Reviewer's note (delete before publishing): this policy now covers the platform only. The public marketing website runs Google Analytics and needs its own separate cookie notice and consent banner — see the status document. Placeholders in square brackets must be completed.
Scope
This policy covers cookies and all similar technologies — including localStorage, sessionStorage, IndexedDB, cache storage and service workers. UK PECR reg. 6 and the EU ePrivacy Directive Art. 5(3) are technology-neutral: they govern storing information on, or accessing information stored in, your device, whatever the mechanism. Cookies are simply the best-known example.
This policy covers the Yone platform — the authenticated product — only. Our public marketing website is operated separately and has its own cookie notice at [LINK — that notice still needs to exist]. Nothing described below applies to that site, and nothing on that site applies here.
1. Overview
Our approach is deliberately minimal.
The platform stores only what it needs to work: two cookies for login and security, and browser storage for session state, your interface preferences, and a cache of unsaved drafts.
| Strictly necessary | Analytics | Advertising / profiling |
|---|---|---|
| Yes — cookies and browser storage | None | None |
There is no analytics, advertising or tracking technology of any kind inside the platform.
Why no consent banner appears inside the platform: everything the platform stores is strictly necessary to deliver a service you have explicitly requested, which is exempt from consent under UK PECR and the EU ePrivacy Directive.
2. What the Platform Stores
2.1 Authentication cookies
Two cookies work together to keep you signed in: a short-lived access token, and a longer-lived refresh token that silently renews it while you're active. There is no separate CSRF-protection cookie — cross-site request forgery protection comes from the SameSite=Strict attribute on both cookies below, not from a distinct token.
Access token
| Attribute | Detail |
|---|---|
| Name | access_token |
| Mechanism | httpOnly, Secure, SameSite=Strict cookie |
| Type | Strictly necessary |
| Duration | 30 minutes from issue — renewed automatically roughly every 25 minutes while you keep the platform open in your browser |
| Data stored | An encrypted, signed session token — no personal data readable from the cookie itself |
| Party | First party |
Refresh token
| Attribute | Detail |
|---|---|
| Name | refresh_token |
| Mechanism | httpOnly, Secure, SameSite=Strict cookie |
| Type | Strictly necessary |
| Duration | 7 days from issue, reissued (rotated) eachtive session renews indefinitely as long as you returnwithin any 7-day window. If you close the platform and don't return within 7 days, you'll need to log in again. |
| Data stored | An encrypted, signed session token — noom the cookie itself |
| Party | First party |
The session tokens above are held in httpOnly cookies, which means scripts running in your browser cannot read them. They are never stored in browser storage.
2.2 Language preference cookie
Remembers your chosen display language across visits.
| Attribute | Detail |
|---|---|
| Name | NEXT_LOCALE |
| Mechanism | Cookie (not httpOnly — readable by the platform's own scripts so it can apply your language choice) |
| Type | Strictly necessary — reflects a choice you act |
| Duration | 1 year, or until you change your language setting |
| Data stored | Your selected display language code onl |
| Party | First party |
2.3 Interface preferences — browser storage
Remembers how you've set parts of the interface up, so it looks the same next time.
| Attribute | Detail |
|---|---|
| Keys | diagram_drag_mode, ai_output_lang_{organisation id} |
| Mechanism | localStorage |
| Type | Strictly necessary — these record a choice you actively made |
| Duration | Until you clear it, or until you log out —logout |
| Data stored | Your process-diagram canvas navigation mode (pan or select), and your preferred AI response language for each organisation |
| you work in. No personal data beyond your own settings. | |
| Transmitted? | No — browser storage is not sent to our servers with each request |
2.4 AI assistant chat history — browser storage [IMPORTANT]
So your AI assistant conversation isn't lost if you refresh the page or close and reopen the platform, we cache the conversation text on your device.
| Attribute | Detail |
|---|---|
| Keys | org_chat_{organisation id} |
| Mechanism | localStorage |
| Type | Strictly necessary — the AI assistant relies osation available across page loads |
| Duration | Until you clear it, or until you log out — cleared automatically at logout |
| Data stored | The text of your AI assistant conversatrsonal data such as names and business contact detailsyou've referenced while chatting |
| Transmitted? | Not by this mechanism — conversation crocessing pipeline through the normal application whenyou send a message, not read from this local cache by any other party |
Please read this if you use a shared device. This cache sits on your own device rather than our servers, and is outside our infrastructure controls. We clear it automatically whogout function. If you close the browser tab withoutlogging out, this data may remain on the device until your next login or until you clear your browser data. On shared, public or kiosk machines, always log out rather than simply closing the
No analytics, advertising or tracking technology of ae authenticated platform.
3. What We Do Not Use
Inside the platform, we do not use:
- Advertising or retargeting cookies
- Social media pixels or share-button trackers
- Third-party profiling or data-broker technology
- Cross-site or cross-device tracking
- Session replay, heatmap or mouse-tracking tools
- Device fingerprinting
We do not sell this data, and we do not share it for cross-context behavioural advertising.
4. Managing and Clearing Storage
Browser storage does not expire. Unlike a cookie, a localStorage entry has no expiry date and stays until something removes it. So:
- We clear the platform's browser storage when you log out. Logging out is the reliable way to remove drafts and preferences from a device.
- Clearing cookies alone does not clear browser storage. Most browsers treat them as separate categories — you usually need to clear "site data", "hosted app data" or "storage", not just cookies. In Chrome and Edge this is under Delete browsing data → Cookies and other site data; in Firefox, Clear Data → Cookies and Site Data; in Safari, Manage Website Data.
- You can inspect exactly what we store at any time via your browser's developer tools, under Application → Storage.
Note: the items in §2.1–2.5 cannot be disabled without breaking login, autosave or secure operation. Clearing them will log you out and may discard unsaved drafts.
5. Legal Basis and Local Rules
- UK: PECR reg. 6, read with the UK GDPR. Everything the platform stores is strictly necessary and therefore exempt from consent. The exemption applies to the purpose, not the mechanism — browser storage is treated exactly like a cookie.
- EU/EEA: ePrivacy Directive Art. 5(3) as implemented locally, read with the EU GDPR. Same position.
- Switzerland: revFADP — transparency required; we apply the same approach.
- US (California and other states): we do not sell personal information, share it for cross-context behavioural advertising, or use any advertising or tracking technology within the Service. Global Privacy Control has nothing to opt out of here, since no such sale, sharing or advertising occurs within the Service.
- Elsewhere: where local law requires consent for analytics, our approach applies globally, so the same consent-first position holds wherever you are.
6. Changes to This Policy
We may update this policy, including when we add or remove a technology. Material changes will be communicated via in-platform notification or email. If we ever introduce anything that is not strictly necessary, we will ask for your consent first.
7. Contact
Questions: contact@yone.co.uk
Yone IT Ltd · Company No. 13073396 · 60 Cookridge Drive, LS16 7HW Leeds, United Kingdom
Terms · Privacy · Cookies · DPA
© 2026 Yone IT Ltd