Cookie policy.

1. Introduction and Scope

This Cookie Policy explains how Hoodbnb B.V., trading as 'Tribii' (hereafter 'Tribii'), uses cookies and similar storage. Tribii is a European SaaS platform for independent hotels. On our marketing website (tribii.com), and on the pages of app.tribii.com where you sign up for or log in to Tribii, we use analytics and advertising cookies in addition to the strictly essential ones, but only if you switch them on: they are off by default and nothing is set until you choose. Everywhere else, including the whole of Tribii once you are signed in, uses strictly essential cookies only.

Because these pages can set non-essential cookies, we display a cookie banner on tribii.com and record your choice. You are asked once. Signing up happens on app.tribii.com, which is the same website under the same company, so the choice you made on tribii.com carries across to it and no second banner appears; if you have made no choice, nothing optional is set there at all. You can change or withdraw that choice at any time using the 'Cookie settings' link in the footer of every page on tribii.com. For website statistics we also use Umami, a cookieless, privacy-first analytics tool that sets no cookies and stores nothing on your device; it needs no consent and runs whatever you decide.

Scope. This policy covers three distinct surfaces, and the difference between them matters:

• tribii.com, our public marketing website. This is the only surface with a cookie banner, and the only place you are asked.
• app.tribii.com, the Tribii application. Its sign-up, log-in, password and contact pages carry the same optional analytics and advertising cookies as tribii.com, and only where you have already agreed to them there. The application itself, everything you reach after signing in, uses strictly necessary cookies only.
• The embedded booking widget on our customers' own hotel websites. Strictly necessary cookies only. See Section 10.

2. What Are Cookies and Similar Technologies?

Cookies are small text files stored on your device when you visit a website. Each cookie is linked to a domain and expires after a set time. Cookies help websites recognize users and remember preferences.

This policy also covers similar technologies that store or read information on your device: local storage, tracking pixels, and device or browser identifiers. European law treats these the same way as cookies, so where this policy says 'cookies' it means all of them, and the lists below say which mechanism each entry uses.

3. The Three Categories We Use

We group the cookies and similar technologies on tribii.com, and on the Tribii sign-up pages described in Section 1, into three categories.

Strictly necessary. These make the website work: keeping you logged in, securing forms, remembering your language, routing your requests. They cannot be switched off and we do not ask for consent to use them, because the law does not require consent for them.

Analytics. These help us understand how people find Tribii and how they move from our marketing website to signing up, so we can improve both. We only set them if you agree.

Advertising. These let us measure whether our advertising works, by connecting a sign-up back to the advertisement that led to it. They are not used to build audience lists or to show you Tribii ads elsewhere: see Section 6. We only set them if you agree.

Analytics and advertising cookies are off by default. Nothing in those two categories is placed on your device, and no data is sent to Google, until you actively choose to allow it. Refusing costs you nothing: tribii.com works exactly the same either way, and so does creating and using a Tribii account.

4. Strictly Necessary Cookies

Tribii uses the following strictly essential cookies:

• Session ID: Maintains your login session. Expires when your browser closes.
• Authentication Token: Secures your account. Valid for 30 days.
• CSRF Token: Protects against cross-site request forgery attacks. Expires per session.
• Language Preference: Remembers your chosen language. Valid for 12 months.
• Load Balancing: Routes your requests to the best server. Expires per session.

On our marketing website (tribii.com) the strictly essential set is smaller, and is listed in full in the preference centre behind the 'Cookie settings' link:

• i18n_redirected: Remembers the language you chose. Valid for 12 months.
• tribii_consent: Stores your cookie choice so we do not ask again, and so we can show that you were asked. Local storage, kept for 6 months.
• tribii_consent_state: Carries the choice you made on tribii.com across to the sign-up pages on app.tribii.com, so you are not asked twice and so those pages know what you allowed. Cookie set on tribii.com and readable by app.tribii.com, kept for 6 months.
• cf_clearance: Cloudflare's bot check on our forms. Set by challenges.cloudflare.com, expires per session.

These cookies are strictly necessary for authentication, security, and platform functionality. They do not track your behavior or preferences beyond what is needed to keep you logged in.

Under the ePrivacy Directive (Directive 2002/58/EC), strictly essential cookies do not require user consent because they are necessary for the service you requested.

5. Analytics Cookies

We use two analytics tools, and they are treated differently because they work differently.

Umami: no consent needed. Umami is a privacy-first analytics tool that sets no cookies, stores nothing on your device, and does not track you across websites. It gives us aggregate page-view counts only. Because it neither stores nor accesses information on your device, it falls outside the consent requirement and runs for all visitors.

Google Analytics 4: consent required. If you accept analytics cookies, we use Google Analytics 4 to understand traffic sources, page journeys and sign-up funnels in more detail. The visit to our marketing website and the sign-up that may follow it are measured as one journey rather than two, which is why the same cookies are read on both tribii.com and app.tribii.com. Google Ireland Limited acts as our processor for this. Google Analytics data may be transferred to Google LLC in the United States under the EU Standard Contractual Clauses and the EU-US Data Privacy Framework.

• _ga (tribii.com, first party, and read on app.tribii.com): distinguishes one visitor from another. 24 months.
• _ga_<property-id> (tribii.com, first party, and read on app.tribii.com): maintains the analytics session state. 24 months.

Durations are the values we configure. Your browser may keep them for less: Chrome caps first-party cookies at 400 days, and Safari's tracking prevention can reduce script-set cookies to 7 days.

We have configured Google Analytics so that IP addresses are truncated within the EU before processing and are not logged or stored; data sharing with Google for product improvement, benchmarking, technical support and account specialists is switched off; URL query parameters and email addresses are redacted before collection; and event and user data is deleted after 14 months.

6. Advertising Cookies

If you accept advertising cookies, we use Google Ads and the Meta (Facebook) Pixel to measure which campaigns bring people to Tribii, so we know which advertising is worth paying for. Because the advertisement is seen on tribii.com and the sign-up happens on app.tribii.com, the Google Ads cookie is read on both; the Meta Pixel runs on tribii.com only.

We do not run remarketing. We do not build audience lists from the pages you viewed, and we do not use these cookies to follow you around the web with Tribii ads. They are used to attribute a sign-up back to the advertisement that led to it, and nothing more. If that ever changes we will update this policy and ask you again, rather than quietly widening what your existing consent covers.

• _gcl_au (tribii.com, first party, and read on app.tribii.com): Google Ads conversion linker, attributes a sign-up to the ad that led to it. 90 days.
• tribii_attribution (tribii.com, local storage): remembers which campaign brought you here, so a later sign-up is credited to it. 90 days.
• _fbp (tribii.com, first party): identifies your browser for Meta ads measurement. 90 days.
• _fbc (tribii.com, first party): links a Meta ad click to a later sign-up. 90 days.

For the Meta Pixel, Meta Platforms Ireland Limited and Tribii are joint controllers for the collection and transmission of the data, under Meta's Controller Addendum; Meta is an independent controller for what it does with the data afterwards. Meta's privacy policy is at facebook.com/privacy/policy. When you withdraw consent we stop the pixel and delete _fbp and _fbc from your device.

The essence of that arrangement, which Article 26(2) GDPR requires us to make available to you, is this. Tribii is responsible for obtaining your consent before the pixel loads, for giving you this information, and for letting you withdraw consent as easily as you gave it. Meta is responsible for the security of the transmission and for everything it does with the data once received. You may exercise your data-protection rights against either of us, in respect of all of the joint processing, and you are not obliged to approach us first. Write to us at contact [at] tribii [dot] com and, if the request concerns what Meta does with the data after collection, we will forward it to Meta and tell you that we have done so. Meta has undertaken primary responsibility for responding to requests about the joint processing under its Controller Addendum, and its own tools for access, objection and deletion are reachable from the privacy policy linked above.

For advertising measurement, Google acts as an independent controller in respect of some of this data, under Google's Ads Controller-Controller Data Protection Terms. That means Google decides certain purposes for itself and has its own obligations to you. Google's own privacy policy is at policies.google.com/privacy and you can control ad personalisation across Google's services at myadcenter.google.com.

7. How We Load These Tags

We do not use a tag-management container. The Google tag and the Meta Pixel are each loaded directly by our own code, from a single place, so what runs on tribii.com and on the Tribii sign-up pages is exactly what is in our source code and nothing can be added to it without a deployment. There is no third-party interface through which tags could be introduced without review.

8. Google Consent Mode

We use Google Consent Mode in what Google calls its basic configuration. In plain terms: if you have not accepted, no Google tag is downloaded or executed at all, so your browser makes no request to Google and Google receives nothing, not even an anonymous signal.

We deliberately do not use the advanced configuration, in which tags load before a decision and send cookieless pings carrying your IP address, user agent and page address. That option would give us better conversion estimates. We consider it the wrong trade for a site whose visitors are choosing us partly because we do not do that sort of thing.

Because nothing loads before consent, we cannot model the behaviour of visitors who refuse, and we do not attempt to. Where we need to know whether an advertisement led to a sign-up, we match that up on our own servers from information you gave us directly, rather than by tracking you.

9. Third-Party Cookies Set by Embedded Providers

Two third parties whose services are essential to operating the Tribii platform may set first-party cookies on their own domains when their iframes load within Tribii or on a hotel's booking page:

• Stripe (payments). Stripe sets cookies on stripe.com and m.stripe.com domains for fraud detection and session management when the Stripe Checkout or Elements iframe loads. These cookies are visible in your browser's developer tools but are controlled by Stripe under Stripe's own privacy policy, not by Tribii. Blocking these cookies will prevent payments from being processed.
• Google Maps. When a property page or booking page loads an embedded Google Map, Google may set cookies on google.com / gstatic.com domains for map rendering, abuse prevention, and language preferences. These cookies are controlled by Google under Google's own privacy policy. Blocking them may prevent the map from loading.

Tribii does not have access to these cookies and cannot delete them on your behalf. Manage them through your browser settings or directly with the relevant provider.

In addition to session cookies, the widget transmits booking-form data to Tribii servers in real time. For details on how Tribii handles this data, including for abandonment recovery, see the Privacy Policy.

10. The Embedded Booking Widget

The Tribii booking widget that appears on our customers' hotel websites sets strictly necessary cookies only. It does not run Google Analytics, Google Ads or any advertising or remarketing technology, and it never has. The cookie-setting analytics and advertising described in Sections 5 and 6 apply to tribii.com, our own marketing website, and to the Tribii sign-up pages described in Section 1. They apply to nothing else: not to the widget, not to a hotel's booking page, not to a hotel's website, and not to online check-in.

One clarification, so this section cannot be read too widely. On the booking pages Tribii hosts on a hotel's behalf, we run Umami, the cookieless statistics tool described in Section 5. It sets no cookie, stores nothing on your device and creates no cross-site identifier, so it needs no consent and does not appear in any table here. It counts page views for the hotel, which is the controller of that data, and Umami acts as our sub-processor on those pages. It does not run on the widget embedded in a hotel's own website, nor on the hotel websites we publish, nor on online check-in. Our Data Processing Agreement and our Sub-processor List say the same thing.

This is a deliberate design decision. When you place the Tribii widget on your hotel's website, you are not inheriting our marketing stack, and you do not need to add Tribii to your own cookie banner beyond the strictly necessary category.

The widget may set essential cookies on the hotel's domain to maintain session state and enable bookings. These are first-party cookies on the hotel's domain, not Tribii's. Hotels remain responsible for informing guests about cookies set on their own domain; to assist, Tribii provides a suggested cookie-notice paragraph in its documentation portal.

11. How to Give, Refuse or Withdraw Consent

The first time you visit tribii.com you will see a cookie notice with three options: accept all, reject all, or manage your preferences by category. Refusing is exactly as easy as accepting: one click, on the first screen, with no extra steps.

You are asked in one place only. If you arrive directly at app.tribii.com without having been asked, no analytics or advertising cookies are set there and no notice is shown: the absence of a choice is treated as a refusal, not as a reason to ask again mid-sign-up.

We record your choice for 6 months, after which we will ask again. We will also ask again sooner if we materially change how we use cookies.

To change your mind at any time, use the 'Cookie settings' link in the footer of every page on tribii.com; it governs the sign-up pages on app.tribii.com too. Withdrawing consent is as easy as giving it. When you withdraw, we stop setting new analytics and advertising cookies immediately, on both, and instruct your browser to clear the existing ones. Withdrawal does not affect the lawfulness of anything we did while your consent was active.

Closing the notice without choosing, or continuing to scroll, is not consent. We treat it as a refusal and set nothing beyond the strictly necessary category.

We keep a record of the choice you made, when you made it, and which version of this policy was shown to you, because European law requires us to be able to demonstrate that consent was given. That record is described in our Privacy Policy.

12. Managing Cookies Through Your Browser

You can also control cookies via your browser settings. All modern browsers (Chrome, Firefox, Safari, Edge) allow you to:

• View and delete cookies
• Block cookies for specific domains
• Disable all cookies

Consult your browser's help documentation for step-by-step instructions.

Important: If you disable essential cookies (session ID, authentication token), you will not be able to log in or use Tribii. Tribii requires these cookies to function.

13. Do Not Track and Global Privacy Control

We honour Global Privacy Control (GPC). If your browser or an extension sends a GPC signal, we record it as a refusal of all optional cookies and do not display the banner. The older "Do Not Track" (DNT) signal has been deprecated and is not a reliable standard, so we do not rely on it; use GPC or the 'Cookie settings' link instead.

Strictly essential cookies are always set regardless of these signals, because they are required for security and account management and are exempt from consent under the ePrivacy Directive.

14. Updates to This Policy

Tribii may update this Cookie Policy to reflect changes in our practices or legal requirements. Significant changes will be announced via email or through a prominent notice on our platform. The 'Last updated' date at the bottom indicates when this policy was last revised.

Version 2.1. Extended the optional analytics and advertising cookies from tribii.com to the sign-up, log-in, password and contact pages of app.tribii.com, so that an advertisement and the sign-up it led to can be connected. The choice you make on tribii.com governs both; there is still only one banner and still no remarketing. Nothing changed inside the Tribii application once you are signed in, and nothing changed for the booking widget, a hotel's booking page or a hotel's website.

Version 2.0. Added Google Analytics 4, Google Ads and the Meta Pixel to tribii.com under consent, for advertising measurement only (no remarketing), and introduced a cookie consent notice. Umami remains our cookieless default and still runs without consent. The booking widget is unchanged and remains strictly-necessary-only.

15. Contact Us

If you have questions about this Cookie Policy or our use of cookies, please contact us:

• Hoodbnb B.V., registered in the Netherlands under KVK number 73124680
• Email: contact [at] tribii [dot] com

We will respond to your inquiry within 30 days.