Cookie policy
The cookies and browser storage COHESORA uses — all strictly necessary; no analytics or advertising.
Draft — not in force. Draft 0.1 · Not in force — no effective date has been set · Awaiting review by a qualified lawyer (UK data-protection and commercial law).
Cookies set by COHESORA
- cohesora_session — keeps you signed in. HttpOnly (not readable by scripts), Secure in production; ends after 30 minutes of inactivity and at most 12 hours after sign-in, or when you sign out.
- cohesora_csrf — a random value used to protect your account against cross-site request forgery. Same lifetime as the session.
Other browser storage
- The dashboard remembers, in your browser's local storage, that you dismissed the first-run checklist. It contains no personal data beyond the firm name in the key and never leaves your device.
What is not used
No analytics, advertising, tracking or third-party cookies are set by COHESORA. The public interactive demo sets no cookies at all. Because every cookie is strictly necessary for a service you asked for, no consent banner is shown; the INVICTT website (invictt.com) has its own cookie notice.
Decisions required before this can take effect
Matters for professional legal approval or for INVICTT AI to determine. They are deliberately not answered here.
- Confirm with counsel that both cookies are 'strictly necessary' under PECR as amended by the Data (Use and Access) Act 2025.
- Align with the invictt.com cookie notice.