Cortex uses cookies and similar technologies (localStorage) to operate the Service, secure your session, and — with your consent — to measure usage. This policy explains what we set, why, and how to control it.
1. Categories
Necessary (always on)
- cortex_access— httpOnly, Secure, SameSite=Lax. Short-lived (~15 minutes) JWT used to authenticate API calls.
- cortex_refresh— httpOnly, Secure, SameSite=Lax. Opaque rotating refresh token (7 days) used to mint new access tokens. SameSite=Lax on both cookies is our CSRF mitigation: browsers withhold Lax cookies from cross-site fetch/XHR requests regardless of method, so a malicious site cannot ride your session to call our API.
- cortex_vcp_access / cortex_vcp_refresh— analogous pair scoped to the operator console (only set on Pleisys staff workstations).
Analytics (consent required)
Aggregated, anonymised page-view counts and feature-usage metrics. We do not place third-party analytics until you opt in. No analytics cookies are set if you decline.
Marketing (consent required)
Reserved for future cross-site campaign measurement. No marketing cookies are set today.
Preferences (consent required)
Stores your theme + locale + dismissed-banner state locally so they persist across visits. Stored in localStorage, not as a server-readable cookie.
2. Managing consent
The cookie banner appears on first visit and on revisit if your consent record is older than 12 months. You can change your selection any time with the button below.
3. Third parties
We do not embed third-party tracking scripts in the marketing site by default. Sentry error monitoring is loaded on the application surfaces; it captures only PII-redacted stack traces and does not set tracking cookies. The Razorpay or Stripe checkout SDK is loaded only when you initiate a payment and sets cookies under their own privacy policies.
4. Do Not Track
We respect the DNT header on analytics and marketing categories: when DNT is sent, those categories are treated as “declined” regardless of banner state.