Cookie Policy

1. Introduction and Scope

This Cookie Policy explains how Yellsy LLC, a company registered in the United States, uses cookies, browser storage, and similar technologies on yellsy.com and its related interfaces. It forms part of our broader Privacy Policy, which you should read alongside this document for a complete understanding of how we handle your data.

This policy applies to all visitors and registered users of the Platform, regardless of their location. Where specific rights apply to residents of the European Economic Area or the state of California, these are noted explicitly.

2. What Cookies Are

Cookies are small text files placed on your device by a website when you visit it. They allow the site to recognize your device on subsequent visits or across page navigations within the same session. Cookies have an expiry date: session cookies are deleted when you close your browser, while persistent cookies remain on your device for a defined period or until you delete them manually.

In addition to cookies, websites can use other browser storage mechanisms such as localStorage and sessionStorage. Unlike cookies, data stored in localStorage is never automatically transmitted to our servers with each request. It stays on your device and is only read when your browser explicitly requests it via JavaScript. This distinction matters for your privacy, and we explain exactly what we store and why in Section 4 below.

We also embed third party scripts (Cloudflare, hCaptcha, Stripe) that may set their own cookies for security and fraud prevention. These are described in full in Section 5.

3. Legal Basis for Cookie Use

For users located in the European Economic Area, our use of cookies is governed by the ePrivacy Directive (2002/58/EC, as amended) and the GDPR. Every cookie and storage item we use falls into the category of strictly necessary, meaning it is essential for the platform to function as you have requested. Under Article 5(3) of the ePrivacy Directive, strictly necessary cookies do not require your prior consent.

We do not use cookies that require consent under the ePrivacy Directive. If this changes in the future, we will introduce a consent mechanism and obtain your explicit agreement before setting any non-essential trackers.

4. What We Store and Where

4.1 Authentication Tokens (Browser localStorage)

When you log in, Yellsy stores two tokens in your browser's localStorage: a short-lived access token (valid for 2 hours) and a refresh token (valid for 30 days). These tokens are sent to our servers as HTTP Authorization headers, not as cookies. This design avoids the cross-site request forgery risk that comes with cookie-based authentication. Both tokens are cleared automatically when you log out or when they expire.

4.2 Infrastructure and Payment Cookies

A small number of cookies are set by the security and payment infrastructure we depend on. These are described in the full inventory table below. They are all strictly necessary and none of them is used for advertising or behavioral profiling.

5. Third Party Technologies

6. Optional Analytics and Advertising Technologies

At the present time, Yellsy does not deploy any optional cookies for analytics or advertising purposes. All cookies currently active on the platform are strictly necessary, as described in Section 4. However, we may in the future introduce optional tracking technologies — including analytics scripts, advertising pixels, and behavioral measurement tools — to better understand how users interact with our platform and to measure the performance of our marketing campaigns. We want to be transparent about this possibility so that you are never surprised by changes to our cookie practices.

Categories we may introduce in the future

When any of these categories are activated, the cookie inventory table in Section 4 will be updated to list each technology by name, provider, purpose, and duration, along with a link to the relevant provider privacy policy. You will be notified by email at least thirty (30) days before any optional category goes live.

7. Analytics

7.1 Server-Side Analytics

Yellsy uses or may use server-side analytics tools to measure platform performance and understand how our service is used in aggregate. Unlike client-side analytics, these tools process data entirely on our servers and do not write any cookie or identifier to your device. No consent banner is required for server-side analytics under the ePrivacy Directive, since they do not access or store information on your terminal equipment.

Data processed through server-side analytics may include anonymized IP addresses, page paths, referral sources, session durations, and API response times. This data is aggregated and does not produce a profile linked to you as an identifiable individual. Where IP addresses are processed, they are truncated or hashed before any retention. The full details of this server-side processing are covered in our Privacy Policy.

7.2 Client-Side Analytics (Optional — Consent Required)

If we introduce client-side analytics tools in the future — for example scripts that observe which pages attract the most interest or measure conversion rates from marketing campaigns — these will fall under the optional Analytics category described in Section 6. They will set cookies or identifiers on your device and will not be activated until you have explicitly consented through the cookie preference panel.

8. Do Not Track Signals

Some browsers send a Do Not Track (DNT) signal to websites, requesting that they refrain from tracking your browsing activity. At present, since Yellsy only uses strictly necessary cookies, your DNT preference does not materially change our behavior — there is nothing optional to disable.

If and when we introduce optional analytics or advertising technologies, we will honor DNT signals by treating them as equivalent to a refusal of consent for those categories. In practice, this means that a browser sending a DNT signal will be treated as if you had selected "decline all optional cookies" in the consent panel, with no further action required from you.

9. International Data Transfers

Yellsy LLC is based in the United States. The third party providers whose cookies appear on our platform — Cloudflare, hCaptcha, and Stripe — are also US-based companies. If you are accessing the platform from the European Economic Area, your data (including data processed in connection with their cookies) is transferred to the United States.

These transfers are made on the basis of Standard Contractual Clauses approved by the European Commission, or equivalent transfer mechanisms recognized under applicable data protection law. Each provider maintains their own data transfer documentation, which is accessible through the privacy links listed in Section 5.

10. Managing Your Cookie Settings

You have the right to control cookies through your browser settings. Below are the paths for the most common browsers:

11. Retention of Cookie Data

Cookie lifetimes are listed in the inventory table in Section 4. Session cookies are deleted when you close your browser. Persistent cookies expire on the date shown in the table. Data collected in connection with third party cookies is retained according to each provider's own retention policies, which are accessible through the links in Section 5. We do not retain cookie data on our own servers beyond what is recorded in server access logs, which are kept for a maximum of 90 days for security and diagnostic purposes.

12. Changes to This Policy

We will update this Cookie Policy if we introduce new technologies, change our providers, or if legal requirements evolve. Any material change will be reflected on this page with a revised date at the top. We encourage you to review this policy periodically. If we ever introduce optional cookies that require your consent, we will present a clear banner and will not set those cookies until you have explicitly agreed.

13. Contact

If you have any questions about how Yellsy uses cookies or browser storage, or if you would like to exercise any data protection rights described in our Privacy Policy, please reach out to us.