Cookie Policy · Bluvense Lead Intelligence

The complete list

This is not a representative sample. These are the only cookies the platform sets.

bluvense_session

Keeps you signed in between requests.

CategoryStrictly necessary

ContentsAn opaque random token. Nothing about you is encoded in it, and the database stores only its SHA-256 hash — so a stolen database yields no usable credential.

Readable by scriptsNo. It is set httpOnly, so JavaScript on the page cannot read it.

Cross-site behaviourSameSite=Lax, and marked Secure in production.

Set whenYou sign in. Cleared when you sign out.

ExpiresAt the end of the session lifetime — by default a maximum of 30 days, or after 72 hours without use, whichever comes first.

bluvense_csrf

Proves that a form submission came from our own pages.

CategoryStrictly necessary

ContentsA random token. It holds no personal data and identifies nobody.

Readable by scriptsYes, by design. The page has to copy the value into a hidden form field so the server can compare the two. The protection is that a site on another origin cannot read the cookie to make that copy.

Cross-site behaviourSameSite=Lax, and marked Secure in production.

Set whenOn your first page view, whether or not you have an account.

ExpiresSeven days, then reissued.

bluvense_google_oauth

Protects a Google sign-in round trip. Set only while that flow is in progress.

CategoryStrictly necessary

ContentsA signed, time-limited token holding the OAuth state and PKCE verifier. It is not your Google password and it is not a Google cookie.

Readable by scriptsNo. It is set httpOnly.

Cross-site behaviourSameSite=Lax, and marked Secure in production.

Set whenYou click Continue with Google. Cleared when Google sends you back, or after ten minutes.

ExpiresTen minutes.

What we do not set

We do not use analytics, advertising, marketing, personalisation, profiling or social-media cookies, and we do not set any third-party cookie. There is no Google Analytics, no advertising pixel, no remarketing tag and no cross-site tracking of any kind.

This is enforced technically as well as stated as policy: the Content Security Policy issued with every page restricts what the browser may load to our own origin, so a third-party tracker could not run even if one were added by accident.

Not a cookie: your theme preference

Whether you prefer light or dark mode is stored in your browser’s local storage under the key bluvense-theme. That is not a cookie: it stays on your device and is never sent to our server. Clearing your site data removes it, and the interface falls back to your operating system preference.

Not a cookie: the assistant thread

The public assistant keeps a random identifier in sessionStorage under the key bluvense-assistant-visitor so a follow-up question stays in the same conversation. It dies with the tab, is never a cookie, and is not joined to an account. Closing the tab starts a fresh thread.

Why there is no cookie banner

Under the UK Privacy and Electronic Communications Regulations and the EU ePrivacy Directive, consent is not required for cookies that are strictly necessary to provide a service the user has asked for. All of our cookies are in that category: without them you could not stay signed in, submit a form safely, or complete Google sign-in.

Interrupting every visitor with a consent dialogue that offers no real choice would be theatre. If we ever introduce a cookie that is not strictly necessary, we will ask for your consent first, and you will be able to refuse without losing access.

Managing cookies

Every major browser lets you view, block and delete cookies, usually under privacy or site settings. You can do that here at any time, but it has consequences:

Deleting or blocking the session cookie signs you out and prevents you signing in again.
Deleting the CSRF cookie makes form submissions fail until you reload the page, at which point a new token is issued.

Blocking cookies entirely leaves the public marketing pages readable, but makes the product itself unusable.

Related policies

The Privacy Policy explains what we do with the data behind the session — including the IP address and browser user agent recorded against each sign-in, and how long those records are kept.

Changes to this policy

If we add, remove or change a cookie, we will update this page and the date at the top. A new non-essential cookie would additionally require your consent before it was set.