Skip to content
Sotto Pizzeria
Order

Cookie Policy

Cookie Policy

What cookies we use and how you can manage them.

Sotto Pizzeria uses cookies and similar technologies on this website to support site functionality, user experience and marketing. This policy explains which of them we use, for what purpose and for how long, and how you can manage them.

What cookies are

Cookies are small text files that a website stores on your device. They enable basic site functions and help us understand how the site is used.

In addition to cookies, the site uses your browser's storage: localStorage keeps data until it is deleted, and sessionStorage is cleared when you close the tab. We describe these below in the same way as cookies. First-party cookies are stored under the sotto.fi domain, even when a script from, for example, Google sets them. Third-party cookies are stored under another service's domain, such as doubleclick.net.

Cookie categories we use

The categories are the same as in the cookie panel: Necessary, Analytics and Marketing. The duration shown is the maximum, and for many cookies it starts again on every visit. Your browser may shorten it: for example, Chrome limits cookies to 400 days at most and Safari limits some cookies to 7 days. Providers may change the names and durations of their cookies. The list reflects the situation on 3.11.2026.

Necessary (always on)

Necessary cookies and stored data are needed for the site's basic functions, such as your language choice, forms and remembering your cookie choice. They cannot be switched off and do not require consent.

  • sotto-cookie-consent (Sotto Pizzeria, localStorage) — remembers your cookie choice, that is, the categories you allowed and the version and time of your choice. Duration: 12 months from your choice, after which we ask again; the record stays in your browser until you make a new choice or clear the site data.
  • sotto-mktg-consent (Sotto Pizzeria, cookie) — tells our server your marketing choice, so that our server sends events to Meta only if you have allowed marketing. Duration: 12 months from your choice (expires together with it).
  • NEXT_LOCALE (Sotto Pizzeria, cookie) — remembers the language you chose; set only when you switch language. Duration: until you close the browser.
  • sotto-language-bar-dismissed (Sotto Pizzeria, localStorage) — remembers that you closed the language bar, so that it does not appear again. Duration: until you clear the site data.
  • sotto-preferred-restaurant-slug (Sotto Pizzeria, localStorage) — remembers the restaurant you chose, so that the Order button takes you straight to its online shop. Duration: until you choose another restaurant or clear the site data.
  • sotto-pending-order-context (Sotto Pizzeria, sessionStorage) — keeps the menu item you picked while you choose a restaurant. Duration: until you close the tab (deleted as soon as it has been used).
  • sotto:check-delivery:v2:… (Sotto Pizzeria, sessionStorage) — keeps the result of the delivery area check on the group order form, so that the same address is not checked again; the name contains the address you typed. Duration: until you close the tab.
  • sotto-chat-history (Sotto Pizzeria's Giuseppo chat, localStorage) — keeps the last 20 messages of your conversation, so that it continues when you move between pages; only if you use the chat. Duration: until you select Clear chat.
  • sotto-chat-session (Sotto Pizzeria's Giuseppo chat, localStorage) — a random identifier for the conversation, which our server uses to keep the messages in the same conversation; only if you use the chat. Duration: until you select Clear chat.
  • cf.turnstile.u (Cloudflare Turnstile, localStorage in Cloudflare's challenges.cloudflare.com frame) — protects forms against spam and bots; loads when a form comes into view (including the newsletter form at the bottom of the page). Duration: not stated by Cloudflare (kept until you clear your browser data).

Analytics (only with consent)

Analytics cookies help us understand how the site is used, so that we can improve it. The data is collected pseudonymously: your browser is given a random identifier.

  • Google Analytics 4 (Google) — visitor numbers, page views and the most popular content (data kept for 14 months)
  • Microsoft Clarity (Microsoft) — heatmaps and session recordings to improve the user experience: they show us, for example, clicks and scrolling. Text you type in forms and the chat is masked. Recordings are kept for 30 days (recordings marked separately for up to 13 months) and heatmaps for 13 months. Clarity is not given permission for advertising storage, so it does not set Microsoft advertising cookies.

Analytics cookies and stored data:

  • _ga (Google Analytics 4, cookie) — distinguishes browsers with a random identifier; also read for recording gift card purchases and group order payments (see below). Duration: 2 years.
  • _ga_VGMHM5D9EX (Google Analytics 4, cookie) — keeps track of the state of your visit (session); also read for recording gift card purchases and group order payments. Duration: 2 years.
  • _clck (Microsoft Clarity, cookie) — Clarity's user identifier and settings. Duration: 1 year.
  • _clsk (Microsoft Clarity, cookie) — combines the page loads of one visit into a single recording. Duration: 1 day.
  • _cltk (Microsoft Clarity, sessionStorage) — identifier for the browser tab. Duration: until you close the tab.

If you have allowed analytics cookies and buy a gift card, our server records the purchase (amount, whether it is a gift, language and order reference) in Google Analytics 4 under the same identifier that the GA4 cookie gave your browser. A group order payment is recorded in the same way (amount, whether it was paid on the order page or by payment link, language and order reference) if you had allowed analytics cookies when you sent the group order form. Without analytics consent, nothing is sent.

In addition, the site stores a few of its own measurement markers in your browser, but only with your consent. Without consent, the markers are kept only in the memory of the open page and disappear when you close the tab or the page fully reloads. The markers contain no identifier and do not leave your device except as described below:

  • sotto:landingPage (Sotto Pizzeria, sessionStorage) — the first page you opened on the site; attached to a form only if you send one (see the privacy policy); stored only with analytics consent. Duration: until you close the tab.
  • sotto:storefront-click-at, sotto:early-order-click (Sotto Pizzeria, sessionStorage) — the time and details of an order click, so that the click is counted exactly once; stored with analytics or marketing consent. Duration: until you close the tab (the marker is valid for 10 minutes).
  • sotto-chat-conversation-tracked (Sotto Pizzeria's Giuseppo chat, localStorage) — a marker showing that the start of the conversation has already been counted; stored only with analytics consent. Duration: until you select Clear chat.

Marketing (only with consent)

Marketing cookies enable targeted advertising and measuring the results of advertising. We can see which ads bring visitors and orders to the site, and we can show Sotto Pizzeria ads to people who have visited it. Only active if you allow marketing.

  • Meta Pixel and Conversions API (Facebook and Instagram) — advertising for Sotto Pizzeria restaurants and measuring its results
  • TikTok Pixel — advertising for Sotto Pizzeria restaurants and measuring its results
  • Google Ads — measuring the results of Google ads and showing ads to people who have visited the site
  • Google Floodlight (Campaign Manager 360) — measuring the results of advertising campaigns

Marketing cookies and stored data:

  • _gcl_au (Google Ads and Google Floodlight, cookie) — connects ad clicks with the orders or enquiries that follow them. Duration: 90 days.
  • _gcl_aw, _gcl_dc, _gcl_gb, _gcl_gs, _gcl_ag (Google Ads and Campaign Manager 360, cookie) — store the ad click identifier when you arrive at the site from a Google ad. Duration: 90 days.
  • _gcl_ls (Google Ads and Google Floodlight, localStorage) — counters and short-lived identifiers for conversion measurement. Duration: 90 days.
  • IDE (Google Floodlight, third-party cookie on doubleclick.net) — advertising and measuring ad results. Duration: 13 months.
  • test_cookie (Google, third-party cookie on doubleclick.net) — checks whether your browser accepts cookies. Duration: 15 minutes.
  • _fbp (Meta Pixel, cookie) — browser identifier for measuring and targeting ads; our server also attaches it to Conversions API events. Duration: 90 days.
  • _fbc (Meta Pixel, cookie) — ad click identifier when you arrive from a Facebook or Instagram ad. Duration: 90 days.
  • lastExternalReferrer, lastExternalReferrerTime (Meta Pixel, localStorage) — whether you last came from Facebook, Instagram, elsewhere or directly, and when. Duration: 90 days.
  • _ttp (TikTok Pixel, cookie) — browser identifier for measuring and targeting ads. Duration: 90 days.
  • _ttp (TikTok, third-party cookie on tiktok.com) — TikTok's own browser identifier on its own domain, for measuring and targeting ads. Duration: 90 days.
  • ttcsid, ttcsid_D5NO33JC77U1NP0L66J0 (TikTok Pixel, cookie) — visit identifiers. Duration: 90 days.
  • ttclid (TikTok Pixel, cookie) — ad click identifier when you arrive from a TikTok ad. Duration: 1 day.
  • _tt_enable_cookie (TikTok Pixel, cookie) — checks whether your browser accepts cookies. Duration: 90 days.
  • tt_sessionId, tt_pixel_session_index, tt_appInfo (TikTok Pixel, sessionStorage) — the pixel's visit and platform details. Duration: until you close the tab.
  • _fbleid (Meta Pixel, cookie) — an event identifier for measuring ad results, which the pixel may set when you have arrived from a Facebook or Instagram ad and click, for example, an order button. Duration: 7 days.

If you allow marketing, Google Analytics data may also be used in Google advertising, for example to show ads to people who have visited the site (Google signals). In some situations, these services may also set or read other cookies of their own on their own domains, for example if you are signed in to their services: Google's NID (valid for 6 months from last use), DSID (2 weeks) and ar_debug, and Meta's fr (90 days). Google does not state how long the ar_debug cookie lasts. More information: how Google uses information from sites that use its services.

When you have allowed marketing and send the contact, franchise or group order form or subscribe to the newsletter, our server also reports this directly to Meta (Conversions API). The report contains your email address in hashed form (SHA-256), and your phone number and name if you gave them, plus your IP address, browser details, the page address, the type of form and Meta's identifiers _fbp and _fbc. For a group order, the order value is also included. Meta compares the hashes with its own user data to measure the results of ads. Our server may also report to Meta when you open the details of a menu item or search for the nearest restaurant, but then without contact details. Without marketing consent, our server sends nothing to Meta.

When you have allowed marketing and send a form, the Google tag may detect the email address, phone number and address you typed in the form and send them to Google in hashed form (SHA-256), so that Google Ads and Campaign Manager 360 can measure ad results more accurately (enhanced conversions). Without marketing consent, this data is not sent.

Online shop and payments

When you go on to order, you move to the online shop run by Wolt Oy at order.site. Wolt asks for its own cookie consent there, and Wolt's own cookie policy applies. The choice you make on sotto.fi does not carry over to the online shop.

If you allow it in Wolt's cookie panel, Sotto Pizzeria's Google Analytics, Google Ads and Meta Pixel tags also work in the online shop, so that we can measure orders and the results of our advertising. A Google measurement parameter, _gl, may be added to the link to the shop, so that an order placed there can be connected to your visit on sotto.fi.

Online payments for gift cards and group orders are made on Stripe's payment page or in Stripe's payment form embedded on our order page. Stripe uses its own cookies, for example for payment security and fraud prevention. The embedded payment form may store Stripe's strictly necessary cookies (__stripe_mid, __stripe_sid) on sotto.fi. They are needed to complete the payment, so no consent is requested for them.

Measurement without cookies

The following measurements also work before you choose and after you have rejected cookies. They do not use cookies or store anything on your device, but your browser sends the details described below. The legal basis is our legitimate interest in keeping the site working, improving it and assessing the results of our marketing (see the privacy policy).

Google tags without consent (Consent Mode)

Google Analytics, Google Ads and Google Floodlight load on the page through Google Tag Manager even when you have not allowed them. In that case they do not store or read cookies but send Google cookieless signals instead (the so-called advanced mode of Google Consent Mode). A signal reports, for example, that a page loaded, that you scrolled, what you chose in the cookie panel or that you clicked an order button. It contains the page address and referring page, the time, basic browser and device details, the status of your cookie choice and whether you arrived via an ad. As with any web request, Google also receives your IP address. The signals contain no persistent identifier: they only carry a random identifier that is not stored on your device and lasts no longer than your visit, so different visits cannot be linked to the same browser. Google uses the signals to estimate visitor and conversion numbers statistically.

If you arrive at the site via an ad, the ad click identifier (for example gclid) is in the page address and travels with it from one page to the next, so that the result of the ad can be measured without cookies. If you have not allowed marketing, Google Ads and Google Floodlight remove the identifier from the signals they send. In Google Analytics signals, it may be included as part of the page address.

Vercel Web Analytics and Speed Insights

Vercel, the company that hosts the site, counts page views and measures page loading speed for all visitors. Vercel receives the page address and referring page, the country, device type, operating system and browser, the loading speed measurements and the type of network connection (for example 4G). Vercel recognises page loads by the same visitor using a hash calculated from the request, which is discarded within 24 hours. The data is stored without identifiers and is not linked to you.

Cookie panel choice counter

To improve the cookie panel, we count how many times it was shown and what was chosen in it (Accept all, Reject or Save choices). Your browser sends our server only the event, the version of the panel and the situation in which it was shown (for example whether you were asked for the first time or again), the device type (phone or computer, based on the width of the browser window) and the page language. Only daily totals are stored. The counter does not use cookies or browser storage, and it does not store your IP address, browser details or any other identifier, so individual visitors cannot be identified. The daily totals are deleted after 400 days.

Error reports (Sentry)

If a technical error occurs on a page, your browser sends an error report to the Sentry service, which stores the data in the EU. The report contains details of the error, the page address, browser details and the events on the page that preceded the error, such as navigation and clicks. We do not attach your IP address, cookies or anything you have typed in forms.

Giving and withdrawing consent

When you first arrive at the site, a cookie panel, “May we use cookies?”, opens at the bottom of the page. You can choose:

  • Accept all — you allow analytics and marketing
  • Reject — only necessary cookies are used
  • Customise — you choose analytics and marketing separately and save your choice (Save choices) or reject both (Reject all). The categories are off to begin with.

Before you choose, we do not use analytics or marketing cookies or any related browser storage. This applies to all visitors, whichever country you browse the site from. Google's tags then send only cookieless signals (see Measurement without cookies). The panel stays visible until you make a choice.

Your choice is stored in your browser (sotto-cookie-consent and sotto-mktg-consent) and is valid for 12 months, after which we ask again. We also ask again if our use of cookies changes so that your earlier choice no longer covers it.

You can review and change your choice at any time with the Cookie settings button at the bottom of the page. It opens the same panel and shows your current choice. When you withdraw consent, that is, choose Reject or Reject all, or switch a category off and choose Save choices, the Google tags of the withdrawn category then send only cookieless signals, and the Meta and TikTok pixels (marketing) and Microsoft Clarity (analytics) are stopped if they have already loaded on the page. At the same time, the site deletes the cookies and browser storage of the withdrawn category from the sotto.fi domain, including our own measurement markers, and reloads the page once. TikTok's ttclid cookie, however, is only removed when its one-day duration ends. If you are filling in a form on the page, the page is not reloaded, so that what you have typed is not lost, but the tags are still stopped and the stored data deleted. Withdrawal takes effect from that point on and does not delete data that has already been sent to the services.

The site cannot delete third-party cookies stored under other services' domains, such as the IDE cookie on doubleclick.net or the _ttp cookie on tiktok.com. They are removed when they expire, or you can delete them straight away in your browser settings. If you clear the sotto.fi site data in your browser, your choice is deleted and the panel asks again.

Browser cookie settings

If you wish, you can block or delete cookies from your browser settings. In that case, some parts of the site may not function normally.

More information

Also read our privacy policy. You can send questions about cookies to info@sotto.fi.

Policy last updated: 3.11.2026

Order now →