Reservly Cookie Policy

Last updated: July 13, 2026

The short version

• Essential cookies, always on. Session, authentication, and security cookies that are strictly necessary for the service, plus the record of your own cookie choice (we cannot remember "no" without storing "no").
• Preferences you choose yourself are remembered. If you pick a language or a currency on a booking page, we store that choice because you asked us to. We never write one you didn't pick.
• Optional cookies need your "yes" first. Referral attribution (reservly_ref) and our exchange-rate cache are stored only after you accept. If you have not answered the banner, we treat that as a no — not as a yes. This applies everywhere, including the US, where the law would let us default them on.
• Rejecting deletes, not just stops. Choosing Reject — at the banner or later via Cookie preferences in the footer — deletes the optional cookies already set. It does not merely stop future ones.
• Analytics and advertising cookies may be activated as Reservly grows (Google Analytics 4 for aggregate traffic; Meta Pixel and Google Ads conversion pixels when we run paid campaigns). Not active today — we run none of them. When activated, all consent-gated, all disclosed below at least 30 days in advance.
• Advertising cookies would live on our marketing site only. They are never set on Reservly-hosted booking pages. End-user booking data never flows to any advertising platform.
• We don’t sell your data. We may "share" marketing-site visitor data with advertising platforms (CCPA/CPRA's term for the measurement and retargeting that paid campaigns rely on) — strictly consent-gated, strictly opt-outable.
• We honour Global Privacy Control (GPC). If your browser sends a GPC signal, we treat it as a rejection — you don't need to click the banner, and any optional cookies already set are deleted.
• Accept and Reject are equal choices. Both appear together, at the same level, at the same size, one click each. Reject is never hidden behind an extra step. No dark patterns.

Questions: support@reservly.io.

1. What cookies are

A cookie is a small text file that a website places in your browser. Cookies let a website remember things between visits — that you're logged in, what language you speak, whether you've already seen a banner. Similar technologies include localStorage, sessionStorage, IndexedDB, and tracking pixels. This policy covers all of them; we use "cookies" throughout as shorthand.

2. Who sets cookies on Reservly

• Reservly (first-party) sets cookies on reservly.io, app.reservly.io, and Reservly-hosted booking pages.
• Third parties that a business or end user interacts with (Stripe, Paddle, Upstash, Twilio) may set their own cookies or process data when their services are engaged. Those cookies are governed by their own privacy policies, not ours.

3. Cookie categories

Jurisdiction note. Storing anything on your device that is not strictly necessary requires your prior consent under the EU ePrivacy Directive Art. 5(3) and its national implementations — UK PECR reg. 6, Germany's TTDSG § 25. That rule applies to the act of storing, whether or not the stored value is personal data.

We apply the opt-in discipline everywhere, not only in the EU / UK / EEA / Switzerland / Canada. US state privacy laws would permit us to default optional cookies on and let you opt out afterwards; we don't. What still varies by region is only how the choice is presented — a blocking modal where prior consent is legally required, an unobtrusive bar elsewhere — never what is stored before you answer.

Germany's TTDSG § 25 permits no legitimate-interest exception for storing information on a terminal device; our optional cookies are opt-in for German visitors as for everyone. The language and currency preferences are exempt on a different basis — you actively chose them (see the table above), not on legitimate interest.

3a. Email tracking

Reservly's transactional emails (booking confirmations, reminders, account notifications) may include a tracking pixel — a 1×1 transparent image that lets us detect whether an email was opened. This is used solely to assess notification delivery and is not used for advertising profiling.

• What we collect: open event (timestamp, approximate location inferred from IP, email client type).
• Basis: Legitimate interest (GDPR Art. 6(1)(f)) for operational notification health; emails to Canadian addresses comply with the express or implied consent basis under which the message was sent (CASL).
• Opt-out: Disable "Load remote images" in your email client, or request that we disable open tracking for your account by emailing support@reservly.io with subject Email tracking opt-out.
• Links in emails may contain unique identifiers that tell us which link you clicked and which notification type triggered the visit. This data is used only to improve notification UX, not for advertising.

4. Our specific cookies

The table below lists every Reservly-set cookie and storage item we use. We keep this list current.

Strictly necessary — no consent required

Preferences you set yourself — no consent required

These are stored only when you actively pick them. Nothing here is ever written from a guess about you — we do not, for example, detect your browser's language and quietly save it. That is what makes them exempt from consent, and it is a promise about our code, not just about our intentions.

Optional — stored only if you accept

If you have not answered the banner, none of these exist. If you reject — at the banner, later via Cookie preferences in the footer, or by sending a Global Privacy Control signal — any that were already set are deleted, not merely frozen.

What rejecting actually costs you: nothing you can see. Prices, currency conversion, language, and the entire booking flow work identically either way. The only real consequence is for the Business: if you reject, and you leave and return later without the original referral link, they will not be able to tell that they had referred you.

Signed-in Business owners (dashboard)

These are stored only for Business owners using the Reservly dashboard, never for booking-page visitors. They hold interface state, contain no tracking, and are covered by the "strictly necessary / preferences you set yourself" exemptions above.

Third-party cookies / sessions

Third-party cookies may appear depending on which services a Business or visitor activates:

Reservly does not control those third-party cookies. If you don't want them, don't activate the corresponding integration.

When Reservly activates analytics or advertising cookies

Reservly is not currently running paid advertising campaigns and has no analytics or advertising cookies active as of the Last updated date above. We anticipate activating them as Reservly grows. When that happens:

• We update this policy at least 30 days in advance. Active subscribers receive email notice; prospective visitors see the update in § 4.
• We activate cookies consent-gated. Opt-in for EU / UK / EEA / CH / CA residents; opt-out for the US and other regions, per regional law.
• We honour the Global Privacy Control signal as an opt-out — no banner click needed.
• We disclose the specific pixels — name, purpose, duration, first-party or third-party — in § 4 above before they go live.
• We update the Sub-Processor List to include each advertising platform with 30 days' notice.

The analytics and advertising providers we anticipate activating include Google Analytics 4 (first-party cookies for aggregate marketing-site traffic), Google Ads conversion tracking (when running paid search campaigns), and Meta Pixel (measurement and retargeting when running Facebook / Instagram paid social). Other platforms — TikTok, LinkedIn, and similar — may be added as our marketing mix evolves; each follows the notice process above.

What we will not do, ever:

• Sell your personal information for money. "Sell" is a CCPA/CPRA-specific term and this commitment is final.
• Set ad pixels on Reservly-hosted booking pages. Ad pixels are limited to the marketing site (reservly.io and marketing subpages). End-user booking data on reservly.io/<business-slug> pages is never shared with advertising platforms.
• Use your Reservly subscriber account data (business owner email, subscription details) for cross-context behavioural advertising beyond what the consent banner covers for marketing-site visitors.
• Silently introduce new tracking without the notice and disclosure commitments above.

5. Consent banner — geo-adaptive

On your first visit to Reservly, you'll see a cookie banner. What varies by region is how the choice is presented — never what we store before you make it.

• European Union, United Kingdom, European Economic Area, Switzerland, and Canada: an opt-in modal, because prior consent is legally required there.
• United States, and most other regions: an unobtrusive bar at the bottom of the screen, so it doesn't block the page.

In both cases the storage rule is identical and the stricter one: no optional cookie is stored until you accept. If you never answer, we treat that as a no. US state privacy laws would let us switch optional cookies on by default and make you opt out afterwards — we have chosen not to, because a default nobody chose isn't a choice.

The choice is binary, and we describe it as binary. Accept stores the optional cookies listed in § 4; Reject stores none of them and deletes any already set. We do not offer per-category toggles, and this policy will not pretend otherwise — we would rather present two honest options than a granular interface that doesn't exist. If we ever add categories worth separating (analytics, advertising), we will build the per-category control and say so here before switching anything on.

Accept and Reject sit side by side, at the same level, the same size, one click each. Reject is never buried behind "Manage options" or an extra screen. This follows ICO guidance that rejecting must be as easy as accepting.

CASL (Canada). For Canadian visitors, the consent modal also serves as notice under Canada's Anti-Spam Legislation (CASL) § 8 for any marketing-related tracking triggered by cookie preferences. Purely transactional notifications (booking confirmations, reminders) are sent under CASL § 6(5) implied consent and are not gated on cookie consent.

PECR (United Kingdom). Reservly's cookie consent practices for UK visitors comply with the Privacy and Electronic Communications Regulations 2003 (PECR), which implements the EU ePrivacy Directive in UK law. Storing any non-essential cookie requires prior informed consent under PECR reg. 6, regardless of the UK GDPR lawful basis used for the underlying data processing. The ICO recommends that Accept and Reject options are presented with equal visual prominence; our banner complies with this guidance.

TTDSG (Germany). German visitors should note that Reservly's optional cookies are always opt-in — the Telekommunikation-Telemedien-Datenschutz-Gesetz (TTDSG § 25) does not permit a legitimate-interest exception for storing information on a terminal device, and we do not rely on one. The language and currency preferences in § 4 rest on a different footing: they are stored only because you actively selected them, which is the "service explicitly requested by the user" exemption, not a legitimate-interest argument.

Your preference is stored in the reservly_cookie_consent cookie and is consulted before every optional cookie we write.

5.1 Change your cookie preferences

A Cookie preferences link in the footer of every page reopens the banner, so you can change your answer at any time — withdrawing consent is exactly as easy as giving it (GDPR Art. 7(3)).

Withdrawal is retroactive, and it is complete. Switching to Reject does not merely stop future cookies: it deletes the optional cookies already on your device (§ 4) — all of them, including the referral cookies for every Business whose page you have visited, no matter which page you are on when you withdraw. We consider "we've stopped adding more" an inadequate answer to "I withdraw my consent."

You can also clear everything immediately in your browser at any time (§ 8).

6. Global Privacy Control (GPC)

If your browser sends the Global Privacy Control (GPC) signal on a request, Reservly honours the signal as an opt-out of any non-essential cookies and of any "sale" or "sharing" that might otherwise apply under California or other state privacy laws. You do not need to click the banner — the signal suffices.

7. Do Not Sell or Share

Reservly does not sell personal information. Under CCPA/CPRA, "sell" means exchange of personal information for money or equivalent consideration. That's not our business model and never will be.

Reservly may "share" personal information with advertising platforms (Meta, Google, and similar) when we run paid campaigns. Under CCPA/CPRA, "share" is a distinct term that covers cross-context behavioural advertising — the measurement pixels and retargeting that paid acquisition relies on. When active, sharing is limited to marketing-site visitor data (never end-user booking data) and is consent-gated per region.

You can opt out of sharing at any time:

• Click Reject in the cookie banner (labelled "Reject non-essential" in the EU/UK/CA modal, "Reject" elsewhere), or Cookie preferences in the footer to change an earlier answer.
• Use the Do Not Sell or Share My Personal Information page.
• Enable Global Privacy Control in your browser — we honour it automatically.

8. How to manage cookies in your browser

Most browsers let you delete cookies, block specific cookies, or block all cookies. Instructions for the major browsers:

• Google Chrome
• Mozilla Firefox
• Apple Safari
• Microsoft Edge

Blocking essential cookies will prevent Reservly from working (you won't be able to stay logged in). Blocking the preference cookies will disable things like "remember my language choice" but won't prevent you from using the booking flow. Blocking the optional cookies changes nothing you can see — which is why rejecting them is a safe thing to do.

9. Mobile devices and local storage

Reservly uses localStorage, Cache Storage, and IndexedDB in your browser as well as cookies — for a language or currency you picked, for caching the site's own files so pages load fast, and for the exchange-rate cache listed in § 4. These are treated as equivalent to cookies under this policy and are governed by the same rules: the optional ones (reservly_rates_*) are stored only if you accept, and deleted if you reject.

We do not currently use sessionStorage on booking pages.

We do not currently have native mobile apps, so there is no mobile-device identifier equivalent (no IDFA / GAID). If we add native apps in the future we will update this policy.

9.1 Your rights regarding cookie data

Cookie data and localStorage entries that are linked to an identifiable person are personal information and subject to your rights under applicable law (see our Privacy Policy):

• Access: You may request a list of the cookies and storage items we hold associated with your account.
• Deletion / erasure: You may delete cookies directly in your browser at any time. For server-side cookie preference records, submit a deletion request via support@reservly.io (subject: Cookie data deletion).
• Withdrawal of consent: You can withdraw cookie consent at any time via the Cookie preferences link in the footer of any page, which reopens the banner. Optional cookies already set are deleted on withdrawal (§ 5.1). Withdrawal does not affect the lawfulness of processing based on consent before withdrawal.
• Portability: Cookie preference records are minimal (category flags and timestamp). On request, we can provide these in a structured, machine-readable format.

For UK residents, cookie-related complaints may be directed to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint or by post to Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. You have the right to complain to the ICO about Reservly's cookie practices under both PECR and UK GDPR.

10. Children

Reservly is not directed at children under 18 (see our Terms of Service § 4.1), and we do not knowingly collect data from children or set cookies for that purpose.

11. Changes to this policy

We will update this policy when we add, change, or remove cookies. The Last updated date at the top reflects the latest revision. Material changes — for example, if we were to introduce analytics or a new third-party cookie — will be announced with a banner on your next visit and an email to active subscribers.

12. Contact

Questions about a specific cookie, a consent choice, or this policy:

Email: support@reservly.io Subject line for cookie-specific questions: Cookies

This Cookie Policy works together with our Privacy Policy and Terms of Service. Where the Privacy Policy describes in more detail how we process personal information, those descriptions apply here too.