This policy explains what Layro stores in your browser, for what purpose, and how you can change or withdraw your choice at any time.
The terms we use. A “cookie” is a small text file a website stores on your device. “Local Storage” is an area of your browser in which a web application can keep information between visits. Both fall within storing information in terminal equipment, the notion used by Art. 4(5) of Romanian Law no. 506/2004. “Strictly necessary” means indispensable to providing the service you asked for — the only case in which the law does not require consent.
1. Who operates this site
This policy applies to the layro.ro website and the app.layro.ro application, operated by:
Layro S.R.L.
Registered office: Str. Pitar Moș nr. 27, et. 5, ap. 17, Sector 1, București, România
VAT number: RO44254027
Trade register: J2021008343401
Email: contact@layro.ro
2. Cookies and similar technologies
Cookies are small text files that a website stores on your device. Alongside them are other forms of local storage, the most widely used being Local Storage — an area of your browser in which a web application can keep information between visits.
Legally the distinction does not matter: Art. 4(5) of Romanian Law no. 506/2004 governs storing information, or gaining access to information stored, in a user’s terminal equipment, whatever the technical means. We therefore set out below everything we store in your browser, not only cookies as such.
Layro currently uses no cookies at all. Everything listed below is held in Local Storage.
3. What we store on the public website (layro.ro)
3.1 Strictly necessary
Without this, the site cannot honour the choice you made. It requires no consent, because its whole purpose is to record your consent decision.
| Name | Type | Purpose | Duration |
|---|---|---|---|
layro_cookie_consent | Local Storage | Records whether you accepted or declined analytics, so the banner is not shown on every visit. | Until you delete it or change your choice. |
3.2 Analytics (PostHog)
We use PostHog to understand how the site is used: how many visits it gets, which pages are read and which buttons are pressed. Measurement runs in two modes, and what separates them is not whether we measure but whether anything is stored in your browser.
Without consent — the default mode. If you have not chosen yet, or if you declined, PostHog runs in cookieless mode: it writes nothing to your browser and reads nothing from it. Events leave without an identifier stored on your device, and PostHog derives a temporary identifier on its own server from the request metadata — your IP address and browser type — together with a secret value that changes daily. This lets us count visits and see which pages were read within a single visit, but we cannot recognise you from one day to the next and we cannot follow you onto other sites. Because nothing is stored in your terminal equipment, art. 4(5) of Romanian Law 506/2004 does not apply and we do not ask for your consent; the processing rests on legitimate interest (section 6).
| Name | Type | Purpose | Duration |
|---|---|---|---|
| Nothing | — | In this mode we store and read no information in your browser. | — |
With consent. If you press “Accept”, we additionally store a random identifier in Local Storage. It shows us how many visitors return and lets us link separate visits by the same person. At that point we also switch on automatic capture of clicks on page elements, which stays off without consent.
| Name | Type | Purpose | Duration |
|---|---|---|---|
ph_<project-key>_posthog | Local Storage | A random visitor identifier and the current browsing session data, used to tell returning visitors apart. It contains neither your name nor your email address. | Until consent is withdrawn or you clear your browser data. |
__ph_opt_in_out_<project-key> | Local Storage | Records, for PostHog, the fact that you accepted. | Until consent is withdrawn or you clear your browser data. |
When you withdraw consent we delete the stored identifier immediately and return to cookieless mode.
In neither mode do we collect your name, your email address or the contents of forms, we do not record your session or screen, and we measure nothing at all if your browser sends a Do Not Track signal.
More about PostHog’s processing: posthog.com/privacy
4. What we store in the application (app.layro.ro)
In the application we use no analytics tools whatsoever and we do not track user behaviour. We store only what is strictly necessary for the application to work — to keep you signed in and to remember your language. This requires no consent, as it is indispensable to the service you asked for.
| Name | Type | Purpose | Duration |
|---|---|---|---|
app-authenticationToken, app-refreshToken, app-tokenExpiry | Local Storage | These keep you signed in between requests and let your session renew without you re-entering your password. | Access token: 1 hour. Refresh token: 30 days, if you choose to stay signed in. |
clientInviteToken | Local Storage | For clients invited to a project: the token from the invitation link, which grants access without an account or password. | For as long as the invitation is valid. |
layro-locale | Local Storage | The language you chose for the application. | Until you change it or clear your browser data. |
You can clear this at any time, but doing so will sign you out of the application.
5. What we do not use
Layro does not use:
- advertising, remarketing or retargeting cookies;
- social media plugins that set tracking identifiers (Facebook Pixel, Google Ads and the like);
- session or screen recording in the application;
- any analytics tooling in the app.layro.ro application.
6. Legal basis
- Strictly necessary storage — Art. 4(5) of Law no. 506/2004 permits storage without consent where it is strictly necessary to provide the service the user requested. The corresponding data processing rests on performance of the contract or, as the case may be, on legitimate interests — Art. 6(1)(b) and (f) GDPR;
- Cookieless measurement — because we neither store nor read anything in your terminal equipment, Art. 4(5) of Law no. 506/2004 does not apply and we do not ask for your consent. Processing the technical data is still processing of personal data, and it rests on legitimate interests — Art. 6(1)(f) GDPR. The interest pursued is knowing whether the site is read and which sections are useful, so that we can improve it. We weighed that interest against your rights and limited the processing accordingly: nothing is stored on your device, we build no profiles, we do not follow you onto other sites, the server-side identifier changes daily, and the data is neither used for advertising nor sold. You may object to this processing at any time under Art. 21 GDPR — see section 7;
- The identifier stored in Local Storage — your prior consent, given by pressing “Accept” in the banner, under Art. 4(5) of Law no. 506/2004 and Art. 6(1)(a) GDPR. Consent can be withdrawn at any time, as easily as it was given (section 7).
7. Changing or withdrawing your choice
You can change your choice at any time, with no consequence for your use of the site:
- click — the link also sits in the footer of every page. The banner reopens and you can choose again;
- or clear the data stored by the site directly from your browser settings, in the section covering cookies and site data.
If you would rather not be measured at all, including in cookieless mode, you have two routes: switch on the Do Not Track signal in your browser settings — we honour it automatically and send no events — or write to us at contact@layro.ro, exercising the right to object under Art. 21 GDPR.
Instructions for the main browsers:
- Google Chrome — Settings → Privacy and security → Cookies and other site data Chrome guide
- Mozilla Firefox — Settings → Privacy & Security → Cookies and Site Data Firefox guide
- Safari — Preferences → Privacy → Manage Website Data Safari guide
- Microsoft Edge — Settings → Cookies and site permissions Edge guide
8. Where the data is stored
Data collected through PostHog is stored on PostHog’s infrastructure in the European Union (Frankfurt, Germany). Application data is hosted by Amazon Web Services, also in Frankfurt. Full details of recipients, and of the situations in which data may travel outside the European Economic Area, are in our Privacy Policy.
9. Changes to this policy
We update this policy whenever we add or remove a tool that stores information in your browser. The date of the last update is shown at the top of the page. If we introduce new tools requiring consent, we will ask for your agreement again before activating them.
10. Related documents and contact
For any question about this policy, write to us at contact@layro.ro.