Legal
Cookie policy
Last updated: 8 Oct 2026 · Version 0.1 (draft)
Courtesy translation
This English version is provided for your convenience. The Spanish text is the legally binding one and prevails in case of any difference. Read the Spanish original
Draft awaiting legal review
This text is a working draft. A law firm is reviewing it and it may change before launch.
At Vínculo we only use cookies that are strictly necessary for the service to work and be secure. We do not use analytics, advertising or social media cookies. That is why we do not show you a banner asking for consent.
1. What cookies are
Cookies are small files that a website stores in your browser to remember information from one page to the next, for example that you are signed in. Similar technologies, such as the browser’s local storage, are subject to the same rules (article 22.2 of Spanish Law 34/2002 on information society services, LSSI).
2. Cookies we use
| Name | Provider | Purpose | Duration | Type |
|---|---|---|---|---|
| Authentication session cookies (sb-…-auth-token) | Vínculo, through Supabase | Keep you securely signed in. They may be split into several parts and add a temporary verifier while you sign in | Up to 400 days; renewed as you use the service and deleted when you sign out [pending: consider a shorter duration] | First-party, technical, necessary |
| vinculo_link | Vínculo | Remember that you arrived through a psychologist’s personal link, so the booking is attributed to them. It does not change the price you pay | 30 days | First-party, technical, necessary [pending: confirm with a lawyer] |
| vinculo_locale | Vínculo | Remember the language you want to see Vínculo in (Spanish or English), when you choose it or visit the English pages | 1 year | First-party, a preference you choose, necessary |
| vinculo_cal_oauth | Vínculo | Professionals only: protect the connection of their Google or Outlook calendar against forged requests | 10 minutes | First-party, security, necessary |
| __stripe_mid | Stripe | Prevent fraud at the payment step. Only set on the payment page | 1 year | Third-party, security, necessary |
| __stripe_sid | Stripe | Prevent fraud during the payment session. Only set on the payment page | 30 minutes | Third-party, security, necessary |
| __cf_bm | Cloudflare | Tell people apart from bots and protect the website against attacks | 30 minutes | Third-party, security, necessary [pending: confirm whether it is enabled] |
The exact names may change with technical updates. [pending: check the final inventory with a technical audit before launch.]
2.1 Local storage
We use your browser’s local storage to remember interface preferences, such as panels you have opened or closed. We do not store health data or anything that identifies you there, and the information never leaves your device. [pending: inventory of local storage keys.]
2.2 Mobile app
The Vínculo app does not use cookies. It keeps your session in the secure storage of your device’s operating system. [pending: confirm implementation.]
3. Why we do not ask for consent
Article 22.2 of the LSSI exempts from consent the cookies needed to transmit a communication or to provide a service you have expressly asked for. The Spanish Data Protection Agency (AEPD) includes among them sign-in cookies, security cookies and those that remember a preference you choose, such as language (Guide on the use of cookies, updated in 2023). All the cookies in the table above fall into that category. Even so, we tell you about them in this much detail.
[pending: confirm with a lawyer — that vinculo_link is exempt. It is used to attribute the booking to the professional, not to provide a service the patient asked for. Alternative if it is not: pass the attribution as a parameter of the booking itself, without a cookie.]
4. What we do not do
- We do not use cookies or tools for analytics, advertising or social media.
- We do not install advertising pixels or third-party trackers, least of all on the search, booking, payment, chat, video session or clinical record pages.
- We do not use device identification techniques (fingerprinting) to follow you across websites.
- We do not share cookie information with third parties, except Stripe and Cloudflare, which process it for payment and website security.
5. If we add other cookies
If in future we add cookies that are not necessary, for example for analytics, before using them:
- We will show you a notice, with the information in layers, as the AEPD guide requires.
- You will be able to reject them as easily as you accept them, with buttons of the same level and visibility.
- You will be able to choose by purpose, with no boxes ticked in advance.
- We will keep a record of your decision and ask you again at most every 24 months.
- We will never use them on the booking or therapy pages.
We will also update this policy and our impact assessment.
6. How to manage them
You can view and delete cookies in your browser settings:
If you block or delete the necessary cookies, some features will stop working. For example, you will be signed out or will not be able to complete a payment.
7. Changes and contact
If we change the cookies we use, we will update this page and its date. If you have any questions, write to privacidad@vinculo.app. You can read more about how we handle your data in the Privacy policy.