A cookie is a small file a site keeps in your browser so it can recognize you from one page to the next. The law treats them as personal data when they can identify you, which is why you have a right to know which ones exist and to refuse the ones that are not necessary.
The same goes for local storage, the service worker and the cache of an installed application. They are not cookies, they store information on your device all the same, and this document counts all of them.
1. On this site
Today vonzay.com sets no analytics, advertising or cross-site tracking cookies. There are no
social pixels, no heat maps, no campaign identifiers stored in your browser and no error reporting
tools. We checked that against the site’s source before publishing this version, not from memory.
What does get stored is this, and only if you use the form or the control that produces it:
| What it stores | What for | How long |
|---|---|---|
| Site session cookie | Holding the signup form together between the page and the submission, with the marker that stops one submission being replayed | 2 hours |
| Signup cookie | Carrying your name, your email and the plan you picked to the confirmation page, so it can greet you without putting your email in the address bar | 30 minutes |
| Chosen language | Remembering the language you picked in the header’s switcher, so the home page does not change it the next time you come back | 1 year |
| Your answer to the cookie strip, in local storage | Remembering whether you accepted statistics or only the necessary cookies, so you are not asked again | Until you clear it |
The two signup cookies are server-only: the page’s JavaScript cannot read them. The language cookie holds only es or en.
The server does keep the ordinary technical logs any web server keeps: the IP address, the page requested and the time. Those logs stay on our own servers, which are in Ecuador. That is described in the privacy policy and does not depend on a cookie.
Typefaces are served from our own domain, so opening a page makes no request to a font provider and discloses your IP address to no one.
2. The European consent standard
For visitors in the European Union, what governs is Article 5(3) of Directive 2002/58/EC: storing information on your device, or reading what is already there, requires your prior informed consent, unless it is strictly necessary to provide the service you explicitly asked for.
Everything in this document falls inside that exception. It holds up the session you opened, completes the form you submitted, remembers the language you picked, or delivers the notification you turned on.
The cookie strip that appears on arrival asks about something else: anonymous visit statistics. The site has no statistics tool installed today, so whether you accept or not, nothing loads; your answer is only stored for the day there is one. That day this document will say so before it happens, the tool will load only if you accepted, and if you chose “Only necessary” it will stay off. The same would hold for any advertising or measurement pixel, which does not exist today and is not planned.
3. When you go to pay
This site has no payment page today. Plans are taken out by email or through the contact form, and how you pay is agreed in writing when you sign up, so paying stores no cookie from a payment processor in your browser.
When we add a payment gateway, this document gets rewritten before it goes live: it will say what it stores, what for, and whose it is.
4. In the application
app.vonzay.com does need to store information in your browser to work. Without it there is no
session.
| What it stores | What for | How long |
|---|---|---|
| Access token | Keeping the session open between requests | 15 minutes |
| Refresh token | Renewing the session without asking for your password again | 7 days, or until you log out |
| Application session | Letting you into the /app pages without revalidating on each one |
7 days |
| Active company | Knowing which of your companies you are working in | The session |
| Temporary password | Showing once the password the admin console has just generated | Minutes, and it clears as it is shown |
| Workspace state, in local storage | Remembering open tabs, recent documents, expanded folders, bookmarks and the last company | Until you clear it |
| Agent engine per conversation, in local storage | Remembering which engine you opened that conversation with | Until you clear it |
The first three are server-only and the application’s JavaScript cannot read them. Logging out invalidates that account’s tokens on every device immediately.
None of these are used for advertising or to follow you across sites. One clarification about third
parties, because the short sentence would be false: when you open one of the embedded consoles from
the application, such as conversations, automations or webmail, that console stores its own session
cookie on its own domain. They are applications running on our own infrastructure in Ecuador and not
a third party’s, but the cookie does not belong to app.vonzay.com and we would rather you did not
learn that from your browser.
An honest caveat about the standard in section 2, because one row is arguable. Workspace state is not indispensable for the application to work: without it the session stays open and you keep working, just without your tabs. We treat it as part of the desk you asked for, it is stored in your browser and also in your account so it follows you to another device, and it clears from the application or from the browser. If that state were ever used for anything other than handing your desk back, it would move to asking for consent.
5. Notifications and the installed application
If you turn notifications on, your browser registers a push subscription tied to that device. One row is stored per device and it deletes itself when the push service reports the subscription is dead. You can revoke it from the site permissions in your browser.
The application installs a service worker and it does the minimum: it receives the notice, opens the right screen when you tap the notification, and tells an open tab so the bell updates. It stores no copy of your pages and intercepts none of your requests. This marketing site installs none at all.
6. How to control all of this
Every browser lets you inspect, block and clear per-site storage, usually under privacy settings.
Bear in mind that if you block storage for app.vonzay.com, the application will not be able to
keep you logged in, and that if you block it on vonzay.com the signup form will stop completing.
7. Who answers for this
What this site stores is the responsibility of Vonzay Ecuador S.A.S., which is the party that contracts with every client, wherever they are. The team, the day-to-day operation and the servers are in Ecuador: that is where the technical logs stay and where the application that issues the session cookies runs. Which data crosses which border, and under what safeguard, is set out in the privacy policy.
If you have questions about this document, write to sales@vonzay.com or call +593 96 175 0101.