Cookies policy

1. What is a cookie?

A cookie is a small text file placed by a website on the user's device (computer, smartphone, tablet) and read on subsequent visits. Cookies enable, among other things, the maintenance of an authentication session, the memorisation of preferences or audience measurement.

This policy covers the use of cookies and equivalent technologies (local storage, session storage, fingerprinting) by the prosio.be website and the Prosio application.

2. Legal framework

Cookies and equivalent technologies are governed by Belgian electronic communications legislation, the ePrivacy Directive and, where personal data is involved, the GDPR. Operations strictly necessary for communication or an expressly requested service may be exempt from consent. Other purposes require a prior, informed and withdrawable choice.

Prosio offers a separate choice to remember workspace appearance between visits. This choice does not authorise prospecting or access to your mailbox.

3. Strictly necessary cookies

Sign-in, OAuth security and preference cookies needed for requested features support authentication, provider connection flows, language and sender account selection. The appearance control above does not disable these cookies. Blocking authentication cookies prevents access to protected features; public pages remain accessible.

4. List of cookies used

Supabase session cookies: named sb-<project-reference>-auth-token, possibly split into several chunks. They maintain and refresh the session. The installed SDK defaults to a cookie lifetime of 400 days; actual session validity also depends on the authentication server. They are not all HttpOnly.

NEXT_LOCALE: FR/NL/EN language preference managed by next-intl when saved. The current configuration sets no persistent lifetime: session cookie.

outlook_oauth_state and outlook_oauth_return_to: security and return path for the Microsoft connection flow, up to 10 minutes, HttpOnly, SameSite=Lax, Secure in production.

prosio_google_oauth: encrypted Google connection state, up to 10 minutes, HttpOnly, SameSite=Lax, Secure over HTTPS.

prosio_mailbox: user-requested sender address and provider preference, HttpOnly and SameSite=Lax, stored for up to 365 days. Contains no mailbox token.

prosio_preferences: your choice to allow or refuse remembering appearance, choice version and date, for up to 180 days. Used to respect your choice, without a user identifier.

prosio_dark and prosio_rail: theme and menu state, only after permission to remember them. SameSite=Lax cookies, Secure over HTTPS, accessible to site JavaScript, with no sign-in identifier or token. They expire no later than your permission, 180 days after your choice. Refusing or withdrawing removes them.

prosio-mailbox-refresh:<user-identifier>: browser local storage used by reply synchronisation to coordinate checks between tabs. Contains a check timestamp and batch position, not email content. This local storage has no automatic expiration and remains until cleared in the browser.

This inventory describes application mechanisms. Their presence depends on the features used; deployment services and provider pages may have their own mechanisms.

5. Audience measurement

The application code does not integrate an audience measurement service, advertising pixel or retargeting tool. The appearance control does not activate any such service.

Technical logs, CRM action history and business indicators are separate from audience measurement: they may be associated with a user or contact. They are not presented as always anonymous. Their purposes and retention information are described in the privacy policy.

6. Third-party cookies

Connection flows may open Google or Microsoft pages; those providers apply their own policies on their domains. Signing in to Prosio is separate from authorising a professional mailbox.

Displaying a remote image, for example in a signature or catalogue, may contact its hosting server and disclose technical information such as the IP address. Choosing to remember appearance does not consent to third-party tracking. Providers’ policies and browser settings apply to their own storage.

7. Retention period

Lifetimes are listed in the inventory. Changing the theme or menu does not renew your permission. Without a valid choice, the application does not remember these two preferences between visits. A cookie’s lifetime does not guarantee that the server session remains valid for that whole period. Browser local storage is separate from cookies and may need to be cleared separately.

8. Consent

Remembering the theme and menu between visits is disabled until you allow it. You can allow or refuse it in the same place, without affecting access to the CRM. Without permission, appearance changes remain available during your visit. You can withdraw permission using the button above. This choice includes no advertising or audience measurement purpose.

9. Management by the user

The “Cookie preferences” link in the CRM menu and the Cookies link at the bottom of public pages provide access to this control at any time. Refusing or withdrawing removes appearance cookies without removing sign-in cookies.

You can also clear cookies and local storage in your browser settings. Removing authentication cookies may sign you out. Your choice applies to this browser and domain; it does not automatically carry over to other devices.

10. Contact

For any question relating to this cookie policy: contact@prosio.be.