Table of contents
- About this Policy
- What cookies and similar technologies are
- Categories we use
- Cookie table
- Consent banner rules
- Global Privacy Control and Do Not Track
- Rules by region
- Local storage and device technologies in our apps
- Cookies inside Systems and customer domains
- How to manage your choices
- Changes and contact
1. About this Policy
This Cookie Policy explains the cookies and similar technologies used on websites and apps operated by L. M. PEREZ MONTANA ("SonhoLab", "we", "us"). It covers sonholab.com and its language versions, the central registration and control panel (control.sonholab.com), product landing pages, our free web tools, and the web and mobile apps we run.
This Policy is part of our Privacy Policy (02-privacy-policy.md). Terms such as "System", "Customer" and "Customer Data" have the meanings given there.
2. What cookies and similar technologies are
- Cookies are small text files that a website stores in your browser.
- First-party cookies are set by the site you visit. Third-party cookies are set by another company through that site.
- Session cookies are deleted when you close the browser. Persistent cookies stay until they expire or you delete them.
- Similar technologies include browser local storage and session storage, IndexedDB, pixels or tags, software development kits (SDKs) in apps, and device identifiers such as push-notification tokens.
The law treats all of these in the same way: storing or reading information on your device needs your consent, unless it is strictly necessary for a service you asked for (ePrivacy Directive art. 5(3); UK PECR reg. 6; LGPD and the ANPD cookie guidance). In this Policy, "cookies" includes these similar technologies unless we say otherwise.
3. Categories we use
| Category | What it does | Consent needed? | Default |
|---|---|---|---|
| Strictly necessary | Keeps you logged in; protects forms and logins against attacks; balances traffic; remembers your cookie choice; makes the checkout work | No. These are needed for a service you asked for | Always on |
| Preferences | Remembers choices such as language or display settings, where they are not strictly needed | Yes (EEA, Brazil). In the UK, see section 7.3 | Off until you choose |
| Analytics | Counts visits and measures how pages are used, through Google Analytics 4, with Google Signals and ad-personalization signals off | Yes | Off until you opt in |
| Marketing | Advertising, retargeting or cross-site tracking | Yes | Not used on sonholab.com. If we ever add any, they will be off until you opt in, and we will update this Policy first |
What we do not do. We do not use cookies to sell or share your personal information, to build advertising profiles, or to track you across other companies' websites. We do not use advertising or profiling technologies on services directed to children or students, such as Verita.
3.1 Google Analytics 4 settings
When you accept analytics:
- Google Analytics 4 loads, and sets the cookies listed in section 4;
- Google Signals is off, so Google does not link the data to Google accounts;
- ad-personalization signals are off;
- we do not link Google Analytics to any advertising product;
- Google Analytics 4 does not log or store IP addresses; it uses them briefly to derive an approximate location.
Before you accept, Google Analytics does not load and sends no data. We use Google Consent Mode v2 with every storage type denied by default.
Google LLC is our processor for analytics, and the data may be processed in the United States. Subprocessors and International Transfers (04-subprocessors.md) explains the safeguards.
4. Cookie table
We keep this table up to date and update it when we add or change a cookie or similar technology. Each entry shows the fields below.
Fields for each cookie or similar technology:
| Field | Meaning |
|---|---|
| Name | The technical name of the cookie or storage key |
| Provider | Who sets it (SonhoLab or a named third party) |
| Party | First-party or third-party |
| Category | Strictly necessary, preferences, analytics or marketing |
| Purpose | What it is for, in plain words |
| Duration | Session, or how long it lasts |
| Type | HTTP cookie, local storage, session storage, SDK or device identifier |
| Data leaves the EU? | Whether data is sent outside the EU, and to which country |
| Where used | Which sites or apps |
4.1 sonholab.com and product landing pages
| Name | Provider | Party | Category | Purpose | Duration | Type | Data leaves the EU? | Where used |
|---|---|---|---|---|---|---|---|---|
sl_consent | SonhoLab | First | Strictly necessary | Remembers your cookie choice and the version of the consent banner you answered | 12 months | HTTP cookie (Secure, SameSite=Lax) | No | sonholab.com |
preferredLanguage | SonhoLab | First | Strictly necessary | Remembers the language of the site you are using, so pages open in that language | Until you clear your browser storage | Local storage | No | sonholab.com |
_ga | Google LLC | First (set for Google) | Analytics | Distinguishes browsers to count unique visitors | Up to 2 years | HTTP cookie | Yes, United States | sonholab.com, only after consent |
_ga_<container-id> | Google LLC | First (set for Google) | Analytics | Keeps the state of the analytics session | Up to 2 years | HTTP cookie | Yes, United States | sonholab.com, only after consent |
If you open the website chat, it may keep your conversation in your browser while you browse. This is strictly necessary for the chat you asked for.
4.2 Registration, control panel and Systems
| Name | Provider | Party | Category | Purpose | Duration | Type | Data leaves the EU? | Where used |
|---|---|---|---|---|---|---|---|---|
accessToken | SonhoLab | First | Strictly necessary | Keeps you signed in to the System | 15 minutes | HTTP cookie (HttpOnly, Secure, SameSite=Lax) | No | inventario.sonholab.com |
refreshToken | SonhoLab | First | Strictly necessary | Renews your session without asking for your password again | 7 days | HTTP cookie (HttpOnly, Secure, SameSite=Lax; sent only to /api/v1/auth) | No | inventario.sonholab.com |
Other Systems and the registration pages use only strictly necessary cookies of the same kind (to keep you signed in and to protect sign-in forms). We add their names and durations to this table as each System is opened to the public.
Inventory uses only the two cookies above. It sets no anti-forgery cookie: cross-site requests are blocked by SameSite cookies. It uses no local storage or session storage, and no analytics, advertising or other third-party cookies.
4.3 Checkout
When checkout is hosted on Stripe's own pages, Stripe's cookie notice applies to those pages.
Inventory: none. Checkout and billing management are hosted by Stripe on its own domain, so Inventory sets no Stripe cookies.
4.4 Free web tools
A tool may hold your file or settings in your browser memory or storage while it runs. This is strictly necessary for the tool you asked for.
Tools marked "processed in your browser" keep your file on your device. Using browser storage only to deliver the tool you asked for is strictly necessary and needs no consent.
5. Consent banner rules
Our consent banner follows these rules on every SonhoLab website:
- Nothing optional before you choose. Only strictly necessary cookies run until you make a choice.
- Equal choice on the first screen. "Accept all", "Reject all" and "Settings" appear together on the first layer, with the same size, color and prominence.
- Granular settings. You can accept or refuse analytics separately from strictly necessary cookies. No box is pre-ticked. We do not use preferences or marketing cookies on sonholab.com.
- Clear information. The banner says what each category does, who the providers are, and links to this Policy.
- No cookie wall. You can use our websites if you reject optional cookies.
- Refusal is respected. If you reject a category, we do not set or read those cookies, and we do not ask again on every page.
- Withdraw at any time. A "Cookie settings" link in the footer of every page reopens your choices. Withdrawing is as easy as accepting. When you withdraw, we stop the related technologies and delete the cookies we can reach.
- We ask again after 12 months, or earlier if we add a new category, purpose or provider that needs your consent.
- We keep a record of your choice and of the version of the banner you answered, in the
sl_consentcookie in your browser. - No design tricks. The banner does not use colors, wording or layout that push you toward accepting.
6. Global Privacy Control and Do Not Track
Global Privacy Control (GPC). GPC is a browser setting that tells websites you do not want your data sold or shared. When we detect GPC (the Sec-GPC: 1 signal):
- we treat it as an opt-out of any sale, sharing or targeted advertising, for that browser, and as a refusal of analytics cookies;
- we do not load marketing technologies;
- we do not pre-select any optional category in the banner.
We honor GPC for all visitors, wherever they are. We already do not sell or share personal information (see the Privacy Policy, section 12).
Do Not Track. Some browsers send a "Do Not Track" signal. We do not track you across other companies' websites, and we honor GPC, so Do Not Track does not change what we do.
7. Rules by region
7.1 Brazil (LGPD)
We follow the ANPD guidance on cookies (Guia Orientativo: Cookies e Proteção de Dados Pessoais). Optional cookies rely on your consent (LGPD art. 7 I), which must be free, informed and unambiguous. Refusing is as easy as accepting, and you can withdraw at any time (LGPD art. 8 §5). The banner is shown in Portuguese to visitors in Brazil. Under ECA Digital (Lei 15.211/2025), we do not use cookies to profile children or adolescents for advertising.
7.2 European Economic Area (ePrivacy and GDPR)
Optional cookies need your prior consent under the ePrivacy Directive art. 5(3), as implemented in your country, with consent meeting GDPR arts. 4(11) and 7. We give the information required by the case law of the Court of Justice of the EU (Planet49, C-673/17), including cookie duration and third-party access (section 4).
7.3 United Kingdom (PECR as amended by the Data (Use and Access) Act 2025)
UK law now allows some low-risk cookies without consent, including analytics used only to improve the service and cookies that remember appearance or functionality preferences, if we give clear information and a simple way to opt out. Advertising and cross-site tracking still need consent.
Our approach: we ask for opt-in consent for analytics and preferences in the UK too, as we do everywhere. We do not rely on the UK exemption. If we ever decide to rely on it for UK visitors, we will say so in this section, show clear information in the banner, and keep an easy opt-out through "Cookie settings."
7.4 United States
We do not use cookies to sell or share personal information or for targeted advertising. We honor GPC (section 6). The United States Supplement (R-us-states.md) has the state-law details.
7.5 Latin America
We apply the same consent-first approach to visitors from Latin America. The Latin America Supplement (R-latam.md) sets any local rule that adds to this Policy.
8. Local storage and device technologies in our apps
Our mobile and desktop apps (for example, the Verita app, the Farm app, Hades and PDF Free) do not use browser cookies, but they may store or read information on your device.
| Technology | Purpose | Category | Consent |
|---|---|---|---|
| Secure device storage (for example, the system keychain or keystore) | Keeps your login session and keys safe on the device | Strictly necessary | Not needed |
| App local database or files | Saves your settings, drafts and offline copies so the app works without a connection | Strictly necessary | Not needed |
| Push-notification token (Google Firebase Cloud Messaging) | Lets the app receive notifications you asked for | Strictly necessary for notifications | Your device asks for permission; you can turn notifications off in the device settings |
| Device permissions (camera, microphone, files, location) | Only when a feature needs them, such as scanning a document or recording a voice sample | Depends on the feature | Your device asks for permission; you can withdraw it at any time |
| Advertising SDKs or cross-app tracking | Not used | — | — |
PDF Free processes documents on your device. No account and no ads. Google Play services may download the document-scanner module as part of the operating system.
Each app's store listing and its product addendum describe the permissions it uses.
9. Cookies inside Systems and customer domains
Each System sets its own strictly necessary cookies (for example, login sessions), which are covered by section 4.2.
When a Customer runs a System under its own domain and brand (a paid-plan option), or adds its own scripts to a System:
- the Customer is responsible for any cookies or tracking it adds, for its banner and for its cookie notice;
- SonhoLab remains responsible only for the strictly necessary cookies the System itself needs;
- the Data Processing Addendum (DPA) (03-data-processing-addendum.md) and the Customer's own policies apply.
10. How to manage your choices
- On our websites: click "Cookie settings" in the footer of any page to accept, reject or change each category.
- In your browser: you can block or delete cookies in your browser settings. Blocking strictly necessary cookies may stop our websites or Systems from working, for example, you may not be able to log in.
- With GPC: turn on Global Privacy Control in a browser or extension that supports it.
- Google Analytics: in addition to our banner, Google offers a browser add-on to opt out of Google Analytics at tools.google.com/dlpage/gaoptout.
- In our apps: manage notifications and permissions in your device settings. Uninstalling an app deletes the data it stored on your device.
11. Changes and contact
We update this Policy when we add, remove or change a cookie or provider. If a change adds a category or purpose that needs consent, we ask you again through the banner. Each version has a date and stays available in the Legal Center.
Questions: write to our Encarregado (data protection officer) at contacto@sonholab.com. For your rights and complaint options, see Your Privacy Rights and How to Exercise Them (09-data-rights-requests.md).
Version 0.9.0 (preliminary) · Effective 26 September 2026 · © L. M. PEREZ MONTANA (SonhoLab), CNPJ 61.620.014/0001-00. This version is under legal review; we will notify material changes as described in these documents.