This Cookies Policy explains how Selvyo sp. z o.o. ("Selvyo", "we") uses cookies and similar technologies on:
This Policy supplements our Privacy Policy and the API Terms of Service. It is published in line with Article 5(3) of the ePrivacy Directive (2002/58/EC), the Polish Telecommunications Law (Article 173), and Articles 6, 7, and 13 of the GDPR.
A "cookie" is a small text file that a website places on your device when you visit. Cookies are widely used to make websites work, to make them work more efficiently, and to provide information to the site owner.
In this Policy, "cookies" also covers similar local-storage technologies — HTML5 LocalStorage, SessionStorage, IndexedDB, browser fingerprints, pixel tags, and SDK identifiers — to the extent they store or access information on your device. The ePrivacy rules treat these technologies the same way.
Cookies can be categorized by:
| Category | What they do | Consent needed? | Used by Selvyo? |
|---|---|---|---|
| Strictly necessary | Run the site or dashboard — login session, CSRF protection, load-balancer routing, language preference, cookie-consent preference itself. Without them the Services don't function. | No — exempt under Article 5(3) ePrivacy Directive ("strictly necessary for the provision of an information society service requested by the subscriber"). | ✅ Yes |
| Functional | Remember your non-essential preferences (theme/dark-mode, dismissed banners). | Opt-in by default, treated as "analytics-equivalent" under consent. Granular toggle in the preferences center. | ✅ Yes |
| Privacy-friendly analytics | Aggregate visitor counts, page views, traffic sources. No cross-site tracking; no advertising identifiers; IP truncated. | Consent required where local law applies it; we collect opt-in via the cookie banner. | ✅ Yes (Plausible cookieless and/or self-hosted PostHog) |
| Marketing / advertising | Build profiles, target ads across sites, share with ad networks. | Consent required. | ❌ Not used |
| Social-media / embedded third-party content | Set by embedded widgets (Twitter, LinkedIn, YouTube, etc.). | Consent required. | ❌ Not used on the website. If we embed video in documentation, we use privacy-mode embeds (e.g., youtube-nocookie.com) and load them only after consent. |
The table below lists the specific cookies we set. Names with a wildcard * may vary by deployment.
| Name | Provider | Purpose | Type | Lifetime |
|---|---|---|---|---|
vv_session | selvyo.io (first-party) | Maintains your authenticated session in the dashboard. | HTTP cookie, HttpOnly, Secure, SameSite=Lax | Session |
vv_csrf | selvyo.io | Protects against cross-site request forgery on form submissions. | HTTP cookie, HttpOnly, Secure | Session |
vv_cookie_consent | selvyo.io | Stores your cookie-preferences choice (categories you allowed). | HTTP cookie | 12 months |
vv_lb_affinity | selvyo.io (via AWS ALB) | Load-balancer affinity so consecutive requests reach the same backend during a session. | HTTP cookie | Session |
vv_locale | selvyo.io | Stores your selected interface language. | HTTP cookie | 12 months |
AWSALB, AWSALBCORS | AWS (sub-processor) | Application Load Balancer cookies for routing. | HTTP cookie | 7 days |
__Host-stripe-mid, __stripe_sid | Stripe (only on billing-checkout pages) | Stripe fraud-prevention and session token. Set only when you reach the checkout flow. | HTTP cookie | Session / up to 1 year |
| Name | Provider | Purpose | Type | Lifetime |
|---|---|---|---|---|
vv_theme | selvyo.io | Stores your light/dark/auto theme choice. | LocalStorage | Until you clear it |
vv_banner_dismissed_* | selvyo.io | Remembers in-product banners you dismissed (release notes, maintenance notice). | LocalStorage | 30–365 days |
| Name / identifier | Provider | Purpose | Type | Lifetime |
|---|---|---|---|---|
| No cookies set (cookieless mode) | Plausible Analytics (Plausible Insights OÜ, Estonia / EU) | Aggregate, anonymous page-view and traffic-source statistics. IP is processed transiently for geo-attribution and then discarded; no cross-site or persistent identifier. | Hash-only (no cookie / no LocalStorage) | n/a |
ph_* |
PostHog (self-hosted on AWS eu-central-1) |
First-party product analytics (events, funnels) for the dashboard. IP truncated. No third-party recipients. No session-replay of input fields. | LocalStorage + first-party cookie | Up to 12 months |
We do not set marketing or advertising cookies. We do not use Google Ads, Meta Pixel, LinkedIn Insight Tag, TikTok Pixel, retargeting pixels, or similar technologies on our website.
The third parties below may, where listed in Section 4, set cookies via our properties. They act as our processors or sub-processors under the contracts described in our Data Processing Agreement and our sub-processor list at https://selvyo.io/subprocessors.
| Provider | Role | Region | Their privacy policy |
|---|---|---|---|
| Amazon Web Services EMEA SARL | Hosting, load balancer (strictly necessary) | EEA (eu-central-1, Frankfurt) | aws.amazon.com/privacy |
| Plausible Insights OÜ | Cookieless analytics | EEA (Estonia / Germany) | plausible.io/privacy |
| PostHog (self-hosted) | Product analytics — runs on our own AWS instance, no data leaves Selvyo infrastructure | EEA (eu-central-1) | Governed by this Policy and our Privacy Policy |
| Stripe Payments Europe, Ltd. | Payment processing on the billing-checkout flow only | EEA + USA | stripe.com/privacy |
When you first visit the website, our cookie banner asks for your choice on non-essential cookies. You can:
You can change your choice at any time by:
vv_cookie_consent cookie in your browser; orChanging your choice has no effect on data already collected before the change, but stops further non-essential cookies from being set going forward. Withdrawal of consent is as easy as giving it.
Most browsers let you view, manage, delete, and block cookies. The exact steps vary; see the help pages of your browser:
chrome://settings/cookiesabout:preferences#privacyedge://settings/content/cookiesbrave://settings/shieldsBlocking strictly necessary cookies will break parts of the site — for example, you will not be able to sign in to the dashboard or place an order.
Do Not Track (DNT). Browser DNT signals are not interpreted consistently across the industry. We do not currently rely on DNT to override your explicit cookie-banner choice.
Global Privacy Control (GPC). Where your browser sends a GPC signal, we treat it as a valid opt-out preference signal for non-essential cookies and for the "sale"/"sharing" of personal information under U.S. state privacy laws (we do not sell or share — but we honor GPC regardless). When GPC is detected, the cookie banner defaults to Reject non-essential, and you can still adjust manually.
| Cookie category | Legal basis |
|---|---|
| Strictly necessary | Article 5(3) ePrivacy Directive — exemption; and Article 6(1)(b) and (f) GDPR — performance of a contract / legitimate interest in operating the Services. |
| Functional, analytics, marketing (where used) | Article 5(3) ePrivacy Directive — consent; and Article 6(1)(a) GDPR — consent. |
Consent must be freely given, specific, informed, and unambiguous. We do not pre-tick consent boxes, do not use "consent walls", and do not interpret continued browsing as consent.
The Selvyo iOS (Swift) SDK do not set browser cookies. They may use:
The SDKs do not collect Advertising Identifier (IDFA), and do not perform device fingerprinting or cross-app tracking. Apple App Tracking Transparency (ATT) is not triggered by the SDK in itself; the customer's application is responsible for any ATT disclosures relating to its own tracking.
We may update this Cookies Policy from time to time as our site, cookies, or applicable law change. We will revise the "Last Updated" date at the top. Material changes (for example, addition of a new cookie category or a new third-party provider) will be highlighted via the cookie banner so you can review and re-confirm your preferences.
You also have the right to lodge a complaint with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland — uodo.gov.pl, or with the supervisory authority of your residence in the EU/EEA.