ZeroCarbon Enterprise Logo
STATUTORY DISCLOSURE | ePRIVACY DIRECTIVE · GDPR ART. 5(3) · DPDP

COOKIE POLICY

web storage & telemetry notice

Technical specification of HTTP cookies, local storage primitives, security tokens, and diagnostic telemetry employed across the ZeroCarbon Enterprise web application.

Effective DateSeptember 29, 2026
Legal RefZC-LEG-CKY-2026-V2
Audit StatusFully Compliant
Consent ModelExplicit Opt-In
Audit Status: Fully Compliant
Consent Framework: Explicit Opt-In (EU/UK/IN)
01/Fundamentals

1. What Are Cookies & Storage Tokens

Cookies are small cryptographic text files placed on your browser or device by web servers. They allow websites to remember user state, authenticate sessions, maintain security defenses (CSRF prevention), and optimize computational throughput.

In modern web applications, cookies are augmented by HTML5 LocalStorage and SessionStorage, which store serialized state client-side without transmitting credentials on every HTTP request header.

02/Taxonomy

2. Cookie Classifications Used

Strictly Necessary

Essential for authentication, 2FA validation, load balancing, and CSRF token verification. These cannot be disabled.

Functional & State

Maintains organization workspace selection, currency toggles, table pagination states, and reporting views.

Performance Telemetry

Anonymous Web Vitals, page rendering latency, and error tracing to ensure reliable execution of carbon calculations.

03/Active Matrix

3. Active Cookie & LocalStorage Matrix

Key NameStorage TypeLifespanPurpose
company_auth_tokenHTTP cookie (HttpOnly, Secure, SameSite=Strict)7 daysYour signed-in session. Script on the page cannot read it.
trusted_device_tokenHTTP cookie (HttpOnly, Secure, SameSite=Strict)30 days, if you choose "trust this device"Skips the email sign-in code on a device you trusted.
admin_tokenHTTP cookie (HttpOnly, Secure, SameSite=Strict)24 hoursZeroCarbon staff console sessions only.
cookieConsentLocal storageUntil you change itRemembers your cookie choice. The choice is also recorded with its date and time.
_ga, _ga_*HTTP cookie (Google Analytics)Up to 2 yearsSite traffic measurement. Set only if you choose "Accept All Cookies".
04/Third Parties

4. Third-Party Telemetry & Analytics

ZeroCarbon does not deploy intrusive third-party cross-site advertising trackers. We employ privacy-focused telemetry:

  • Vercel Speed Insights: Measures real-user Core Web Vitals anonymously to optimize page render speed.
  • Cloudflare / AWS CloudFront: Manages DDoS mitigation and edge SSL certificates without collecting user identifiers.
06/Governance

6. Policy Updates & Inquiries

ZeroCarbon Privacy & Security Operations

Email: privacy@zerocarbon.org.in

Legal: legal@zerocarbon.org.in