INOVA Francesinha — Mobile Application
Cookie Policy
Ler este documento em português
This Policy explains the storage technologies and third-party software components (SDKs) used by the “Inova” mobile application (INOVA Francesinha). Unlike a website, a mobile application does not use browser “cookies”; it relies on operating-system mechanisms and integrated SDKs. This document describes those mechanisms and works together with the application’s Privacy Policy.
Controller: Inevitável e Primordial, Lda. · Version 1.0 · 14 July 2026
1. No browser cookies
The application is a native application (React Native/Expo) and not a website embedded in a browser. No browser cookies or equivalent advertising-tracking technologies are used. The device advertising identifier (IDFA/AAID) is not collected and there is no cross-app tracking.
2. On-device storage technologies
On the device, the application uses the following technologies, strictly necessary for its operation:
- Secure operating-system vault (Keychain on iOS, Keystore on Android): stores session credentials (tokens) so that the user remains securely authenticated. They are not stored in plain text.
- Local application storage: stores user preferences and settings and the consent status, necessary to provide the service and to demonstrate compliance.
These technologies are strictly necessary and do not require consent, under Article 5 of Portuguese Law no. 41/2004 of 18 August.
3. Integrated third-party SDKs
The application integrates the following third-party SDKs and services:
- Stripe — Payment processing (card and MB WAY). Payment data entered directly into Stripe; INOVA retains only the transaction identifier. Status: active — necessary to perform the contract.
- Sentry — Error and stability reports. Technical error data only (device model, version, stack trace); configured not to send personal data. Status: active — legitimate interest in stability and security.
- Analytics (e.g. Firebase/Google Analytics) — Application usage analysis. Status: not installed; any future use is subject to prior consent.
- Meta / Google Ads — Building advertising audiences. Hashed e-mail/mobile number. Status: planned; subject to specific consent.
4. Necessary SDKs and consent-based SDKs
The Stripe and Sentry SDKs are necessary, respectively, to perform the payment contract and to ensure the security and stability of the application, and do not require consent. Any usage-analytics or advertising SDK will be activated only with the user’s prior, free, specific and informed consent, obtained through a dedicated in-app mechanism and revocable at any time.
5. Managing preferences and consent
Users can manage their preferences, including marketing consent, in the account Preferences within the application. Withdrawal of consent does not affect the lawfulness of processing carried out beforehand, nor the operation of strictly necessary components. Every change is recorded with the document version and the relevant date and time.
6. International transfers
Some of the above providers (in particular Stripe, Sentry and, when activated, Meta/Google) process data in the United States. Transfers rely on the Standard Contractual Clauses approved by the European Commission and, where applicable, on the EU-US Data Privacy Framework, as detailed in the application’s Privacy Policy, to which reference is made.
7. Updates
This Policy may be updated to reflect changes in the technologies used. The version in force is the one made available on the “Legal” screen of the application, identified by the date shown at the start of the document.