Cookie Policy

Last reviewed: 2026-05-25. These terms have been drafted to a publication standard. A formal review by a Finnish licensed attorney (asianajaja) is recommended before high-value contracts are signed.

This policy explains the cookies and similar technologies Pisteo uses across the diner app, the restaurant admin app, and the pisteo.io marketing site.

We keep this short on purpose. Pisteo uses very few cookies and no advertising cookies. We do not track diners.

1. What a cookie is

A cookie is a small text file a website stores in your browser. Some cookies are needed for the site to work. Others are used for analytics or advertising. Under ePrivacy law and Finnish guidance, strictly necessary cookies do not need consent. Anything else does.

We also use similar technologies (local storage, session storage) where they are the right tool for the job. We treat them under the same rules as cookies in this policy.

2. The diner app

The diner app (the page that loads when a diner scans a QR code at a table or opens the public link) uses one cookie:

Name	Purpose	Type	Lifetime
pisteo_session	Links your phone to the table you scanned and keeps your order in progress	Strictly necessary, first-party	Ends when you close the browser or after two hours of inactivity

That is the entire list. The diner app does not use analytics cookies, advertising cookies, or third-party tracking pixels. PostHog is not loaded on the diner side. There is no consent banner because there is nothing to consent to.

When you pay, Stripe loads its own scripts (Stripe Elements, Apple Pay, MobilePay) on the payment screen. These set cookies under Stripe’s own privacy policy at stripe.com/privacy. They are needed to process the payment and to prevent fraud.

3. The restaurant admin app

The admin app is logged-in only. It uses:

Name	Purpose	Type	Lifetime
pisteo_admin_session	Keeps you signed in after authentication	Strictly necessary, first-party	Up to 30 days, expires sooner if you sign out
ph_* (PostHog)	Product analytics. Tracks how restaurant admins use the admin app. EU Cloud.	Analytics, first-party (via reverse proxy)	Up to 12 months
__cf_bm, cf_clearance (Cloudflare)	Bot management and security challenge state on traffic served through Cloudflare	Strictly necessary, first-party	Up to 30 minutes (__cf_bm) / up to 30 days (cf_clearance)

PostHog is for our product analytics only. We use it to understand which features admins use and where the app needs improvement. It is loaded only after you sign in and only in the admin app.

If you want to opt out of PostHog in the admin app, write to [email protected] and we will disable analytics on your account.

The Cloudflare cookies are set by our edge provider to distinguish humans from bots and to protect the platform from abuse. They are classified as strictly necessary under ePrivacy guidance and do not track you across sites.

4. The marketing site (pisteo.io)

The pisteo.io marketing site is a static site hosted on Cloudflare Pages. It does not set any first-party tracking, analytics, or advertising cookies. We do not run PostHog, Google Analytics, Meta Pixel, or any similar tag on this site.

The only cookies you may encounter when visiting pisteo.io are Cloudflare’s strictly necessary security cookies (__cf_bm, cf_clearance), which are set by our edge provider to distinguish humans from bots. These do not require consent under ePrivacy guidance.

Because there is no non-essential tracking, we do not show a consent banner on pisteo.io. If we ever introduce analytics on the marketing site, we will ask for consent first and update this policy.

5. How to control cookies

• In the browser. Most browsers let you block or delete cookies in their settings. Blocking strictly necessary cookies will break the diner ordering flow and the admin sign-in.
• By writing to us. Email [email protected] to opt out of PostHog in the admin app or to ask any question about cookies.

6. Changes to this policy

If we add or change cookies, we update this page and the “Last updated” date. Material changes are notified to admin users by email.

7. Contact

[email protected] Easy Host Oy / Pisteo, Business ID 3288005-7, Helsinki, Finland