Last updated: 21 October 2026.
1. Summary #
- Website bookable.be. A cookie banner (Complianz) asks for consent for statistics and for marketing. Without consent the website only places functional cookies: they remember your choice and make the site work. With consent, Google Analytics, through Google Tag Manager, measures which pages work, and we can measure which advertisements work. With consent for statistics, Microsoft Clarity loads as well: it shows how visitors use the pages, so we can see where things go wrong. Anything typed into a form is masked.
- App app.bookable.be. The app only uses cookies and storage that are needed to make the service work. Under
/start(the sign up) the app loads Google Analytics and Microsoft Clarity, but only if you gave consent on bookable.be. There is no cookie banner on the app itself: your choice on bookable.be also applies there, through the cookiebk_toestemming. Without a choice everything stays refused. - No third party advertising cookies without your consent, and no embedded third party content in the app. On a few example pages of the website there is a Google Maps map that only loads after consent for marketing.
- The rule: consent is needed to place or read information in the browser, unless it is strictly necessary to provide a service that the user expressly asks for, or only to transmit a communication. The Belgian rule is in article 10/2 of the law of 30 July 2018.
2. Giving, changing and withdrawing consent #
- On your first visit to bookable.be you choose in the banner: Allow all, Necessary only, or Choose yourself (functional, statistics, marketing).
- You can always change or withdraw your choice with the Cookies button at the bottom of every page of bookable.be. After that the cookies of that category are no longer used and the website passes your new choice on to the app.
- Your choice is kept for 1 year, in the cookies of the banner and in the cookie
bk_toestemming. You can also delete cookies in your browser settings; the banner then asks again. - If you refuse cookies, the website and the app simply work.
3. Cookies on bookable.be (the website) #
| Name | Purpose | Duration | Category |
|---|---|---|---|
cmplz_banner-status, cmplz_policy_id, cmplz_functional, cmplz_preferences, cmplz_statistics, cmplz_marketing, cmplz_consented_services, cmplz_saved_services, cmplz_saved_categories (Complianz cookie banner) | remembering your choice in the banner | 1 year | functional |
bk_toestemming (set on .bookable.be) | passing your choice to app.bookable.be: s statistics, m marketing, n none, or a combination | 1 year | functional |
_ga, _ga_V7T072JD1B (Google Analytics 4) | a random id to count visits and pages and to follow the move from the website to the app | at most 2 years | statistics, only after consent |
_clck, _clsk (Microsoft Clarity) and the Microsoft cookies MUID and CLID | seeing how visitors use the pages (clicks, scrolling, recordings of a visit) to spot where things go wrong; filled in fields are masked | _clsk 1 day, the others at most 1 year | statistics, only after consent |
_gcl_au, _gcl_aw and similar Google cookies | measuring whether a click on an advertisement led to a request or account, only if we switch on advertisement measurement | at most 90 days | marketing, only after consent |
| Google Maps cookies | showing a map on a few example pages | according to Google | marketing, only after consent (the map only loads then) |
The fonts and scripts of the website are supplied by Bookable itself. Logged in administrators of the website are not measured. The website also uses localStorage and sessionStorage (see 5).
4. Cookies on app.bookable.be (the app) #
| Name | Where | Purpose | Duration | Category |
|---|---|---|---|---|
bk_session | app.bookable.be | staying signed in to the business's management area | 30 days | strictly necessary |
bk_tenant | app.bookable.be | which business is active when a user has several businesses | until the browser closes | strictly necessary |
bk_login_mail | path /inloggen | showing the email address on the "link sent" page, without putting it in the url | 10 minutes | strictly necessary |
bk_aanmelding | path of the sign up | finding a sign up in progress | 1 day | strictly necessary |
bk_start_mail | path of the sign up | showing the email address on the "link sent" page when signing up | 10 minutes | strictly necessary |
bk_start | path /start | a random id of the start, and the page and button through which someone came (first touch), for the count of sign ups per page. Nothing goes to third parties and no IP address is kept with it | 30 days, deleted after the business is created | functional (Bookable's own count) |
bk_taal | app.bookable.be and pages of businesses | remembering the chosen language, only set if the visitor chooses a language themselves | 1 year | strictly necessary (requested by the user) |
bk_mollie_state | path /api/mollie | security when linking Mollie (check that the answer from Mollie belongs to this request) | 10 minutes | strictly necessary |
bk_meekijk | app.bookable.be | session when an administrator of Bookable looks along read only in a business | at most 60 minutes | strictly necessary |
bk_platform.* (including bk_platform.session_token) | Bookable's management area | staying signed in as an administrator of Bookable | at most 8 hours, signed out after 30 minutes without activity | strictly necessary |
bk_meting | under /start | a short cookie that passes an event (such as "account created") to the next page; without personal data | 5 minutes, deleted straight after use | functional |
_ga, _ga_V7T072JD1B | under /start | as on the website: measuring the sign up and following the move from the website to the app | at most 2 years | statistics, only after consent on bookable.be |
_clck, _clsk (Microsoft Clarity) and the Microsoft cookies MUID and CLID | under /start | seeing where the sign up goes wrong (clicks, scrolling, recordings of a visit); filled in fields are masked | _clsk 1 day, the others at most 1 year | statistics, only after consent on bookable.be |
The login library (Better Auth) may set additional technical cookies with the same prefix, for example while signing in with Google. Most cookies of the app are HttpOnly (not readable by scripts) and SameSite=Lax or Strict; in production they only travel over https.
5. Storage in the browser (not cookies) #
| Key | Where | Purpose | Duration | Content |
|---|---|---|---|---|
bk:<business> in sessionStorage | booking form of a business | keeping the chosen service and the moment when the page reloads, for example after the payment at Mollie | until the tab closes, deleted after the confirmation | choices of the customer (service, variant, extras, staff member, date, time, amounts), no personal data |
bk:<business>:poging in sessionStorage | booking form | finding a booking attempt in progress | until the tab closes, deleted after the confirmation | a technical key and a non reversible short fingerprint of the email address (never the email address itself) |
bk_herkomst in localStorage | bookable.be | remembering the origin of your first visit (utm data and click ids, referring site, first page, time) to know, when a request comes in, which campaign worked | until you delete it; only kept after consent for statistics or marketing | origin data, no name or email address |
bk-aanvraag in sessionStorage | bookable.be | passing a request you started on a page to the form on the home page | until the tab closes, deleted as soon as the form takes it over | chosen trade, desired moment, the way you want to start and, if you already filled it in, your email address |
What the customer fills in in the booking form (name, email, mobile number) stays only in the memory of the page.
6. Third party cookies #
- Mollie: paying takes place on Mollie's pages, which set their own cookies. Bookable loads no scripts from Mollie on its own pages.
- Google (signing in): signing in with Google takes place on a Google page, where Google sets its own cookies.
- Google Tag Manager and Google Analytics: loaded through the website and, under
/start, in the app. As long as you have not given consent, all consents for statistics and advertising are set to refused and Google places no cookies for them. As with any external script, Google does technically receive the IP address of your device when loading. - Microsoft Clarity: loaded through the website and, under
/start, in the app, only after consent for statistics. Clarity masks filled in fields and does not record them. - Google Maps: only on a few example pages of the website and only after consent for marketing.
- Widget on a business's website: the script
w.jsand the form in an iframe set no third party cookies for tracking; the cookies of the business's own website fall under the business.
7. Changes #
With every new cookie or service we update this overview and the privacy statement. If a new advertising service is added, such as a Meta pixel, we will first ask for consent in the banner.