Cookie Policy

1. What cookies are

A cookie is a small file a website stores in your browser. Among other things it keeps you signed in or remembers preferences such as your language.

2. Our approach

We distinguish two areas:

• Public site (home page, pricing, blog and legal pages): besides necessary and preference cookies, we use analytics cookies (Google Analytics 4) and marketing cookies (the Google Ads, Microsoft Advertising and Reddit Ads remarketing and conversion tags) only with your consent.
• Application and learner portal: necessary and preference cookies only. No third-party analytics, advertising or tracking runs inside the application or the learner portal; only our own cookieless visit statistics described below.

Under article 22.2 LSSI-CE and the Spanish DPA's guidance, necessary and preference cookies are set without consent. For everything else the public site shows a banner with three equally weighted options — Accept, Reject and Configure (choose per category) — and loads no non-essential script or cookie until you decide. Rejecting is as easy as accepting, and withdrawing consent is as easy as giving it.

Your choice is stored in your browser for 12 months (in localStorage, key kelbado-cookie-consent; it is not a cookie and is not sent to the server); after that we ask again. You can change it at any time through the "Cookie settings" link in the footer, which reopens the banner.

Marketing cookies serve only to build remarketing audiences and measure conversions of Kelbado's own campaigns. We never use customer content or learner data for advertising.

Separately, the public site and the application count visits with our own statistics that use no cookie and store nothing on your device (no localStorage either): page (in the application only the section and the role, such as author or learner — never the account), referring site, country, device type and time on the page, with a visitor identifier that changes every day and cannot be linked across days. It is described in the Privacy Policy, does not depend on the banner, and a browser sending the Global Privacy Control signal is not counted.

3. Cookies we use

3.1 Necessary and preference cookies (no consent needed)

Cookie	Type	Purpose	Duration
__Host-authjs.session-token (authjs.session-token without HTTPS)	Necessary, first-party	Keeps the user signed in	30 days
__Host-authjs.csrf-token	Necessary, first-party	Cross-site request forgery protection	Session
__Host-authjs.callback-url	Necessary, first-party	Returns you to the right page after sign-in	Session
__Host-authjs.state, __Host-authjs.pkce.code_verifier, __Host-authjs.nonce	Necessary, first-party	Protect a sign-in with Google, Microsoft or LinkedIn from being forged or replayed; set only during that sign-in	15 minutes / session
lms-locale	Preference, first-party	Remembers the chosen language	12 months
kelbado-dash-theme	Preference, first-party	Remembers the dashboard light/dark theme	12 months
kelbado-site-preview	Necessary, first-party	Lets platform administrators preview the public site before launch	12 hours

We also use browser localStorage to remember the language, the decision made in the cookie banner (kelbado-cookie-consent, 12 months) and a few interface preferences (panel state, player theme, font size and sound). It is not a cookie and is not sent to the server.

3.2 Analytics and marketing cookies (consent only)

Public site only, and only after you accept them in the banner. None is set if you reject or do not answer.

Cookie	Provider	Purpose	Duration
_ga	Google Analytics 4 (Google Ireland Ltd)	Distinguishes visitors of the public site (random identifier)	2 years
_ga_<id>	Google Analytics 4	Persists the analytics session state	2 years
_gcl_au	Google Ads	Conversion attribution: records that you arrived from an ad	90 days
IDE	Google Ads (doubleclick.net domain, third-party)	Ad measurement and remarketing audiences	13 months
test_cookie	Google Ads (doubleclick.net domain, third-party)	Checks whether the browser accepts cookies	15 minutes
_uetsid	Microsoft Advertising (UET tag)	Groups the pages of one visit for conversion measurement	1 day
_uetvid	Microsoft Advertising (UET tag)	Recognises a returning visitor for conversion measurement and remarketing audiences	13 months
_uetmsclkid	Microsoft Advertising (UET tag)	Conversion attribution: stores the click id when you arrive from a Bing ad	90 days
MUID	Microsoft (bing.com domain, third-party)	Identifies the browser across Microsoft sites for ad measurement	13 months
_rdt_uuid	Reddit Ads (Reddit Pixel)	Recognises a returning visitor for conversion measurement and remarketing audiences	90 days
_rdt_cid	Reddit Ads (Reddit Pixel)	Conversion attribution: stores the click id when you arrive from a Reddit ad	up to 90 days

Google Analytics 4 does not store the full IP address (it is truncated on receipt) and its data retention is set to 14 months. Depending on the campaign configuration Google may set auxiliary cookies (for example _gid, _gcl_aw) whose duration may vary; the official list is at https://business.safety.google/adscookies/.

4. Third-party cookies

With your consent, three providers operate on the public site:

• Google Ireland Ltd (Gordon House, Barrow Street, Dublin 4, Ireland) — Google Analytics 4 and Google Ads. Google may also process the data at Google LLC (United States) under the EU-US Data Privacy Framework. Privacy policy: https://policies.google.com/privacy.
• Microsoft Ireland Operations Ltd (One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland) — Microsoft Advertising (UET tag, for Bing search ads). Microsoft may also process the data at Microsoft Corporation (United States) under the EU-US Data Privacy Framework. Privacy statement: https://privacy.microsoft.com/privacystatement.
• Reddit, Inc. (United States) — Reddit Ads (Reddit Pixel, for ads shown on Reddit). The data is transferred to the United States under the EU-US Data Privacy Framework. If you are signed in to Reddit, your browser may also send Reddit's own cookies (reddit.com domain, third-party) with the pixel's requests; Reddit's cookie notice applies to them. Privacy policy: https://www.reddit.com/policies/privacy-policy.

Beyond that we embed no advertising pixels or tags, and no analytics or advertising provider is involved inside the application. The anti-bot check at sign-in runs by default on our own servers (ALTCHA, a proof-of-work puzzle solved by your browser): no third party is involved, it sets no cookies and it sends nothing to anyone else. As an alternative, the platform administration may enable Friendly Captcha (Friendly Captcha GmbH, Germany), which likewise sets no cookies and is listed among our sub-processors. If you embed external content in a course (for example a YouTube or Vimeo video), that provider may set its own cookies when a learner plays it; their policy then applies.

SCORM packages are served from a separate, isolated content domain with no access to the application's cookies.

5. Managing cookies

• Cookie settings (link in the footer of the public site): accept or reject each category and change your mind whenever you like. Once you withdraw consent we stop loading those scripts from that moment; cookies already set expire on their own or can be deleted in your browser (those on the doubleclick.net, bing.com and reddit.com domains can only be removed by your browser).
• Browser: you can block or delete cookies in the settings of Chrome, Firefox, Safari or Edge. Note that blocking necessary cookies means you will not be able to sign in or use the platform.
• Google: the Google Analytics opt-out add-on (https://tools.google.com/dlpage/gaoptout) and the ad settings of your Google account (https://adssettings.google.com).
• Microsoft: the personalised-ads settings of your Microsoft account (https://account.microsoft.com/privacy/ad-settings).
• Reddit: the ad personalisation settings of your Reddit account (https://www.reddit.com/settings/privacy).

6. Changes

Any change in our use of cookies will appear on this page with a new version and date. Questions: support@kelbado.eu.