Last updated: 2026-05-10 · v1
Cookie Policy
Effective Date: 2026-05-11 Last Updated: 2026-05-11 Version: 1.0
This Cookie Policy explains how GRANDROUTES GLOBAL PTE. LTD. ("Gvoya") uses cookies, web-beacons, local storage, and similar technologies on the Gvoya websites (gvoya.com, b2b.gvoya.com, supplier.gvoya.com) and mobile applications (collectively, the "Service"). This Policy supplements our Privacy Policy and Terms of Service.
1. What Are Cookies?
Cookies are small text files placed on your device by your browser when you visit a website. Similar technologies include local storage, session storage, IndexedDB, web beacons (pixel tags), and SDK-managed identifiers. Together they allow a service to remember your preferences, recognize returning users, measure performance, and protect against fraud.
2. Categories of Cookies We Use
We classify cookies into four categories. Only the Strictly Necessary category is set by default; all others require your consent under GDPR Art. 6(1)(a), the EU e-Privacy Directive, the UK PECR, the Singapore PDPA, China PIPL Art. 14, and the CCPA "right to opt out" framework.
2.1 Strictly Necessary (Always On)
These cookies are required for the Service to function. They cannot be disabled.
| Name | Purpose | Type | Lifetime |
|---|---|---|---|
session-token | Authenticated session (Auth.js JWT) | First-party, HTTP-only, Secure | 8 hours |
gvoya_anon_id | Anonymous visitor identifier for compliance evidence chain (associates pre-login Consent records to userId after login) | First-party, Secure | 30 days |
gvoya_cookie_consent | Records your cookie banner choice (all / necessary) | First-party, Secure | 365 days |
__Host-csrf | Cross-site request forgery protection token | First-party, HTTP-only, Secure | Session |
gvoya_geo | ISO-2 country derived from IP (used for jurisdiction-aware document fallback and price localization) | First-party, Secure | 180 days |
2.2 Functional (Consent: Necessary or All)
| Name | Purpose | Lifetime |
|---|---|---|
NEXT_LOCALE | Selected interface language (one of 24 supported locales) | 365 days |
gvoya_pending_name | Holds your display name during signup until account is created | 30 minutes |
2.3 Personalization & AI Memory (Consent: All)
| Name | Purpose | Lifetime |
|---|---|---|
gvoya_consent | Records optional consent for partner contact (referrals) | 365 days |
gvoya_ref | Referral attribution for partner credits | 30 days |
| AI Concierge memory keys | Stored server-side under your userId; remembers preferences (destination interests, budget tier, cabin preference) for better future recommendations. Cleared via /account/settings. | Until you clear |
2.4 Analytics (Consent: All)
If you accept all cookies, we use first-party analytics to measure how the Service is used.
| Provider | Purpose | Data sent |
|---|---|---|
| PostHog (self-hosted or EU cloud) | Product analytics: page views, AI conversation completion rates, conversion funnel | Truncated IP, page URL, session id, user agent |
| Sentry | Error monitoring | Stack traces, browser/UA, user id (if logged in), de-identified context |
We do not integrate Google Analytics, Facebook Pixel, TikTok Pixel, or third-party advertising networks. We do not "share" personal information for cross-context behavioral advertising under California Civil Code §1798.140(ah).
3. How to Control Cookies
3.1 Cookie Banner
When you first visit the Service, a cookie banner offers two choices:
- Accept all — enables Necessary, Functional, Personalization, and Analytics cookies
- Necessary only — only Strictly Necessary cookies (the Service still functions, but personalization and analytics are disabled)
You may change your choice at any time via the footer link "Cookie preferences" or the dedicated page at /cookie-policy#preferences. Each choice is recorded as a LegalConsent row (scope = cookie) with your truncated IP, user-agent, and timestamp for compliance evidence.
3.2 Browser Controls
Most browsers allow you to view, manage, delete, and block cookies on a per-site basis. Consult your browser's documentation:
- Chrome / Edge: Settings → Privacy and security → Cookies
- Firefox: Settings → Privacy & Security → Cookies and Site Data
- Safari: Settings → Privacy
Note that disabling Strictly Necessary cookies will prevent login and break booking flows.
3.3 Do Not Track / Global Privacy Control
We honor the Global Privacy Control (GPC) signal as an opt-out under CCPA §1798.135(b). When GPC is detected, we treat the visit as if "necessary only" was selected, regardless of any pre-existing local preference. The legacy "Do Not Track" signal is acknowledged but, due to its non-standardization, we follow the GPC standard for primary compliance.
3.4 Withdrawing Consent
You may withdraw cookie consent at any time:
- Click the footer cookie icon and choose "Necessary only"; or
- Visit
/account/legal-consents, find the cookie consent record, and click "Withdraw"; or - Email privacy@gvoya.com with subject "Withdraw cookie consent — [your email]"
Withdrawal takes effect immediately for future requests. Existing identifiers in non-necessary categories will be deleted within seven (7) days.
4. Third-Party Cookies in Embedded Content
Some pages embed third-party media (e.g., YouTube voyage trailers, Vimeo player). These embeds may set their own cookies on their domains. Embeds use privacy-enhanced modes where available (e.g., youtube-nocookie.com). Such cookies are governed by the respective provider's policies.
5. International Considerations
Users in the EU/EEA, UK, Switzerland, Brazil, and other consent-required jurisdictions: cookies in categories 2.2-2.4 are not set unless you affirmatively click "Accept all". Your consent is legally evidenced by the gvoya_cookie_consent cookie value AND the corresponding LegalConsent row in our database.
Users in mainland China: pursuant to PIPL Art. 14, separate consent is sought for cross-border transfer of any personalization data. Where a sub-processor is outside mainland China, the relevant cross-border-transfer notice is presented.
Users in California: you have the right to opt out of any "sale" or "sharing" via the GPC signal. Gvoya does not sell or share personal information for cross-context behavioral advertising in any case.
6. Changes to This Cookie Policy
We may update this Policy from time to time. Material changes (e.g., adding a new analytics provider) require fresh consent and will be announced via the cookie banner and email at least fourteen (14) days in advance.
7. Contact
Questions about this Cookie Policy:
Data Protection Officer: dpo@gvoya.com Privacy team: privacy@gvoya.com GRANDROUTES GLOBAL PTE. LTD., Singapore