Cookie Policy
What we store on your device, and why.
1. Which website are you on?
Two different situations, with different answers.
A. The Postlyo website or dashboard
Sections 2–5 apply. We use only strictly necessary cookies — no analytics, no advertising, no profiling.
B. A website built by one of our customers
That site’s operator decides what runs there. They may have enabled analytics or advertising that we do not control and do not receive. Their cookie notice governs, not this one. Section 6 explains what may be present.
2. What cookies are
A cookie is a small text file placed on your device by a website. “Similar technologies” include local storage, session storage and pixels, which serve comparable purposes. Where this Policy says “cookies”, it means all of them.
Cookies are first-party (set by the site you are visiting) or third-party (set by another domain), and session (deleted when you close your browser) or persistent (kept until they expire or you delete them).
3. Cookies we set
3.1 Strictly necessary
These are required to deliver the Service. Without them you cannot sign in or stay signed in. They do not require consent, because they are essential to a service you have requested, and they are not used for advertising or cross-site tracking.
| Name | Type | Purpose | Duration |
|---|---|---|---|
access_token | First-party, HTTP-only cookie | Keeps you authenticated during your session | Short-lived; refreshed during active use |
refresh_token | First-party, HTTP-only cookie | Renews your session without asking you to sign in repeatedly | Expires on logout, session expiry, or password change |
pending_subscription_id | Session storage | Preserves your place in checkout so a payment can be matched to your account | Cleared when checkout completes or the tab is closed |
debug | Local storage | Set only if you deliberately enable verbose diagnostics; contains no personal data | Until you clear it |
Authentication cookies are set with the HttpOnly and Secure attributes and an appropriate SameSite value, so they cannot be read by page scripts and are only sent over encrypted connections.
3.2 Analytics, advertising and preference cookies
We set none
At the date of this Policy, the Postlyo marketing site and dashboard set no analytics, advertising, or profiling cookies whatsoever. If that ever changes, we will publish the details here and obtain your consent before deploying them.
4. Your choices
Because we set only strictly necessary cookies on our own properties, there is nothing to opt out of without breaking sign-in. If you block them, you will not be able to use the dashboard.
You can still control cookies through your browser: most browsers let you view, delete and block cookies, and offer a private-browsing mode. See your browser’s help pages.
5. Do Not Track
There is no industry consensus on how to interpret browser “Do Not Track” signals, and we do not currently respond to them. We do honour Global Privacy Control signals where transmitted.
6. Cookies on customer sites
A site built on Postlyo may set additional cookies because its operator chose to enable them. We do not enable these by default and do not receive the data they collect.
| Technology | When it appears | What it does | Controlled by |
|---|---|---|---|
| Google Analytics (GA4) | Only if the site operator has entered a measurement ID | Measures traffic and visitor behaviour; sets analytics cookies | The site operator (and Google) |
| Google AdSense | Only if the site operator has enabled advertising and supplied a publisher ID | Serves advertising and may personalise it based on browsing activity | The site operator (and Google) |
| Session / preference storage | On sites offering reader accounts or comments | Keeps a reader signed in, or remembers a display preference | The site operator |
6.1 If you are a visitor
Look for the cookie notice and privacy policy on the site you are visiting, and direct your questions and rights requests to that site’s operator. If you cannot identify them, contact privacy@postlyo.com and we will try to route your request.
6.2 If you are a customer — your obligations
This is the highest-risk area for our customers, and the responsibility is yours
If you enable analytics or advertising on your site, you become responsible for deploying it lawfully. In the EEA, the UK and a growing number of other jurisdictions, that means:
- Obtain prior consent before any non-essential cookie is set or read. Consent must be freely given, specific, informed and unambiguous. Pre-ticked boxes and “by continuing you agree” banners do not qualify.
- Make rejection as easy as acceptance — a “Reject all” control of equal prominence, at the first layer of the banner.
- Do not fire the tags until consent is given. A banner that appears after analytics has already loaded provides no protection.
- Allow withdrawal of consent at any time, as easily as it was given.
- Keep a record of the consents you obtain.
- Publish your own cookie notice listing the cookies actually in use on your site.
- Comply with Google’s EU User Consent Policy if you use Google Analytics or AdSense. This is a contractual requirement Google imposes on you, independent of the law, and it requires a compliant consent management platform with Consent Mode for EEA and UK traffic.
- Do not enable behavioural advertising on sites directed at children.
We provide legal page templates as a convenience. They do not obtain consent for you, and a policy page is not a consent mechanism. Deploying a consent management platform on your site is your responsibility.
Failure to comply is a breach of our Acceptable Use Policy and exposes you — not Postlyo — to action from your own supervisory authority.
7. Changes
We will update this Policy when our use of cookies changes, and revise the “Last updated” date. If we introduce non-essential cookies, we will obtain consent before doing so.
8. Contact
Questions about this Policy: privacy@postlyo.com. See also our Privacy Policy.
This document is provided in English. If we publish a translation and there is a conflict, the English version governs unless local law requires otherwise.