← Back to TaxFactory

Cookie and local storage policy

Document version 2.1 · Document date 2026-08-03

This is an English translation for convenience. The Spanish version prevails if there is any discrepancy.

1. Owner and scope

The site owner is TAX FACTORY, S.L., Spanish tax number B67123612. Questions: guillem@taxfactory.es. This policy supplements the privacy policy.

Cookies are files a site may store in a browser. Similar technologies include localStorage, sessionStorage, technical identifiers, scripts and third-party requests.

2. Current position

The technical review dated 3 August 2026 found no active analytics, advertising, remarketing or tracking pixels. The site therefore does not display a general cookie banner. If non-essential technology requiring prior consent is added, it will be blocked until a clear accept, reject and preference mechanism is available.

3. Functional browser storage

Language preference

  • Key: taxfactory:locale.
  • Technology: localStorage.
  • Purpose: remember the selected Spanish or English locale.
  • Value: only es or en.
  • Duration: until changed or site data is deleted.

Temporary contracting access

  • Prefixes: taxfactory:contracting-bootstrap:v1: and taxfactory:contracting-access:v1:.
  • Technology: sessionStorage.
  • Purpose: first keep the bootstrap code inside the tab so its exchange can be retried after a connection interruption, then retain the final temporary status and portal credentials. Stripe receives only that bootstrap code in the URL fragment; the page stores it before removing it from the address and removes it after confirming the final credentials.
  • Content: contract identifier, temporary random bootstrap code and temporary random final credentials, not the contract document.
  • Duration: the tab session or until invalidated; the bootstrap code expires within 24 hours. The server never stores raw codes or tokens: it stores the code digest and an AES-GCM encrypted envelope so the same pair can be recovered during exchange.

4. External services

CARTO office map

The map uses Leaflet and tiles from basemaps.cartocdn.com, with OpenStreetMap and CARTO attribution. CARTO may receive IP, browser, device, referrer and timestamps. One spot check found no Set-Cookie header, which does not guarantee future provider behavior. See CARTO Privacy.

Cloudflare Turnstile

Forms use Turnstile to prevent abuse. Cloudflare may process IP, browser, device and technical signals. The reviewed configuration does not enable cf_clearance pre-clearance, but this must be checked again after integration changes. See Cloudflare Privacy.

Stripe and e-Signature.eu

Stripe is loaded when the user proceeds to secure payment and applies its own technologies on its domain. e-Signature.eu will be involved only after payment if the QES flow is enabled. Their own policies and the relevant contracts apply.

5. Browser controls and changes

Browser privacy settings can block or delete cookies and storage. Blocking local storage, session storage, Turnstile or third-party resources may prevent language memory, status access, form submission or map display.

TaxFactory will review this policy when code, providers or purposes change. Contact: guillem@taxfactory.es.