Essential cookies, optional website analytics, and how to control your choices.
Last updated: 20 October 2026
The website uses Auth.js (NextAuth) cookies for session management and sign-in security. The names below are the defaults for our HTTPS website. Temporary cookies are only set when a sign-in flow needs them. Local development over HTTP may use the same names without the secure prefixes.
Keeps you signed in and securely associates requests with your account. It is set after authentication. Large sessions may be split into numbered cookie chunks.
Duration: Up to 30 days under the current Auth.js session settings. Activity can refresh the expiry.
Supports cross-site request forgery protection for authentication requests.
Duration: A browser-session cookie; Auth.js clears or replaces it as needed.
Temporarily remembers the permitted page to return to after sign-in.
Duration: A browser-session cookie; it is replaced or cleared as the sign-in flow requires.
Temporary checks used when an identity provider supports the corresponding OpenID Connect or OAuth security flow. They help ensure the sign-in response belongs to the request you started.
Duration: Only during the sign-in flow; these checks expire after 15 minutes and are cleared when used.
Cookie rules can also apply to local storage. We remember your accept or reject choice in the essential local-storage entry privalyx_consent_v2 for 180 days. We ask again after it expires or if you clear site data. Optional analytics is off until you accept; rejecting it does not prevent you from using the website or sending an enquiry.
When analytics is enabled on this deployment and you accept, our analytics service provider receives approved public page paths, campaign labels, demo and booking-link clicks, form-start and successful enquiry events, broad device category, session landing page, referring website domain (not its path or query), and whether a page accumulated 30 seconds of visible, focused time. This is an engagement estimate, not proof that the visitor read the page. The local-storage entry privalyx_analytics_v1 holds a random browser identifier, a visit-session identifier, activity time, session landing page, referring website domain and first/latest campaign labels. It expires with the consent choice, no later than 180 days after it is created. This lets us understand journeys and returning visits in the same browser. A new visit session begins after 30 minutes of inactivity.
We do not send form contents, names, email addresses, phone numbers, account identifiers, full URLs or unlisted contact-page tokens to analytics. Authentication, account and unlisted digital-profile routes are excluded. We do not use advertising pixels, session replay, automatic capture of all interactions, or cross-device identification.
If you choose Microsoft, Google or LinkedIn to sign in, or follow a link to Microsoft Bookings, those providers may use cookies on their own services and domains. Their cookie and privacy terms apply there; those cookies are not set by the Privalyx website.
Use to accept or reject optional analytics at any time. Withdrawal stops future collection and removes this browser's analytics identifier and campaign storage; it does not delete events already sent. See the Privacy Policy for retention and deletion requests. If browser storage is unavailable, analytics remains disabled.
You can also clear or block cookies and local storage through your browser settings. Blocking essential cookies may prevent sign-in, account security checks, or returning to the page you requested. Auth.js cookie names and options may change if we change our authentication configuration; this page will be updated if our cookie use changes materially.
For information about our broader handling of personal information, read the Privacy Policy. Questions can be sent to support@privalyx.com.
Privalyx