Cookie Policy
Last updated
This policy explains the cookies and similar technologies used on lbreeze.com and in the lbreeze customer portal, what each one is for, and how to control them. It sits alongside our Privacy Policy, which explains everything else we do with personal data.
1. What a cookie is, and what the law requires
A cookie is a small file a site stores in your browser so it can recognise the browser on a later request. The same rules cover related technologies, including local storage, session storage and pixels, and where we use those we treat them exactly as we treat cookies.
Regulation 6 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 lets us store information on your device without asking only where it is strictly necessary to provide the service you have asked for. Everything else needs your consent before it is set, not after. That is why our banner appears before any non-essential cookie is placed, why rejecting is as easy as accepting, and why nothing in the optional categories runs until you choose.
2. Strictly necessary cookies
These are set without asking, because the site cannot work without them. You cannot turn them off through our banner, though your browser can block them, in which case signing in will not work.
| Cookie | Purpose | Expires |
|---|---|---|
zephyr.session_token, or __Secure-zephyr.session_token over HTTPS |
Keeps you signed in to the customer portal and the admin area. Holds an opaque session reference, not your password. | On sign-out, or after the session lifetime configured on your account |
zephyr-consent |
Remembers the cookie choices you made, so we do not ask again on every page. Holds your decisions and the version of the banner you answered. | 6 months |
| Load balancing and security cookies set by our edge and infrastructure providers | Route your request to a healthy server and defend against automated abuse | Session, or as stated by the provider |
We also use short-lived tokens in your browser's storage to protect forms against cross-site request forgery. These are strictly necessary and are cleared when you close the tab.
3. Optional cookies
These are set only if you consent, and only for the categories you accept.
| Category | What it does | Set by | Expires |
|---|---|---|---|
| Analytics | Counts visits and measures which pages and journeys are used, so we can improve them. We do not use it to identify you personally or to build an advertising profile. | lbreeze, first-party and self-hosted | No cookie is set: our analytics does not store anything in your browser |
| Marketing and attribution | Records that a visit came from a particular campaign or partner, so that a referral is credited correctly and we can measure whether advertising works. | lbreeze | 90 days |
| Preferences | Remembers non-essential choices such as a chosen theme or a dismissed notice. | lbreeze | 12 months |
4. Third-party content
Some pages embed content from third parties, such as a video player, a documentation site or a status page. Where that happens the third party can set its own cookies once the content loads, under its own policy and outside our control. We load embedded content only after you have accepted the relevant category, or behind a click-to-load placeholder, so that nothing is set before you choose.
5. Changing your mind
Use the Cookie settings link in the footer of any page. It reopens the banner with your current choices, and any change takes effect immediately: accepting a category turns it on for the rest of the visit, and withdrawing consent stops us setting anything further in that category and asks the provider to drop what it holds where the provider supports it.
Your browser can also block or delete cookies, usually under Privacy or Site settings. Blocking strictly necessary cookies will break sign-in, and deleting the zephyr-consent cookie means the banner will ask you again on your next visit.
6. Do Not Track and Global Privacy Control
Browsers send these signals inconsistently and there is no settled standard for them. We treat a Global Privacy Control signal as a valid withdrawal of consent for the analytics and marketing categories, and act on it without asking. We do not act on Do Not Track headers, because they carry no reliable meaning.
7. Keeping this list accurate
We re-check the cookies actually set by our sites against this table, and update the table when a provider changes, a feature is added, or a cookie's lifetime changes. If you find a cookie on one of our pages that is not described here, tell us at privacy@lbreeze.com and we will either document it or remove it.
8. Changes to this policy
The current version is always at lbreeze.com/legal/cookies with the date it was last updated. Where we add a new category of optional cookie, we will ask for consent again rather than relying on a choice you made before that category existed.