Cookie Policy
Last Updated: September 29, 2026
1. Introduction
This Cookie Policy explains how RiFa Holding & Advertising GmbH ("we", "us", or "our") uses cookies and similar technologies such as local storage when you visit LobbyFlight ("Service"). It lists every item we use, who provides it, what it is for, how long it lasts and how you can change or withdraw your consent.
2. What Are Cookies?
Cookies are small text files that a website places on your computer or mobile device. They are used to make websites work, to remember choices and, with your consent, to measure how a website and its advertising perform.
Cookies can be "persistent" or "session" cookies. Persistent cookies remain on your device for a set period, while session cookies are deleted as soon as you close your web browser.
Local storage and session storage work in a similar way: they keep small pieces of information in your browser. This policy covers them too, and we ask for your consent for them on the same terms as for cookies.
3. Categories
We group cookies and similar technologies into the following categories. Only necessary items are used without your consent.
Necessary
Required for the website and portal to work: signing in, security, remembering your cookie choice and your language. They are not used for tracking and do not require consent.
Functional
Optional convenience features. The cookie banner lets you allow this category, but LobbyFlight currently sets no cookies or storage items in it.
Analytics
Help us understand how visitors use the website so we can improve it (Google Analytics, PostHog, Vercel Web Analytics). They are loaded only after you allow the "Analytics" category.
Marketing
Measure whether our advertising on Meta (Facebook, Instagram) and Google works, and which campaign brought you to us. They are loaded only after you allow the "Marketing" category.
4. Cookies and Storage We Use
The complete list. Where a name contains * or <ID>, the exact name depends on the page or on our account with the provider.
| Name | Provider | Purpose | Category | Duration |
|---|---|---|---|---|
| __Secure-next-auth.session-token | LobbyFlight | Keeps you signed in to the portal (cookie). | Necessary | 30 days |
| __Host-next-auth.csrf-token, __Secure-next-auth.callback-url | LobbyFlight | Protect the sign-in form against forged requests and return you to the right page after signing in (cookies). | Necessary | Session |
| cookieConsent, cookiePreferences | LobbyFlight | Store your cookie choice so that our server respects it (cookies). | Necessary | 1 year |
| cookieConsent, cookie-consent-preferences | LobbyFlight | The same choice in local storage, read before any analytics or marketing script is loaded. | Necessary | Until you change your choice or clear your browser data |
| NEXT_LOCALE | LobbyFlight | Remembers the language of the website (cookie). | Necessary | 1 year |
| i18nextLng, portal-locale | LobbyFlight | Remember the language of the website and the portal (local storage). | Necessary | Until you clear your browser data |
| portal-sidebar-collapsed, lf-onboarding-seen, lf-studio-visited, display-guide-dismissed:* | LobbyFlight | Signed-in portal users only: remember the sidebar layout and which introductions you have already seen (local storage). | Necessary | Until you clear your browser data |
| exit_intent_shown | LobbyFlight | Makes sure our welcome offer is shown at most once a week (cookie). | Necessary | 7 days |
| exit_intent_email, exit_intent_coupon | LobbyFlight | Only if you enter your email address in the welcome offer: pre-fill the registration form and the offer code (local storage). | Necessary | Until you register or clear your browser data |
| demo-settings | LobbyFlight | Remembers the settings you try out in the live demo (cookie). | Necessary | 7 days |
| lf-board:v1:*, display-session-id | LobbyFlight | Lobby screens only: keep the last settings and flight list so a screen survives a short network outage (local storage), and identify the screen's browser session for the hotel's screen statistics (session storage). | Necessary | Settings up to 24 hours, flights up to 30 minutes; session |
| guest-sw.js (service worker), push subscription | LobbyFlight, the push service of the guest's browser | Flight Concierge guest page only: delivers the flight notifications a guest turns on. | Necessary | Until the guest removes the page or turns notifications off; the subscription is deleted 30 days after the trip |
| _ga, _ga_<ID> | Google Ireland Ltd. (Google Analytics 4) | Distinguish visitors and sessions to produce usage statistics (cookies). | Analytics | 2 years |
| ph_<ID>_posthog | PostHog Inc. | Product analytics: which pages and features are used (cookie and local storage). | Analytics | 1 year |
| Vercel Web Analytics (no cookie) | Vercel Inc. | Cookieless page-view statistics: page, referrer, country and device type. | Analytics | Nothing is stored on your device |
| lf_attr | LobbyFlight | Remembers which ad or campaign brought you to us (utm parameters, fbclid, gclid) so a later sign-up can be attributed to it (cookie). | Marketing | 90 days |
| _fbp, _fbc | Meta Platforms Ireland Ltd. (Meta Pixel) | Recognise your browser and, if you came from a Meta ad, the ad click, to measure the results of our Meta ads (cookies). | Marketing | 90 days |
| _gcl_au, _gcl_aw | Google Ireland Ltd. (Google Ads) | Measure sign-ups and purchases that result from our Google ads (cookies; _gcl_aw only if you came from a Google ad). | Marketing | 90 days |
5. Server-Side Measurement (Meta Conversions API)
When you sign up for a trial, complete a purchase or step through the demo on one of our campaign pages, our server can report the same event directly to Meta (Conversions API), so that Meta counts it only once together with the Pixel. The report contains the event name, time and page, your email address and account ID as SHA-256 hashes, your IP address and browser user agent, and the _fbp and _fbc values if they exist.
We send these reports only if you have allowed the "Marketing" category. For a purchase that happens later we rely on the choice you made when you signed up; if you later turn marketing off in the cookie settings while signed in, that stored choice is withdrawn as well. Without marketing consent nothing is sent.
6. Third-Party Services and Content
The following services can set cookies of their own, on their own websites or only after an action of yours:
- Stripe: Payments run on Stripe's own checkout and billing pages (checkout.stripe.com, billing.stripe.com). Stripe sets its cookies there under its own privacy policy; LobbyFlight's website does not load Stripe scripts.
- Google Maps: The Flight Concierge guest page shows a Google map only when the guest taps to open it. Google can then set its own cookies.
- Vercel: Our hosting provider. Vercel sets no cookies on our website; Vercel Web Analytics is covered in section 4.
7. Your Choices and How to Withdraw Consent
You decide which optional categories we may use:
Cookie Banner
On your first visit the banner asks for your choice. "Only necessary" and "Accept all" are equally easy, and under "Settings" you can allow analytics and marketing separately. Until you allow a category, none of its scripts are loaded.
Change or Withdraw Your Consent
You can change your choice or withdraw your consent at any time, with effect for the future, using the button below. Choose "Only necessary" to withdraw everything. We then stop the affected trackers and delete their cookies from our website; the lawfulness of processing before the withdrawal is not affected.
Browser Settings
You can also block or delete cookies and site data in your browser. If you block necessary cookies, signing in to the portal will not work.
8. Browser-Specific Cookie Management
Here are links to the cookie management instructions for popular browsers:
9. Do Not Track Signals
Some browsers can send a "Do Not Track" signal. We do not respond to it automatically; instead, no analytics or marketing technology is used until you allow it in the cookie banner.
10. Updates to This Policy
We update this Cookie Policy when the cookies or technologies we use change. The date at the top of this page shows when it last changed.
11. Contact Us
If you have any questions about our Cookie Policy or how we use cookies, please contact us:
RiFa Holding & Advertising GmbH
E.v. Behringstraße 14
9500 Villach, Austria
Email: info@lobbyflight.com