Cookie policy

1. Purpose

This page explains how MB360 handles cookies and similar trackers on the public site and in the application.

2. Strictly necessary cookies

• next-auth.session-token, next-auth.csrf-token, and next-auth.callback-url support authentication and security.
• The next-intl locale cookie stores your display language.
• The mb360_consent cookie stores your consent choice for 180 days.

These cookies remain active because they are required for the service to work.

3. Optional categories

The Audience measurement and Advertising and conversions categories remain disabled until an explicit choice is made.

Google Ads is currently the only third-party client-side marketing tag implemented. The Google Ads tag loads only on public marketing pages after explicit consent to the Advertising and conversions category. It does not load on /cookies, on /signup, or inside the private app boundary.

With that same consent given on the public site, MB360 also sets the first-party mb360_acq cookie (30 minutes, domain monbureau360.fr, shared by the site and app.monbureau360.fr). It holds only normalized acquisition dimensions: the campaign parameters of the link (source, medium, campaign, content, term, campaign ID) or, failing those, the search engine name (organic search), only the domain name of the referring site (referral), or "direct / unknown", plus the landing page; for a visit from a Google Ads ad, an encrypted seal of the click identifier that only MB360 can decrypt, never the raw identifier. The full address of the referring page is read in your browser only for this immediate classification: it is neither stored nor transmitted. Navigating between MB360 pages creates no new origin. Your browser may send this cookie to the app before you make a choice on that host; the app uses it only after your consent on that host, then deletes it.

Linking this origin to your organization and sending the first confirmed paid subscription to Google Ads from MB360's servers is a processing operation separate from the Google Ads tag in your browser; it is described in the Privacy Policy.

The Audience measurement category remains inactive in this release. If you withdraw consent, MB360 blocks new marketing reads and writes, deletes the mb360_acq cookie and attempts to clear first-party Google Ads cookies that were already set whenever that is technically possible.

4. Technical monitoring

Sentry error monitoring remains classified as necessary. Session Replay is disabled in this release.

5. Change your choice

Use the Cookie settings link in the footer to reopen the preference panel.

Changing your choice blocks new deposits and reads by our tools. You can also remove cookies already present through your browser settings.

6. Third-party services

During authentication, Google may place its own cookies on accounts.google.com. Those cookies are governed by Google's own policy, not directly by MB360.

7. International transfers

Strictly necessary cookies are processed inside the European Union: the MB360 backend is hosted in France (Google Cloud, europe-west9 region, Paris).

Data in the Advertising and conversions category (the Google Ads tag and the server-side transmission of a confirmed conversion), processed only after your explicit consent, goes to Google acting as an independent controller: for European users, Google Ireland Limited (Ireland). Under Google's applicable controller terms, this initial transfer does not require controller-to-controller Standard Contractual Clauses; Google may make onward transfers, including to the United States, under its own terms and safeguards. The mb360_acq cookie is an MB360 first-party cookie and is not sent to Google.

If you refuse or withdraw your consent, no advertising cookie is set and no such transfer takes place.

8. Contact

For any question about this policy: contact@monbureau360.fr.