This is a courtesy translation. The Italian version is the authoritative one.

This page explains which cookies and other tracking technologies we use on membrs.world and app.membrs.world, why we use them, how long they last, and how you can accept them, refuse them or change your mind.

It follows the Guidelines on cookies and other tracking tools of the Italian Data Protection Authority (Garante per la protezione dei dati personali, decision of 10 June 2021, doc. web no. 9677876), art. 122 of the Italian Privacy Code (Legislative Decree 196/2003) and Regulation (EU) 2016/679 (GDPR).

For everything concerning your personal data in general, see the Privacy Policy.

1. What cookies and other tracking technologies are

A cookie is a small text file a website stores in your browser and that the browser sends back on later visits. It exists to remember something: that you are logged in, that you prefer the dark theme, that you already dismissed a notice.

Cookies are not the only way to keep information on your device. Your browser also provides:

• localStorage — persistent browser memory tied to the site. It stays until you clear the site's data. Unlike cookies, it is not automatically sent to the server with every request.
• sessionStorage — the same thing, but it is emptied when you close the tab.

The Garante's guidelines of 10 June 2021 do not cover cookies alone: they cover "cookies and other tracking tools". localStorage and sessionStorage therefore belong in this notice exactly like cookies, and you will find them listed in the table in section 3, with the type of storage indicated.

We use four categories:

• Technical — without them the service does not work: login, session, security, and storing your own cookie choice. No consent required.
• Functional — they remember a preference you expressed yourself (language, theme, notices already dismissed). They do not profile.
• Analytics — they measure how the platform is used. In our case they are third-party and require your consent.
• Attribution — they identify the promoter whose link brought you here. They are not advertising cookies and they do not follow you across other sites.

We use no advertising, profiling or cross-site tracking cookies. We use no cookie wall: refusing does not prevent you from using the platform.

2. Who sets them

The data controller is:

Saba Events S.R.L. — Via di Salicchi, 711/X, 55100 Lucca (LU), Italy — VAT and tax code: 04726940234 (VAT number: IT04726940234). Contact: hello@membrs.world — certified email (PEC): sabaevents@pec.it.

Saba Events S.R.L. operates the membrs. platform and is the party that sets all the first-party cookies listed in section 3.

Besides us, these third parties are involved:

• Google Ireland Limited / Google LLC — Google Analytics 4. Sets third-party cookies only after your consent (section 4).
• Supabase Inc. — provides the authentication service. The sb-…-auth-token session cookie is generated by the Supabase library but written on our domain: for the purposes of this policy it is a first-party cookie.
• Stripe Payments Europe, Ltd. — payments. It sets no cookies on our domains: see section 5.

We have not appointed a Data Protection Officer (DPO): it is not mandatory for this processing. The contact point for any request is hello@membrs.world.

3. Full inventory

Three notes on the table:

• Service worker. We register a service worker on the site, but it exists solely to receive push notifications: it stores nothing and caches nothing.
• Mobile app. The native membrs. app uses no cookies and contains no analytics SDK and no crash-reporting tool. Session credentials are kept in the device's secure storage (Keychain on iOS, Keystore on Android).
• ops.membrs.world. This is our internal back office, accessible to Saba Events staff only: members cannot reach it and it is not covered by this policy.

4. Analytics and consent — how it actually works

We use Google Analytics 4 (measurement ID G-D5T4KPW9YW) to understand how the platform is used. Here is the exact behaviour, without the convenient simplifications:

1. Google's gtag.js script is loaded on every page, regardless of your choice.
2. Before gtag.js is even downloaded, an inline script sets Google Consent Mode v2 denying the four measurement and advertising signals: analytics_storage: denied, ad_storage: denied, ad_user_data: denied, ad_personalization: denied. The other three Consent Mode v2 signals — functionality_storage, personalization_storage and security_storage — stay at Google's default, meaning granted: they concern neither measurement nor advertising.
3. The practical consequence is that, until you accept, no analytics cookie is set and no identifier is stored on your device.
4. The script is nonetheless present on the page. Because of how Consent Mode works, Google may receive cookieless pings: transmissions with no persistent identifiers, which still contain technical request data such as IP address, user agent, page URL and browser language. This is why we do not write "nothing is sent until you accept": it would not be true. The previous version of this policy said so, and it was inaccurate.
5. If you accept, exactly one thing changes: analytics_storage becomes granted and Google sets the _ga and _ga_D5T4KPW9YW cookies. ad_storage, ad_user_data and ad_personalization stay denied permanently — we never turn them back on.
6. Measurement is configured with IP anonymization (anonymize_ip: true) and Google Signals disabled (allow_google_signals: false): no personalized advertising, no cross-device reporting, no advertising audiences.

What we measure. Product events only: signup, checkout start, purchase, event RSVP, door check-in, subscription cancellation, booking cancellation. The parameters of these events carry technical identifiers and amounts only (club id, plan id, payment session id, value, currency): never your name, email, phone number or any other directly identifying data.

No advertising, no profiling, no cross-site tracking. GA4 is the only third-party script loaded in the browser on our domains. Fonts are self-hosted: there are no calls to external CDNs.

5. Payments — Stripe sets no cookies on our domains

Stripe.js is never loaded on membrs.world or app.membrs.world.

When you subscribe, our server redirects you to the payment page hosted by Stripe (checkout.stripe.com); when you manage your subscription, it redirects you to Stripe's Billing Portal (billing.stripe.com). Your card details are entered on those pages and never pass through our servers.

The cookies Stripe uses — including for fraud prevention — are set on Stripe's own domains, while you are on those pages, and are governed by Stripe's Cookie Policy.

Explicit correction: the previous version of this notice stated that "Stripe sets cookies during checkout", implying this happened on our domains. It does not, and the wording has been corrected.

6. How to give, refuse and withdraw consent

6.1 The banner

On your first visit a banner appears at the bottom left with the short notice, a link to this page and two buttons: "Decline" and "Accept".

Until you choose, analytics cookies stay off. Continuing to browse, scrolling the page or closing the tab does not count as consent: we treat consent as given only if you press "Accept".

6.2 If you decline

Nothing bad happens. analytics_storage stays denied, no _ga cookies are set, no identifier is stored. Everything else on the platform — login, member card, bookings, payments — works exactly as before. The banner does not reappear.

6.3 How to withdraw consent, today

This needs to be stated precisely, because the mechanism is cruder than it should be.

Your choice is saved in your browser's localStorage, under the key membrs_analytics_consent, and the banner stays hidden as long as that value exists. There is currently no "manage cookie preferences" control on the site that reopens the banner.

To change your mind you therefore have to clear the site's data for membrs.world and app.membrs.world in your browser settings: on your next visit the banner will reappear and you can choose again. Two warnings:

• clearing the site's data also clears the session cookies, so you will be logged out and will have to sign in again;
• if you only want to stop measurement, you can just delete the _ga and _ga_D5T4KPW9YW cookies, but your consent will remain recorded and the cookies will be set again on your next visit.

Alternatively you can install the Google Analytics opt-out browser add-on, which blocks measurement on every site using Google Analytics.

We are working on a permanent control to review your choices: until then, the method described above is the real one, and we would rather tell you than hide it.

6.4 Browser settings

You can block or delete cookies directly from your browser, at any time:

• Google Chrome
• Apple Safari
• Mozilla Firefox
• Microsoft Edge

You can also enable the Do Not Track signal or your browser's anti-tracking protections: in any case we run nothing that tracks your behaviour outside this site.

6.5 Warning: strictly necessary cookies cannot be turned off

If you block strictly necessary cookies, the platform stops working. Specifically:

• without sb-iosospebyczpzcplxcgw-auth-token you do not stay authenticated: every private page will send you back to the sign-in screen;
• without the PKCE verifier, sign-in with Google or Apple fails;
• without session cookies you cannot complete checkout or manage your subscription.

These cookies have no technical alternative and require no consent, but they do not circumvent it either: they exist only to deliver the service you asked for.

7. Legal basis

• Technical cookies and equivalent tools — art. 122(1) of the Italian Privacy Code (Legislative Decree 196/2003), which exempts them from consent and requires only this notice. This covers session and authentication cookies, the PKCE verifier, the membrs-cookie-migration marker, the membrs-active-context role context and the storage of your own choice (membrs_analytics_consent): recording a refusal would be impossible without keeping it somewhere.
• Functional cookies (membrs-theme, membrs_lang, membrs-push-declined, membrs-onboarding-seen-*) — we treat them as technical because they hold nothing but a preference you expressed yourself, contain no identifiers, do not profile and are disclosed to no one.
• GA4 analytics cookies — consent, under art. 122 of the Italian Privacy Code and art. 6(1)(a) GDPR. We do not rely on the exemption the Garante's 10 June 2021 guidelines grant to analytics that can be treated as technical cookies: that exemption presupposes, among other things, that the data is not accessible to the third party for its own purposes, and with Google Analytics 4 this condition cannot be verified. We therefore make them subject to your prior consent, withdrawable at any time (section 6.3), and keep them configured with anonymized IP and advertising signals disabled.
• membrs_pr — this deserves an honest note. It is not an advertising cookie: it is first-party, it holds an eight-character code only, it does not profile, it does not follow you across other sites and it is not passed to anyone for marketing purposes. It exists to recognise, at signup, the promoter whose link brought you here, so that the referral can be credited to them. Today it is set the moment you open that link, without a separate consent request, because we consider it instrumental to the request you yourself made by opening that link. This classification is under review: in the meantime you can delete it from your browser settings at any time, with no effect on your membership.

We carry out no profiling and no automated decision-making through cookies. We use no cookie wall: access to the site and to the service is never conditional on accepting analytics cookies.

You have the right to lodge a complaint with the Italian Data Protection Authority, Garante per la protezione dei dati personali (www.garanteprivacy.it).

8. Third-party notices

• Google — Privacy Policy · How Google uses cookies · How Google Analytics safeguards data
• Stripe — Privacy Policy · Cookie Policy
• Supabase — Privacy Policy

9. Changes and contact

We update this notice whenever the platform's behaviour changes: if we add, remove or modify a cookie, the table in section 3 is updated together with the code. Material changes — a new category or a new third-party tool — mean the banner is shown again and consent is collected afresh.

For questions, requests or reports about this policy: hello@membrs.world.

For the full picture of which personal data we process, for which purposes, who we share it with and how long we keep it, see the Privacy Policy.

10. Data controller

Saba Events S.R.L. Via di Salicchi, 711/X — 55100 Lucca (LU), Italy VAT and tax code: 04726940234 (VAT number: IT04726940234) PEC: sabaevents@pec.it — SDI recipient code: 9SUB64Q Email: hello@membrs.world

Saba Events S.R.L. is the provider of the membrs. platform, the seller of the memberships and the data controller.