account, no name, no email, only the random identifier your browser held. So we cannot verify that a conversation is yours, and we cannot act on a request we cannot verify. It is deleted after 90 days regardless. If you created an account from the same browser within the 30 days, the conversation is part of your account and all your rights apply to it.

9If this changes

Everything in this policy was checked against the running product on the date shown at the top. Two rules keep it true:

A published wording is never edited in place. Any change means a new version label, a new effective date, and all three languages republished together under one shared label, shown at the top of this page.
If we ever add anything that needs your consent, for example an advertising or analytics tag, we will ask for it before that item loads, with refusing as easy as accepting, and this policy will say so in a new version. Until then, there is nothing to consent to.

10Contact

Questions about this policy: privacy@rutaspain.com, or by post to the address in section 1.

You can complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es) if you believe we have handled your data wrongly.

11Language

This policy is published in Spanish, Ukrainian and English. The Spanish version is the authoritative one. If there is any difference between the versions, the interpretation most favourable to you as a consumer prevails.