Translation provided for information only; only the French version is legally binding. Read the French version

Cookie policy

This policy describes the cookies and trackers used by Hanaé (sole trader, SIREN 882 790 363) on the hanae.paris website and in the Hanaé app, in accordance with the recommendations of the CNIL (the French data protection authority) and the GDPR. It supplements our privacy policy.

What is a tracker?

A cookie is a small file placed on your device (computer, smartphone) when you visit a website. Other ways of saving information on your device (the browser's local storage or session storage, the app's storage) are subject to the same rules: this policy covers them all.

Strictly necessary trackers

These trackers are essential for the service you request and do not require your consent (article 82 of the French Data Protection Act).

Session and sign-in (Supabase Auth): when you sign in, your session is saved on your device (the browser's local storage on the website, the device's secure storage in the app). It is renewed automatically while you use the service and deleted when you sign out.
Cart: the contents of your cart are saved in your browser's local storage (this is not a cookie). They stay on your device until the order is paid or until you empty the cart.
Order in progress: the details entered on the order page are kept in your browser's local storage, so they are not lost when you go through the payment page, even if it opens in another tab. They are erased once the order is paid, are no longer reused after one hour, and are then deleted the next time you open the order page.
Referral code or promo code (cookie hanae_ref_code): set when you open a referral link or a link that includes a promo code, so the discount is applied to your order automatically. Duration: 90 days.
Cookie choices (cookie hanae_consent): remembers whether you accepted or declined audience measurement and, where applicable, advertising measurement. Duration: 6 months, after which we ask you again.
Language (cookie NEXT_LOCALE): remembers the language the site is displayed in. Duration: until the browser is closed.

Live visitors

To know how many people are browsing the site right now, each tab gets a random identifier, kept in session storage (hanae_live_v1) and erased when the tab is closed. It sends the page being viewed, where the visit came from and the approximate city derived from the IP address, without making it possible to identify you. This information is only used by the Hanaé team and is deleted after one hour. This audience measurement, limited to our own statistics, is exempt from consent under the conditions set by the CNIL.

Trackers that require your consent

These trackers are only set if you accept them, with one click on “Accept all” or purpose by purpose with “Customise”. As long as you have not made a choice, or if you decline, none of them is set or read, and the site remains fully functional.

PostHog (audience measurement, journeys on the site, events such as adding to the cart, recording of the checkout page with fields masked): cookie and local storage ph_… containing a random identifier. The data is hosted in the European Union. Duration: 13 months maximum.
Partner link (cookie hanae_link): when you open a hanae.paris/l/… link shared by a partner, it allows any order you place to be credited to that partner. Duration: 30 days.
Visit source (local storage hanae_attribution_v1): the source of your first visit (campaign, referring site, landing page), attached to your order so we know which channels bring people to us. Duration: 13 months maximum. Without your consent, only the source of the current visit can be attached to an order placed during that visit, without saving anything on your device. The identifier of a click on a Google ad (gclid, gbraid, wbraid) is only kept and attached to the order with your consent to advertising measurement.
Google Ads (advertising measurement, provided by Google Ireland Limited): when we run ads on Google, measures the orders placed after a click on one of them, so we know which ads are useful and can adjust their budget. The Google tag is only loaded after you accept “Advertising measurement”. It sets the cookies _gcl_au (conversion measurement) and, if you arrive through an ad, _gcl_aw or _gcl_gb (click identifier). Duration: 90 days. On payment, the order amount and reference are sent to Google, without your name or contact details. No ad personalisation or remarketing is enabled. Google may also read its own cookies on its domains, under its own responsibility; data may be transferred to the United States (Data Privacy Framework).

Third-party services

Stripe: payment takes place on Stripe's secure page, which sets its own security and anti-fraud cookies, under its own responsibility.
Google Maps / Places: map and address autocomplete on the order page only. Google's service may use the browser's storage while you enter the address.

Error tracking

Sentry collects anonymised technical information when an error occurs (URL, error message, browser). No advertising cookie is set.

Mobile app

The app saves the same necessary information on your phone (session, cart, referral code, chosen language). Audience measurement (PostHog) and keeping the partner link only start after your consent, requested at first launch. You can change your mind at any time in Account, under the “Audience measurement” setting. We ask for your choice again after 6 months. The app contains no advertising tracker.

Managing your consent

On your first visit, a banner offers to “Accept all” or “Decline all” and, when advertising measurement is active, to “Customise” your choice for audience measurement and advertising measurement separately. Closing the banner without choosing counts as declining: nothing is set, and you will be asked again on a later visit. If you accepted audience measurement before advertising measurement was introduced, we ask you again: your earlier consent does not cover it. You can change your mind at any time using the “Manage cookies” link at the bottom of every page. If you withdraw your consent, measurement stops immediately and the PostHog trackers, the partner link, the saved visit source and the Google Ads cookies (_gcl_…) are erased from your browser.

Most browsers also let you block or delete cookies. Blocking strictly necessary trackers may prevent access to some features (sign-in, cart).

No targeted advertising

Hanaé does not do remarketing or ad personalisation and does not sell any data to advertising networks. The only advertising measurement is the tracking of orders that come from our Google ads, described above, and only with your consent.

Your rights

Under the GDPR, you have the right to access, rectify, erase and object to the data collected through cookies. To exercise these rights: bonjour@hanae.paris. You may also lodge a complaint with the CNIL · cnil.fr.

Last updated: October 2026.