Draft — pending legal review. This document has not yet been reviewed by counsel and may change before Irisend is generally available.
Cookie Policy
Effective date: 2026-09-25
This Cookie Policy explains how Irisend ("Irisend") uses cookies and similar technologies (local storage, pixels) on [to be completed: COMPANY_DOMAIN] (marketing site and dashboard), and your choices.
1. What Are Cookies
Cookies are small text files placed on your device when you visit a website. Similar technologies include local/session storage and tracking pixels. We use these terms interchangeably below to mean any technology that stores or accesses information on your device.
2. Categories of Cookies We Use
| Category | Purpose | Consent required (EU/UK ePrivacy)? | Examples |
|---|---|---|---|
| Strictly necessary | Required for the site/dashboard to function: authentication/session, load balancing, CSRF protection, security, cookie-consent preference storage | No — exempt under ePrivacy Art. 5(3) | session cookie, CSRF token, auth cookie, consent-preference cookie |
| Functional | Remember preferences (e.g., theme, language) that are not strictly required | Yes | UI preference cookies |
| Analytics | Understand aggregate usage of the marketing site/dashboard to improve the product | Yes (unless configured as genuinely strictly-necessary, privacy-preserving analytics, which we treat as still requiring consent to stay on the safe side) | [to be completed: ANALYTICS_TOOL] cookie/local storage |
| Marketing | Not currently used for third-party advertising; reserved for future use, would require separate consent | Yes | — |
We do not currently use third-party advertising or cross-site tracking cookies.
3. Consent Mechanism
Where you are in the EEA, UK, or another jurisdiction requiring prior consent for non-essential cookies:
- On first visit, we present a cookie banner allowing you to accept all, reject non-essential, or customize by category, before any non-essential cookie is set.
- Strictly necessary cookies are set regardless, as permitted under ePrivacy Art. 5(3) and equivalent laws (e.g., UK PECR).
- You can change your choice at any time via the "Cookie preferences" link in the site footer, or by clearing cookies in your browser.
- We log consent status and timestamp to demonstrate compliance on request.
Implementation note for Irisend: choose and deploy a consent-management tool (or a lightweight self-built banner) that blocks non-essential scripts/cookies until consent is given, and that lets users withdraw consent as easily as they gave it.
4. Specific Cookies
| Name | Set by | Category | Duration | Purpose |
|---|---|---|---|---|
[{{SESSION_COOKIE_NAME}}](irisend-missing-placeholder:SESSION_COOKIE_NAME) | [to be completed: COMPANY_DOMAIN] | Strictly necessary | Session | Authenticates logged-in dashboard users |
[{{CSRF_COOKIE_NAME}}](irisend-missing-placeholder:CSRF_COOKIE_NAME) | [to be completed: COMPANY_DOMAIN] | Strictly necessary | Session | CSRF protection |
cookie_consent | [to be completed: COMPANY_DOMAIN] | Strictly necessary | 12 months | Remembers your cookie choice |
[{{ANALYTICS_COOKIE_NAME}}](irisend-missing-placeholder:ANALYTICS_COOKIE_NAME) | [to be completed: ANALYTICS_TOOL] | Analytics | [to be completed: ANALYTICS_COOKIE_DURATION] | Aggregate product/site usage analytics |
__cf_bm / cf_clearance | Cloudflare | Strictly necessary | Up to 30 minutes / 1 year | Bot mitigation, security (set by Cloudflare when proxying the site) |
Update this table to match the actual cookies/technologies deployed once the marketing site and dashboard are built — an inaccurate cookie table is itself a compliance gap under ePrivacy/GDPR transparency rules.
5. Browser Controls
Most browsers let you block or delete cookies via settings. Blocking strictly necessary cookies may break dashboard login and core site functionality.
6. Third-Party Cookies
Some cookies (e.g., Cloudflare security cookies, analytics) are set by third parties providing services on our behalf; see Subprocessors for the vendors involved and their own privacy/cookie policies.
7. Changes
We will update this policy as our cookie usage changes and reflect the current effective date above.
8. Contact
This document is a draft template and does not constitute legal advice. See research/legal.md for review recommendations before publishing.