Cookie Policy

1. What cookies are

A cookie is a small file a website stores in your browser. Among other things it keeps you signed in or remembers preferences such as your language.

2. Our approach

We distinguish two areas:

• Public site (home page, pricing, blog and legal pages): besides necessary and preference cookies, we use analytics cookies (Google Analytics 4 and Hotjar) and marketing cookies (the Google Ads remarketing and conversion tag) only with your consent.
• Application and learner portal: necessary and preference cookies only. No analytics, advertising or third-party tracking runs inside the application or the learner portal.

Under article 22.2 LSSI-CE and the Spanish DPA's guidance, necessary and preference cookies are set without consent. For everything else the public site shows a banner with three equally weighted options — Accept, Reject and Configure (choose per category) — and loads no non-essential script or cookie until you decide. Rejecting is as easy as accepting, and withdrawing consent is as easy as giving it.

Your choice is stored in your browser for 12 months (in localStorage, key kelbado-cookie-consent; it is not a cookie and is not sent to the server); after that we ask again. You can change it at any time through the "Cookie settings" link in the footer, which reopens the banner.

Marketing cookies serve only to build remarketing audiences and measure conversions of Kelbado's own campaigns. We never use customer content or learner data for advertising.

3. Cookies we use

3.1 Necessary and preference cookies (no consent needed)

Cookie	Type	Purpose	Duration
authjs.session-token (__Secure-authjs.session-token over HTTPS)	Necessary, first-party	Keeps the user signed in	30 days
__Host-authjs.csrf-token	Necessary, first-party	Cross-site request forgery protection	Session
authjs.callback-url	Necessary, first-party	Returns you to the right page after sign-in	Session
lms-locale	Preference, first-party	Remembers the chosen language	12 months
kelbado-dash-theme	Preference, first-party	Remembers the dashboard light/dark theme	12 months
kelbado-site-preview	Necessary, first-party	Lets platform administrators preview the public site before launch	12 hours
lms-ref	Necessary, first-party	Only if you arrive through an invitation link (/r/…): remembers the invitation code you arrived with so the referral reward can be attributed	30 days

We also use browser localStorage to remember the language, the decision made in the cookie banner (kelbado-cookie-consent, 12 months) and a few interface preferences (panel state, player theme, font size and sound). It is not a cookie and is not sent to the server.

3.2 Analytics and marketing cookies (consent only)

Public site only, and only after you accept them in the banner. None is set if you reject or do not answer.

Cookie	Provider	Purpose	Duration
_ga	Google Analytics 4 (Google Ireland Ltd)	Distinguishes visitors of the public site (random identifier)	2 years
_ga_<id>	Google Analytics 4	Persists the analytics session state	2 years
_gcl_au	Google Ads	Conversion attribution: records that you arrived from an ad	90 days
IDE	Google Ads (doubleclick.net domain, third-party)	Ad measurement and remarketing audiences	13 months
test_cookie	Google Ads (doubleclick.net domain, third-party)	Checks whether the browser accepts cookies	15 minutes
_hjSessionUser_<id>	Hotjar	Visitor identifier so that later visits are attributed to the same pseudonymous profile	365 days
_hjSession_<id>	Hotjar	Current session data (heatmaps and session recording)	30 minutes
_hjTLDTest	Hotjar	Checks on which domain cookies can be set; removed after the check	Session
_hjHasCachedUserAttributes	Hotjar	Indicates whether the attributes cached in localStorage are up to date	Session

Google Analytics 4 does not store the full IP address (it is truncated on receipt) and its data retention is set to 14 months. Depending on the campaign configuration Google may set auxiliary cookies (for example _gid, _gcl_aw) whose duration may vary; the official list is at https://business.safety.google/adscookies/. Hotjar may additionally keep _hj… keys in localStorage/sessionStorage for the same purpose, always after consent.

4. Third-party cookies

With your consent, two providers operate on the public site:

• Google Ireland Ltd (Gordon House, Barrow Street, Dublin 4, Ireland) — Google Analytics 4 and Google Ads. Google may also process the data at Google LLC (United States) under the EU-US Data Privacy Framework. Privacy policy: https://policies.google.com/privacy.
• Hotjar Ltd (Malta, European Union; part of the Contentsquare group) — heatmaps and session recordings of the public site. Recordings automatically mask what you type into form fields and are never made inside the application or the learner portal. Legal information: https://www.hotjar.com/legal/.

Beyond that we embed no advertising pixels or tags, and no analytics or advertising provider is involved inside the application. The anti-bot check at sign-in runs by default on our own servers (ALTCHA, a proof-of-work puzzle solved by your browser): no third party is involved, it sets no cookies and it sends nothing to anyone else. As an alternative, the platform administration may enable Friendly Captcha (Friendly Captcha GmbH, Germany), which likewise sets no cookies and is listed among our sub-processors. If you embed external content in a course (for example a YouTube or Vimeo video), that provider may set its own cookies when a learner plays it; their policy then applies.

SCORM packages are served from a separate, isolated content domain with no access to the application's cookies.

5. Managing cookies

• Cookie settings (link in the footer of the public site): accept or reject each category and change your mind whenever you like. Once you withdraw consent we stop loading those scripts from that moment; cookies already set expire on their own or can be deleted in your browser (those on the doubleclick.net domain can only be removed by your browser).
• Browser: you can block or delete cookies in the settings of Chrome, Firefox, Safari or Edge. Note that blocking necessary cookies means you will not be able to sign in or use the platform.
• Google: the Google Analytics opt-out add-on (https://tools.google.com/dlpage/gaoptout) and the ad settings of your Google account (https://adssettings.google.com).
• Hotjar: honours your browser's "Do Not Track" signal and offers its own opt-out page (https://www.hotjar.com/policies/do-not-track/).

6. Changes

Any change in our use of cookies will appear on this page with a new version and date. Questions: support@kelbado.eu.