Cookie Policy · Cannabis Institute

English translation for convenience; the Polish version prevails.

§ 1 GENERAL PROVISIONS

This Cookie Policy sets out how cookies and similar technologies are used in the Cannabis Institute website and the Medical portal (together the "Service"). The Service is run by Carborating spółka z ograniczoną odpowiedzialnością (a Polish limited liability company) with its registered office in Poznań, operating under the Cannabis Institute brand (the "Controller"), whose details are given in the Privacy Policy.
The Service uses cookies and similar technologies, in particular browser local storage. They are governed by Art. 399 of the Polish Electronic Communications Law, which requires clear and comprehensible information about the purpose of storing or accessing information on the user's terminal equipment.
Cookies are small text files saved on the User's device and read on later visits. Browser local storage keeps data only on the User's device and does not send it to the Service automatically.

The following categories are used:
- 1.1. necessary — they make the Service work. They cover:
  - sign-in and session security;
  - the choice of portal and Profile, which determines access to content for specific audiences;
  - remembering consent settings.

No consent is needed;

1.2. functional (preferences) — they remember the User's choices, such as language, theme and tool settings. They are used because they are needed to provide the service in the way the User asks;
1.3. analytics and statistics — usage statistics, only with consent. At the effective date of this Policy, the Service uses none;
1.4. marketing — ads tailored to the User's behaviour, only with consent. At the effective date of this Policy, the Service uses none.
By lifetime, the Service uses:
- "session" files, kept until sign-out or until the browser is closed;
- "persistent" files, kept for the time set in their parameters or until the User deletes them.

Name	Purpose	Lifetime
`sb-…-auth-token`	signed-in session (Supabase Auth)	until sign-out or session expiry
`wcn_portal`, `wcn_audience`	chosen portal (Cannabis Institute / Medical) and Profile	1 year
`wcn_view_as`, `wcn_view_portal`	preview mode for testers and administrators	session
`wcn_consent`	the User's cookie choices	6 months
`wcn_entry`	acceptance of the entry statement (educational purpose, adult)	1 year

Name	Purpose	Lifetime
`wcn_lang`	interface and translation language	1 year
`wcn_theme`	light or dark theme	1 year
`wcn_filters`	filter panel state	1 year
`wcn_map_country`	map home country	1 year

Key	Purpose
`wcn_cart_v1`	Equipment Catalogue cart
`wcn_compare_v1`, `wcn-med-compare`	product comparison lists
`wcn_patient_diary_v1`	Diary in local mode — health data stay only on the User's device
`wcn_patient_visit_v1`	visit preparation
`wcn_twin_quality`, `wcn_twin_cards_v2`, `wcn.twin.*`, `wcn:map-projection`, `wcn:strains-columns`, `wcn-course-theme`	tool settings (3D quality, layout, feed plan, map projection, table columns, course theme)

Payment operators (Przelewy24, Stripe) and sign-in providers (Google, Apple) use their own cookies on their pages, which the User visits to pay or sign in. Their own policies apply.

On entering the Service, the User can choose the categories they consent to. They can change or withdraw consent at any time using the consent tool in the footer ("Cookie settings"). Withdrawing consent is as easy as giving it.
The User can also use browser settings to block or delete cookies and local storage. Restricting necessary cookies may prevent some functions from working, in particular sign-in. Clearing local storage also deletes Diary entries kept in local mode.
The Controller keeps proof of cookie consent (date, scope and version) to demonstrate compliance, under Art. 6(1)(c) and (f) GDPR.
If the Controller introduces analytics or marketing cookies, it will ask for consent before using them and update this Policy.