Cookie Policy
Version cookies-2026-09-15 · Last updated 15 September 2026
Ook beschikbaar in het Nederlands · Également disponible en français
1. Who we are
This website is operated by Andrey Sobolevsky, a sole trader (eenmanszaak / entreprise en personne physique) trading as Waivoo, Chaussée de Tervuren 145, 1410 Waterloo, Belgium. Enterprise number (KBO/BCE) 0772.527.301, VAT BE 0772.527.301. We are the data controller for the processing described here. Contact: support@waivoo.com. No Data Protection Officer is appointed, as none is required for processing of this nature and scale.
2. What this policy covers
Belgian law (article 10/2 of the Law of 30 July 2018, implementing article 5(3) of the ePrivacy Directive) requires your consent before anything is stored on, or read from, your device — unless it is strictly necessary to deliver a service you expressly asked for. The rule is technology-neutral, so this policy covers cookies and localStorage, sessionStorage, IndexedDB, tracking pixels, device fingerprinting and tracking links, not just cookies.
3. Strictly necessary — no consent needed, and why
An item is exempt only if it carries a communication, or if the service you requested genuinely cannot work without it. Convenience, analytics and commercial usefulness do not qualify. These are the items we rely on that exemption for, listed in full so you can check that claim:
| Name | Type | Domain / path | Recipient | Purpose | Legal basis | Duration | Transfer outside the EEA |
|---|---|---|---|---|---|---|---|
| access_token | cookie | api.waivoo.com / | Andrey Sobolevsky (sole trader, trading as Waivoo), BE 0772.527.301 | Keeps you signed in between requests. Set by our authentication service and not readable by page scripts (httpOnly). | Strictly necessary — session for a login you expressly requested | 30 minutes | None |
| refresh_token | cookie | api.waivoo.com / | Andrey Sobolevsky (sole trader, trading as Waivoo), BE 0772.527.301 | Lets your browser obtain a new session token without asking you to sign in again. Single-use and replaced each time it is used. This is the longest-lived identifier we store on your device. | Strictly necessary — maintaining a login you expressly requested | 30 days | None |
| access_token | cookie | waivoo.com / | Andrey Sobolevsky (sole trader, trading as Waivoo), BE 0772.527.301 | A copy of your session token that our page server reads to decide whether you may open a protected page. Written by page scripts, and removed automatically once the token expires. | Strictly necessary — access control for a service you requested | Up to 24 hours, and never longer than the token itself is valid | None |
| token_type | cookie | waivoo.com / | Andrey Sobolevsky (sole trader, trading as Waivoo), BE 0772.527.301 | Records the authentication scheme used with the session token above. | Strictly necessary — session for a login you expressly requested | Up to 24 hours | None |
| isAuthenticated | cookie | waivoo.com / | Andrey Sobolevsky (sole trader, trading as Waivoo), BE 0772.527.301 | Flags that a session exists, so the interface can render the signed-in state. | Strictly necessary — session for a login you expressly requested | Up to 24 hours | None |
| workforce_access_token | cookie | waivoo.com / | Andrey Sobolevsky (sole trader, trading as Waivoo), BE 0772.527.301 | Staff console session. Only ever set for Waivoo staff accounts. | Strictly necessary — session for a login expressly requested | 12 hours | None |
| waivoo_consent | cookie | waivoo.com / | Andrey Sobolevsky (sole trader, trading as Waivoo), BE 0772.527.301 | Remembers your cookie choices, so we neither ignore them nor ask you again on every page. | Strictly necessary — the GBA expressly exempts the cookie that stores your preference | 180 days (identical whether you accept or refuse) | None |
| access_token, token_type, isAuthenticated | localStorage | waivoo.com / | Andrey Sobolevsky (sole trader, trading as Waivoo), BE 0772.527.301 | Holds your session token for the in-page API client, so the app can call our services as you. | Strictly necessary — session for a login you expressly requested | Until you sign out or clear site data | None |
| search_prompt_<id>, initial_prompt_<id> | sessionStorage | waivoo.com / | Andrey Sobolevsky (sole trader, trading as Waivoo), BE 0772.527.301 | Carries the trip request you just typed across a single page redirect. Deleted the moment it is read, and in any case when the tab closes. | Strictly necessary — completing an action you initiated | Deleted on first read; at most the browser tab session | None |
| new_session_<id> | sessionStorage | waivoo.com / | Andrey Sobolevsky (sole trader, trading as Waivoo), BE 0772.527.301 | Marks a trip you have just started in this tab, so the page opens it as a new trip rather than as a trip you have no access to. Holds no content. | Strictly necessary — completing an action you initiated | Deleted once the trip is saved; at most the browser tab session | None |
| waivoo_pending_trip | cookie | waivoo.com / | Andrey Sobolevsky (sole trader, trading as Waivoo), BE 0772.527.301 | Holds the trip request you typed while signed out, so signing in can pick up exactly where you left off instead of losing your request to the login screen. A cookie rather than tab storage because e-mail verification usually returns in a new tab. | Strictly necessary — completing an action you initiated | 30 minutes, and deleted the moment it is used | None |
| waivoo_pending_share | cookie | waivoo.com / | Andrey Sobolevsky (sole trader, trading as Waivoo), BE 0772.527.301 | Holds the shared-trip invitation link you opened while signed out, so that after you sign in or create an account you land back on the invitation instead of losing it to the login screen. It contains only the invitation code — never who invited you or anything about the trip. A cookie rather than tab storage because e-mail verification usually returns in a new tab. | Strictly necessary — completing an action you initiated | 1 day, and deleted the moment it is used | None |
| accounts.google.com/gsi/client | script | accounts.google.com /gsi/client | Google Ireland Ltd (EEA) / Google LLC (US) | Google Identity Services, used only for the "Continue with Google" sign-in option. Loaded ONLY once you open the sign-in dialog — never on ordinary browsing. | Strictly necessary — only loaded to perform a sign-in you expressly requested | Per page load; any cookies set are Google's own and governed by Google's policy | United States — EU-US Data Privacy Framework and Standard Contractual Clauses |
| __stripe_mid, __stripe_sid and related | cookie | checkout.stripe.com / billing.stripe.com / | Stripe Payments Europe Ltd (IE) / Stripe, Inc. (US) | Payment processing and fraud prevention, set by Stripe on Stripe's own pages after you choose to subscribe. Stripe's scripts are NOT loaded on waivoo.com — you are redirected to Stripe. | Strictly necessary — processing a payment you requested (set by Stripe as controller) | Set by Stripe (typically 30 minutes to 1 year) | United States — Standard Contractual Clauses |
4. Purposes you can choose
Each of these is optional, separate, and switched off unless you turn it on. Refusing gives you full access to the site — we do not operate a cookie wall and we do not charge for refusing.
Remembering your trips on this device
Keeps a copy of trips you have opened, and of any guided tour you previously downloaded for offline use, in this browser's storage.
If you refuse: trips still work, but load from our servers each time, and any guided tour you previously downloaded is deleted from this device.
Maps and content loaded from other companies
Loads the interactive Google map and place suggestions, and — inside the trip report — short travel films played from YouTube, TikTok, Vimeo or Pexels. Loading any of these tells that company your IP address and which page or film you are viewing. Recipients: Google Ireland Ltd / Google LLC (map and YouTube), TikTok Technology Ltd, Vimeo.com Inc and Pexels GmbH, with transfers to the United States for all except Pexels.
If you refuse: you get a static map preview served by our own servers instead of the interactive map, see film posters only (no third-party players), and type place names manually.
Advertising and partner tracking
On our Explore travel articles only, loads a script from Stay22 that turns links to booking sites (such as Booking.com, Expedia, Hotels.com, Vrbo, Agoda, Kayak and GetYourGuide) into tracking links, so a booking you make can be attributed to us and earn us a commission. To do this, Stay22 stores identifiers in your browser, calculates a fingerprint of your device, checks whether you use an ad blocker or private browsing, and receives your IP address (from which it derives your approximate location), the address and text of the article you are reading, and the page you came from. It may also add sponsored links to the article and open partner results in a new tab. Recipient: Stay22 Technologies Inc., whose privacy policy states that data may be processed outside Canada, including in the United States and Europe. Kept separate from our own marketing because the recipient is different.
If you refuse: the Stay22 script is never loaded, and you can still book with our partners; the link simply carries no tracking identifier.
Purposes we have defined but do not use
We publish these so our taxonomy is transparent before anything changes. We do not currently do any of them, no such data is collected, and we will ask you again before we start:
- Measuring how the site is used. Statistics about which pages are visited and where people get stuck, so we can improve the product.
- Tailoring what we show you. Building a picture of your travel preferences from how you use the site, in order to choose and order the destinations, hotels and itineraries we suggest.
- Personalised pricing and commission. Using a profile built from your behaviour to determine the prices, commissions or offers shown to you on hotel bookings. This is kept strictly separate from every other purpose and is never bundled with them.
- Waivoo's own marketing. Measuring our own campaigns and showing you our own offers based on how you used the site.
- Social sharing buttons. Share and follow buttons that load from social networks and let them see that you visited the page.
5. Optional items in detail
| Name | Type | Domain / path | Recipient | Purpose | Legal basis | Duration | Transfer outside the EEA |
|---|---|---|---|---|---|---|---|
| search_session_<sessionId> | localStorage | waivoo.com / | Andrey Sobolevsky (sole trader, trading as Waivoo), BE 0772.527.301 | Keeps a copy of trips you have opened on this device, so they load instantly and still appear if our servers are briefly unreachable. The site works fully without it. | Consent | Until you withdraw consent or clear site data | None |
| waivoo-offline-tours (stores: sections, blobs) | indexedDB | waivoo.com / | Andrey Sobolevsky (sole trader, trading as Waivoo), BE 0772.527.301 | Holds a guided tour you previously downloaded — its text, images and audio. Guided tours have been withdrawn, so nothing new is written here, but anything downloaded before then is still on your device. It can reach tens of megabytes and is never deleted automatically; you can remove it from the cookie preferences panel at any time. | Consent (the download itself was user-initiated, but the storage is long-lived and substantial, so we ask) | Until you delete it or clear site data — no automatic expiry | None |
| maps.googleapis.com (Maps JavaScript API + Places) | script | maps.googleapis.com /maps/api/js | Google Ireland Ltd (EEA) / Google LLC (US) | Draws the interactive map of your trip and suggests places as you type. Loading it tells Google your IP address and which page you are on. If you refuse, we show a static map preview served by our own servers instead (the /api/map-snapshot route — Google never sees your browser). | Consent | Per page load; any storage is set by Google under Google's policy | United States — EU-US Data Privacy Framework and Standard Contractual Clauses |
| www.youtube-nocookie.com (embedded travel films) | script | www.youtube-nocookie.com /embed/* | Google Ireland Ltd (EEA) / Google LLC (US) | Plays short travel films about your destinations inside the trip report. Loading a player tells YouTube your IP address and which film you watch, and YouTube will store identifiers in your browser under its own policy. If you refuse, we show only still images served by Waivoo. | Consent | Per play; any storage is set by YouTube under Google's policy | United States — EU-US Data Privacy Framework and Standard Contractual Clauses |
| www.tiktok.com/player (embedded travel films) | script | www.tiktok.com /player/v1/* | TikTok Technology Ltd (Ireland) / ByteDance Ltd | Plays short travel films hosted on TikTok inside the trip report, only after you allow it. Loading a player tells TikTok your IP address and which film you watch. If you refuse, we show only still images served by Waivoo. | Consent | Per play; any storage is set by TikTok under TikTok's policy | United States / Singapore — Standard Contractual Clauses |
| videos.pexels.com / images.pexels.com (stock travel footage) | script | videos.pexels.com /* | Pexels GmbH (Germany, EU) | Streams licence-free stock travel footage inside the trip report when no creator film is available for a destination. Loading a clip tells Pexels your IP address. Poster images are proxied through Waivoo; the video stream itself comes from Pexels. If you refuse, we show only still images served by Waivoo. | Consent | Per play; any storage is set by Pexels under Pexels' policy | None |
| player.vimeo.com (embedded travel films) | script | player.vimeo.com /video/* | Vimeo.com Inc (US) | Plays short travel films hosted on Vimeo inside the trip report, only after you allow it. Loading a player tells Vimeo your IP address and which film you watch. If you refuse, we show only still images served by Waivoo. | Consent | Per play; any storage is set by Vimeo under Vimeo's policy | United States — Standard Contractual Clauses |
| Stay22 "Let Me Allez" (letmeallez.js and spark-gallery-widget.js) | script | scripts.stay22.com /letmeallez.js | Stay22 Technologies Inc. | Loaded only on Explore travel articles, and only after you allow partner tracking. Rewrites links to booking sites (Booking.com, the Expedia group including Hotels.com and Vrbo, the Kayak group, Agoda, GetYourGuide) into www.stay22.com tracking links so a booking can be attributed to Waivoo for a commission. It calculates a device fingerprint (from canvas, audio, WebGL, screen, hardware, plugins, speech voices, language and system settings) and sends it to id.h2.stay22.com; checks for ad blockers and private browsing (in Chromium browsers this can create a one-byte test file named "_" in the site's private file system); and sends Stay22 the full address of the page including its query string, the referring page, the article title and up to 10,000 characters of its text. Stay22 derives an approximate location from your IP address. It can also add sponsored links to the article text and open partner results in a new tab. A small, randomly sampled share of visits sends page-performance measurements to Stay22, and ThumbmarkJS (api.thumbmarkjs.com) receives rare sampled diagnostics. | Consent | Per page load while you are on Explore; the identifiers it stores are listed separately below | Outside the EEA — Stay22's privacy policy states data may be processed outside Québec and Canada, including in the United States and Europe |
| sid22, hip22, conMeth, localnova, pendingNovaSave, scrollPort22, visitor_id_id22 | localStorage | waivoo.com / | Stay22 Technologies Inc. | Written into this site's storage by the Stay22 script. sid22: visitor/session identifier sent with every Stay22 request. hip22: a hash of your IP address supplied by Stay22. conMeth: Stay22's classification of your connection (normal, VPN, data centre, Tor, bot). visitor_id_id22: your device-fingerprint identifier. localnova and pendingNovaSave: remember that a partner tab was recently opened, to limit how often it happens. scrollPort22: your scroll position when you leave through a partner link. Deleted when you withdraw consent. | Consent | sid22, hip22, conMeth: 6 hours; localnova, pendingNovaSave: about 14 minutes; scrollPort22: 1 minute; visitor_id_id22: no expiry — deleted when you withdraw consent or clear site data | Values are sent to Stay22 — see the Stay22 script entry above |
| extnova, _tmjs_l | sessionStorage | waivoo.com / | Stay22 Technologies Inc. | Written by the Stay22 script. extnova: a one-time flag about a partner tab, deleted as soon as it is read. _tmjs_l: records that the fingerprinting library already sent its sampled diagnostics in this tab. | Consent | At most the browser tab session; deleted when you withdraw consent | Used by the Stay22 script — see the Stay22 script entry above |
| __cf_bm | cookie | stay22.com / | Stay22 Technologies Inc. (set through its CDN provider Cloudflare) | Bot-detection cookie set on Stay22's own domain when your browser downloads the Stay22 script. Waivoo cannot read or delete it; it is governed by Stay22's policy. | Consent (the script is only requested after you allow partner tracking) | 30 minutes | See the Stay22 script entry above |
6. Third parties your browser may contact
- Google Ireland Ltd / Google LLC — Identity Services, loaded only when you open the sign-in dialog; Maps and Places, loaded only if you allow third-party embeds. Transfers to the United States under the EU-US Data Privacy Framework and Standard Contractual Clauses.
- Stripe Payments Europe Ltd / Stripe, Inc. — payment pages you are redirected to when you subscribe. Stripe's scripts are not loaded on waivoo.com.
- DigitalOcean / AWS — time-limited links to documents you open from your own trip.
- Stay22 Technologies Inc. — affiliate tracking links on our Explore travel articles, loaded only if you allow partner tracking. Its script (scripts.stay22.com) also contacts www.stay22.com, id.h2.stay22.com and, rarely, api.thumbmarkjs.com. Stay22's privacy policy states that data may be processed outside Québec and Canada, including in the United States and Europe.
To be explicit about what is absent: apart from the Stay22 partner tracking described above, which needs your consent and only runs on Explore articles, we run no analytics, no advertising network, no tag manager, no session replay and no tracking pixel. Fonts and icons are served from our own servers, not from a third party. There is no service worker.
7. How long your choice lasts
We remember your answer for 180 days, and for exactly the same period whether you accept or refuse. We will not re-ask inside that period. We ask again only if you clear your browser storage, or if we introduce a new purpose, recipient or transfer — in which case we ask about the change.
8. Changing or withdrawing consent
Use the Cookie preferences link in the footer of any page, or the button below. Withdrawing takes the same single click as giving consent, needs no account and no email.
Withdrawal is retroactive: we stop loading the relevant third-party content and we delete what that purpose already stored on your device. It does not affect the lawfulness of anything we did while your consent was in force.
9. Profiling, personalisation and pricing
The price you see does not depend on who you are. For a given hotel, date and party size, every visitor is shown the same price. We do not currently build behavioural profiles at all, and no automated decision-making produces a legal or similarly significant effect on you within the meaning of article 22 GDPR.
We may in future use behavioural data to decide the order and selection of the destinations, hotels and itineraries we suggest. That is the Tailoring what we show you purpose above, and it would still not change the price you are quoted.
Should we ever go further and personalise prices, commissions or offers on the basis of automated decision-making, we commit to all of the following before it takes effect: asking you separately and explicitly, outside this cookie banner; carrying out a data protection impact assessment; giving you a way to obtain human review, express your point of view and contest the outcome; never using special-category data or data about minors as an input; and displaying the notice required by articles VI.45 §1 21° and VI.64 §1 20° of the Belgian Code of Economic Law — “this price has been personalised for you on the basis of automated decision-making” — next to the price itself. That last obligation comes from consumer law, applies whatever you choose here, and cannot be switched off by withdrawing cookie consent.
Where the order in which we present options is influenced by the commission we earn, we say so at the point where the ranking is shown.
10. Your rights
You have the right to access, rectify and erase your data, to restrict or object to its processing, and to data portability (articles 15–20 GDPR). You have an absolute right to object at any time to processing for direct marketing, including profiling for that purpose (article 21(2)). Exercise any of these at support@waivoo.com.
You may also lodge a complaint with the Belgian Data Protection Authority: Gegevensbeschermingsautoriteit / Autorité de protection des données, Drukpersstraat 35 / Rue de la Presse 35, 1000 Brussels, contact@apd-gba.be.
11. Deleting site data yourself
The preference centre includes a control to delete any guided tour you previously downloaded for offline use. Guided tours have been withdrawn, so no new one can be downloaded, but a tour saved earlier is still on your device and remains the largest thing we ever stored there. You can also clear everything from your browser: Chrome and Edge — Settings → Privacy and security → Third-party cookies / Delete browsing data; Firefox — Settings → Privacy & Security → Cookies and Site Data; Safari — Settings → Privacy → Manage Website Data. Clearing cookies and site data signs you out.
12. Records of your choice
When you make a choice we record, against a random identifier, the date and time, which purposes you accepted and which you refused, the version and language of the notice you were shown, and a coarse browser family. We deliberately do not record your IP address. We keep these records for the life of the consent plus five years, to be able to demonstrate compliance as article 7(1) GDPR requires. Archived copies of every version of this policy and of the banner are kept for ten years; they contain no personal data.
13. Related documents
See our Privacy Policy for how we handle personal data generally, and our Terms of Service for the contract governing use of the site. Accepting cookies is not acceptance of either document, and neither is bundled with the other.