Cookie Policy

What QualiFlow AI stores in your browser, which of it needs your permission, and how to change your mind at any time.

Last updated: 3 September 2026

1. What this policy covers

This policy describes the cookies and similar browser storage (local storage and session storage) used on the QualiFlow AI website and in the QualiFlow AI application. It should be read together with our Privacy Policy, which explains how we handle personal data more generally, and our sub-processor list, which names the third parties that process data on our behalf.

2. How consent works

The first time you visit, a banner asks for your choice. You can accept everything, reject everything that is not essential, or choose category by category. The banner offers four categories: Essential, Analytics, Marketing and AI Chat Assistant. Each is described below.

Your choice is saved in your own browser, together with the time you made it and whether you accepted all, rejected all or chose individually. It stays until you clear your browser data or we change the set of categories, in which case we ask again.
Until you have made a choice, nothing in the non-essential categories runs. No record, an unreadable record, or a record from an earlier version of this banner are all treated as “not consented”, never as consent.
You can change your choice at any time from the Cookie preferences link in the footer of every page, or with the button in section 8. Withdrawing is as easy as giving.

3. Essential (always on)

These are required for the site and the application to work and to keep your account secure. They cannot be switched off in the banner because the service does not function without them.

Sign-in session — keeps you signed in to the application. It is not readable by scripts and lasts at most 24 hours. Two further short-lived cookies protect the sign-in form against forgery and return you to the page you came from.
Device recognition — set when you sign in. It holds a random value and no account details, is not readable by scripts, and lasts up to 400 days. It lets us tell you when your account is signed in to from a device we have not seen before. This is a security measure, not analytics; the Privacy Policy explains it further.
Sign-up hand-off — when you sign up with Google or Microsoft, short-lived cookies carry the plan and company details you entered across the redirect. They are removed as soon as sign-up completes.
Application storage — the application uses local and session storage in your browser for things it needs to work: your sign-in tokens during multi-step sign-in (for example two-factor verification), the progress of a checkout or plan change, the consent record above, and preferences you set yourself, such as which columns a table shows. Session storage is cleared when you close the tab.
Error reporting — if the application throws an error, a report of that error is sent to Sentry, our error-monitoring provider, whether or not you have consented to analytics. It records that the software failed, not how you used it. Sentry's behaviour-tracking features are covered under Analytics and stay off without your consent.

4. Analytics (off until you allow it)

Analytics help us understand how visitors use the site so we can improve it. Nothing in this category loads until you have allowed it.

PostHog — product analytics. Once allowed, it records the pages you visit, when you leave a page, and clicks and other interactions, and may record how you move through a page. To recognise a returning browser it stores an identifier in your browser (a cookie and/or local storage). If you are signed in, this activity may be linked to your account. If you later turn analytics off, PostHog is stopped immediately and told not to collect.
Sentry behaviour tracking — with your consent, Sentry additionally tracks sessions across releases, measures performance, and may record a replay of your session to help us reproduce problems. Replays mask all text and block images and media, so what you type is never captured. Turning analytics off stops any running replay immediately, and performance tracing checks your choice each time it would start.

5. Marketing

We do not currently place any marketing or advertising cookies, and no part of the site reads this choice today. The category is offered so that your preference is already recorded should that change. We will update this policy before introducing any marketing cookie, and it will remain off for you unless you have allowed it.

6. AI Chat Assistant

Our website offers a chat assistant. It starts only when you have allowed this category; with it off, the assistant does not start and no conversation is sent anywhere. When it is on, the messages you type are sent to our servers and processed with OpenAI, one of our sub-processors, to generate replies. Please do not share sensitive personal information in the chat.

7. Third-party content

We do not embed third-party content such as videos, maps or advertising pixels on our website pages. Links to our social profiles take you to those services, which set their own cookies under their own policies.

8. Changing your choice

Open your preferences below or from the footer of any page. You can also block or delete cookies in your browser settings; if you block the essential cookies, you will not be able to sign in.

9. Changes to this policy

When we add, remove or change a cookie or a category, we update this page and its date. If the change affects a category you have already answered, the banner asks you again.

10. Contact

Questions about cookies or your privacy? Email privacy@qualiflow.ai.

Last updated: 3 September 2026

1. What this policy covers

2. How consent works

Your choice is saved in your own browser, together with the time you made it and whether you accepted all, rejected all or chose individually. It stays until you clear your browser data or we change the set of categories, in which case we ask again.

Until you have made a choice, nothing in the non-essential categories runs. No record, an unreadable record, or a record from an earlier version of this banner are all treated as “not consented”, never as consent.

You can change your choice at any time from the Cookie preferences link in the footer of every page, or with the button in section 8. Withdrawing is as easy as giving.

3. Essential (always on)

These are required for the site and the application to work and to keep your account secure. They cannot be switched off in the banner because the service does not function without them.

Sign-in session — keeps you signed in to the application. It is not readable by scripts and lasts at most 24 hours. Two further short-lived cookies protect the sign-in form against forgery and return you to the page you came from.

Device recognition — set when you sign in. It holds a random value and no account details, is not readable by scripts, and lasts up to 400 days. It lets us tell you when your account is signed in to from a device we have not seen before. This is a security measure, not analytics; the Privacy Policy explains it further.

Sign-up hand-off — when you sign up with Google or Microsoft, short-lived cookies carry the plan and company details you entered across the redirect. They are removed as soon as sign-up completes.

Application storage — the application uses local and session storage in your browser for things it needs to work: your sign-in tokens during multi-step sign-in (for example two-factor verification), the progress of a checkout or plan change, the consent record above, and preferences you set yourself, such as which columns a table shows. Session storage is cleared when you close the tab.

Error reporting — if the application throws an error, a report of that error is sent to Sentry, our error-monitoring provider, whether or not you have consented to analytics. It records that the software failed, not how you used it. Sentry's behaviour-tracking features are covered under Analytics and stay off without your consent.

4. Analytics (off until you allow it)

Analytics help us understand how visitors use the site so we can improve it. Nothing in this category loads until you have allowed it.

PostHog — product analytics. Once allowed, it records the pages you visit, when you leave a page, and clicks and other interactions, and may record how you move through a page. To recognise a returning browser it stores an identifier in your browser (a cookie and/or local storage). If you are signed in, this activity may be linked to your account. If you later turn analytics off, PostHog is stopped immediately and told not to collect.

Sentry behaviour tracking — with your consent, Sentry additionally tracks sessions across releases, measures performance, and may record a replay of your session to help us reproduce problems. Replays mask all text and block images and media, so what you type is never captured. Turning analytics off stops any running replay immediately, and performance tracing checks your choice each time it would start.

5. Marketing

6. AI Chat Assistant