Cookie policy

Cookies are small files a website stores in your browser. We also use similar browser storage (localStorage and sessionStorage). This policy covers crescelo.com and the Crescelo dashboard. It also describes what the chat widget stores on the websites of businesses that use it.

We do not use advertising cookies or cross-site tracking. We use Google Analytics only if you accept it (section 3A); until then only the cookies in section 2 are set.

These are needed for the service to work and are set without asking, as the law permits:

• kortex_admin_session (cookie, HttpOnly, secure): keeps you signed in to the dashboard. Expires when the session ends or after its set lifetime.
• crescelo_oauth (cookie, short-lived): protects the "Sign in with Google" step against forgery. Deleted when sign-in completes.
• Security and rate-limit signals: server-side records tied to your IP address, kept briefly, to stop abuse. No cookie is set for this.

• kortex_theme and kortex_site_theme (localStorage): remember light or dark mode.
• kortex_onboarding_completed (localStorage): remembers that you finished the dashboard tour.
• crescelo_a11y (localStorage): remembers your accessibility menu choices (text size, contrast, colours and so on). It never leaves your browser.

If you choose "Accept analytics" in the cookie notice, we load Google Analytics, which sets the cookies _ga and _ga_* (up to about 2 years) to count visits, see which pages are used and find problems. IP addresses are anonymised, and Google’s advertising and personalisation features are switched off. If you choose "Reject", Google Analytics is not loaded and no analytics cookies are set. You can change your choice at any time with "Cookie settings" in the footer of the website; withdrawing consent also deletes the analytics cookies.

When a business adds the Crescelo assistant to its website, the widget stores a random visitor identifier (ai_ast_visitor_id, in localStorage) so the conversation can continue if you reload the page, and a conversation identifier in the same way. It does not contain your name or email and is not used for advertising. The business that installed the widget is responsible for its own cookie notice and for asking for consent where the law requires it.

• Google reCAPTCHA (on sign-in, registration and contact forms): checks that a request comes from a person. Google may set cookies and process signals such as IP address and browser behaviour under its own privacy policy. We use it to protect the service, which is why it is treated as necessary for security.
• Lemon Squeezy (on checkout and the customer portal, which Lemon Squeezy hosts): sets cookies needed for secure payment and fraud prevention under Lemon Squeezy’s own policy.
• Sign in with Google: when you choose it, Google’s pages may set their own cookies.

You can delete or block cookies and clear localStorage in your browser settings. If you block the strictly necessary ones you will not be able to sign in. Browser "Do Not Track" and Global Privacy Control signals are respected: because we do not sell or share personal data for advertising, there is nothing to opt out of.

Questions: https://www.crescelo.com/support/contact. Last updated September 24, 2026.