Cookie and Local Storage Policy

Why there is no cookie banner

Nothing outside the strictly necessary and user-selected interface customisation exemptions in Article 22.2 of Spanish Law 34/2002 (LSSI) is stored on or read from your device. Your consent is therefore not required, and Fliox shows no cookie banner or preference centre.

Authentication and security

refresh_token is a first-party, HTTP-only cookie sent only to Fliox authentication endpoints. It keeps your authenticated session available across visits and devices. It expires after 30 days or is cleared when you sign out.

google_oauth_state is a first-party, HTTP-only cookie that protects the integrity of the Google sign-in exchange. It expires after 10 minutes and is cleared when the exchange completes.

The application uses the local-storage keys process-it.auth.refresh-lock and process-it.auth.refresh-lock:recent-refresh to coordinate authentication across tabs. Their values are used for no more than 10 seconds and 15 seconds respectively; expired values are ignored.

Interface preferences you choose

fliox-public-theme and process-it.theme-preference remember the light, dark, or system theme you selected. process-it.locale-preference remembers the interface language you selected. These first-party local-storage values remain until you change them or clear site data and are never reused for profiling or advertising.

Public intake status

After you submit a public intake request, a first-party local-storage entry whose key begins fliox:intake-receipt: stores the private status-page path. This lets your browser reopen the status you asked Fliox to provide. It remains until you clear site data. It does not contain your form answers, and Fliox does not use it for tracking or profiling.

Reliability monitoring

Grafana Faro may collect error and performance diagnostics inside the signed-in application only. It does not run on the public marketing site, store a cookie or persistent identifier on your device, collect your IP address, record sessions, capture typed text, file contents, or request bodies, or retain query strings in reported addresses.

Because Faro writes nothing to or reads nothing from your device, Article 22.2 LSSI is not engaged. This limited processing relies on Fliox’s legitimate interest in keeping the service reliable under Article 6(1)(f) GDPR. You may object by writing to privacy@fliox.io.

Payments and email

Subscription checkout and account-management pages are hosted by the payment provider. That provider uses its own strictly necessary technologies to complete the payment flow you requested and supplies its own notice on those pages. Fliox does not receive card details.

Fliox emails contain no open-tracking pixel and no click tracking. Links are not rewritten to monitor clicks. Delivery, bounce, and complaint records are kept only to operate the mail channel.

Your controls and future changes

You can block or delete cookies and local storage through your browser. Blocking authentication storage prevents sign-in; clearing preference or intake-receipt storage does not delete information held in your Fliox account.

If Fliox introduces product analytics, marketing or attribution tags, a persistent reliability identifier, browser IP collection, session recording, or email open or click tracking, it will update this policy and obtain consent before the technology runs. Any banner will make accepting and refusing equally easy and will provide an equally easy way to withdraw or change your choice.

Questions about this policy may be sent to privacy@fliox.io. You may also complain to the Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid, Spain, www.aepd.es.