Cookie and similar technology notice
About this document
| Field | Value |
|---|---|
| Version | 1.0 |
| Effective date | 1 August 2026 |
| Publication date | 1 August 2026 |
| Last reviewed | 18 July 2026 |
| Status | Approved public document |
Version history
| Version | Effective date | Change summary | How this version applies |
|---|---|---|---|
1.0 | 1 August 2026 | Initial public version | Available publicly; technology choices are made separately |
1. Scope
This notice explains how Alessia International Ltd uses cookies, local storage, software development kits (SDKs), pixels and similar technologies on alessiahq.com, app.alessiahq.com and the Alessia applications. A consent-management platform manages consent on the marketing website only; it is not the privacy-control mechanism for the web application or mobile apps.
Cookies are small files stored by a browser. Local storage holds information in a browser or app. SDKs are code components that may process device or usage information. Some technologies are necessary for a requested service; others support preferences, analytics or marketing.
Our Privacy Notice explains the personal-information purposes, lawful bases, recipients, transfers and rights.
2. Categories
Strictly necessary
These technologies support functions a user requests, such as authentication, security, session continuity, load balancing, fraud prevention, subscription checkout and saving privacy choices. Where law permits, they operate without optional consent but are limited to the necessary purpose.
Preferences
These remember choices such as language, display or workflow settings. Some may be necessary for a requested preference; otherwise they are enabled only under the applicable consent rule.
Analytics and performance
Where enabled, our analytics platform processes configured page and app events, account or device identifiers, email and optional name, and device or browser information. It does not receive clinical or portfolio content, including free text, audio, documents, images, video, AI inputs or outputs, or sensitive assessment content. Session replay and IP or geolocation capture are disabled.
Where consent is required, analytics remains disabled until you accept it. Rejecting analytics does not prevent core account use.
Marketing
Alessia does not use behavioural advertising trackers and does not sell personal information or use it for cross-context behavioural advertising. Marketing-email links may be tracked to measure onboarding and funnel conversion when the recipient has opted into marketing. Open tracking and transactional-email click tracking are disabled.
3. Current technologies and providers
The cookie settings panel is the current browser-level register for the marketing website. It identifies the cookies and trackers detected or configured for that site, their categories, purposes, providers and durations where applicable. You can reopen the panel at any time to review or change your choices.
The web application and mobile apps also use local storage or SDKs for sign-in, security, session continuity, privacy preferences, analytics where enabled, notifications and subscription administration. The registers below name the current items. The Subprocessor and Service-provider List identifies the current providers, processing locations and server-side retention. App-store and device-provider notices may also apply. We update these registers when an item is added, removed or materially changed.
Marketing website (alessiahq.com)
The cookie-settings panel is the live register for this site and shows the exact current names and durations. The principal items are:
| Item | Set by | Purpose | Category | Duration |
|---|---|---|---|---|
| Consent-management record | Our consent-management platform | Stores your cookie choices so they are respected on each visit | Strictly necessary | As shown in the cookie-settings panel |
| Analytics identifiers (a cookie and a matching local-storage entry; exact names are shown in the cookie-settings panel) | PostHog | Pseudonymous visitor, device and session identifiers for analytics | Analytics - set only after you accept analytics | Cookie 365 days; local storage until deleted |
Web application (app.alessiahq.com)
| Item | Set by | Purpose | Category | Duration |
|---|---|---|---|---|
Sign-in session - logtoCookies | Alessia (sign-in) | Encrypted sign-in session, including the tokens that keep you signed in | Strictly necessary | Up to 14 days, rolling |
Sign-in error notice - alessiaAuthNotice | Alessia | One-time marker that a sign-in attempt failed, so we can tell you | Strictly necessary | 2 minutes |
Preferences refresh marker - alessia_pref_sync | Alessia | Short-lived marker that your account preferences were refreshed, so we do not re-request them on every page | Strictly necessary | 15 minutes |
Language choice - alessia_locale | Alessia | Remembers the language you chose | Preferences - set only when you choose a language | 1 year |
Theme choice - alessia_theme | Alessia | Remembers the theme (light/dark) you chose | Preferences - set only when you choose a theme | 1 year |
Navigation layout - alessia_rail | Alessia | Remembers whether you collapsed the navigation rail | Preferences | 1 year |
| Analytics identifiers (a cookie and a matching local-storage entry) | PostHog | Pseudonymous account, device and session identifiers for analytics | Analytics - set only after you enable analytics | Cookie 365 days; local storage until deleted |
Mobile apps
The mobile apps do not use cookies. They store information on your device to work: your sign-in credentials are held in the device's protected storage, your settings and choices (including your product-analytics choice) are saved locally, and your portfolio content, reference material and translations are kept on the device so the app works offline. Optional analytics identifiers exist only after you enable product analytics, and push-notification identifiers only after you enable push notifications; both can be turned off in the app's privacy or notification settings, and everything is removed when you sign out where offered, reset the app or uninstall it.
4. Consent controls
On the marketing website, the consent controls provide equally prominent Accept and Reject choices, granular settings and a persistent way to reopen your settings. Under Alessia's global baseline, non-essential technologies remain disabled until you affirmatively accept them.
You can change or withdraw your choices through Cookie Settings. Withdrawal does not affect processing that was lawful before your choice changed. We keep the minimum evidence needed to demonstrate your choice, as explained under “Retention and transfers” below.
On the marketing website, we do not treat a pre-ticked box, silence, continued browsing or acceptance of the Alessia Terms as consent. Privacy acknowledgements and marketing choices are presented separately.
In the web and mobile applications, optional product analytics is disabled until you affirmatively enable it through the consent prompt or Privacy Settings. You can withdraw your choice at any time in Privacy Settings, as easily as you gave it. Strictly necessary technologies for authentication, security, session integrity and subscription administration operate without consent. Operational diagnostics needed to detect and fix failures are minimised and do not use marketing or profiling technologies.
We honour recognised browser-based opt-out signals, including Global Privacy Control, where applicable. You can also manage your choices through Cookie Settings.
For users in Québec, optional analytics and profiling technologies are off by default and are enabled only if you activate them. Privacy settings default to the highest level of confidentiality. The consent controls explain any technology used to identify, locate or profile you and how to activate or disable it.
5. Browser and device controls
Browser settings can block or delete cookies, but blocking strictly necessary storage may prevent sign-in or requested features. Mobile operating systems provide permission and tracking controls. These controls may operate separately from Alessia's in-product preferences.
Before requesting a sensitive app permission or collecting information you may not reasonably expect, Alessia provides an explanation in the relevant app workflow.
6. Email tracking
Service and transactional emails contain only the information needed for account setup, authentication, security, billing, cancellation, deletion or strictly functional onboarding. They do not include portfolio evidence or promotional content. Open tracking and service or transactional link tracking are disabled. When you have opted into marketing, links in marketing and promotional-onboarding emails may be tracked for analytics and funnel conversion. This tracking stops when you withdraw your marketing choice.
7. Retention and transfers
A browser cookie or local-storage expiry does not necessarily delete related provider-side records. Provider-side logs and analytics events follow the Retention Schedule and Subprocessor and Service-provider List.
We keep consent evidence while we rely on your choice and for three years after withdrawal, replacement or the related processing ends. The record may include a consent identifier, timestamp, website or domain, page URL, region or rule set, device or browser information, your choices and the applicable banner or notice version. We configure our pages to avoid personal information in URLs or query strings. Master wording and configuration versions are kept for seven years. We do not retain screenshots or browsing histories as consent proof unless needed for a documented investigation.
Providers may process information outside the user's country. Transfer safeguards are described in the Privacy Notice and Subprocessor List.
8. Changes and contact
We update this notice and the consent interface before materially changing the purpose or effect of non-essential technology. A provider replacement within an already-described category is normally recorded in the Subprocessor and Service-provider List rather than requiring a new version of this notice. Where the provider's identity is relevant to your choice, we identify the replacement before enabling its technology. We request fresh consent where your existing choice is not sufficiently specific or the provider, purpose or effect changes what you previously accepted. Questions or privacy requests may be sent to privacy@alessiahq.com.