The one cookie we set
| Name | Purpose | Type | Expires |
|---|---|---|---|
lyl_session | Keeps you signed in to your business dashboard and prevents request forgery. | Strictly necessary | On sign-out, or when the session expires |
It is set only after you log in. It contains a signed session token, not your name, email or any customer data. Visitors to the public marketing pages are not given a cookie at all.
Why there is no cookie banner
Under the ePrivacy Directive and the GDPR, consent is required for cookies that are not strictly necessary — analytics, advertising, personalisation, embedded third-party media. Cookies that exist purely to deliver a service the user asked for, such as keeping a logged-in session alive, are exempt.
Loyalito only sets the second kind. Presenting you with a consent dialog would be theatre: there would be nothing to decline. If that ever changes, the banner appears before any non-essential script runs, and declining will genuinely block it.
What we do not use
- No Google Analytics, or any other analytics product.
- No advertising or retargeting pixels.
- No social media trackers or share widgets.
- No session recording or heatmap tools.
- No cross-site tracking of any kind.
Local storage
Inside the dashboard we store two small preferences in your browser’s local storage rather than in cookies: whether your sidebar is collapsed, and which location the scan screen last used. These never leave your device, are not sent to our servers, and are not used to identify you. Clearing your browser data removes them.
Cookies on your customers’ side
The public join page, where your customers sign up for a loyalty card, sets no cookies. Wallet passes are held by Apple Wallet or Google Wallet on the customer’s device; those apps are governed by Apple’s and Google’s own policies, not ours.
Managing cookies
You can block or delete cookies in your browser settings. Blocking lyl_session will prevent you from staying signed in, since there is no other way for the dashboard to know who you are.
Related
See the privacy notice for how personal data is handled more broadly, and the sub-processor list for every third party involved in running the service.