Cookie Policy

1. What cookies are

Cookies are small files a website stores in your browser. Websites can also store data in the browser’s local or session storage (session storage is deleted when you close the tab). In this policy, «cookies» means all of these.

It applies to www.yourlegacy.tech and its pages, including /nfc and the digital cards. Who the controller is and how to exercise your rights is explained in the Privacy Policy (/privacidad).

2. Your choice and how to change it

The first time you visit, we ask you with three equally visible buttons:

• «Reject»: we only use what the site needs to work (section 3). No analytics or marketing tool is loaded, and we do not store the partner code or the campaign.
• «Accept all»: you allow both categories, «Analytics» (section 4) and «Marketing» (section 5).
• «Customize»: you choose each category separately, with nothing ticked in advance, and press «Save my choice». You can allow analytics without marketing, or the other way round: each tool only loads with its own category’s permission.
• Until you choose, none of those tools is loaded and nothing from sections 4 and 5 is stored.
• If your browser sends Global Privacy Control (GPC) or «Do Not Track» (DNT), we treat it as «Reject», even if you accepted a category before: we do not ask you and, while the signal stays on, none can be switched on.
• We keep your choice for 12 months in your browser, with the version of this notice and the date and time you chose. After that, we ask again.

You can withdraw or change your permission at any time, as easily as you gave it: with «Cookie preferences» at the bottom of every page, or with the button below, which open «Customize» with what you had chosen. If you remove a category, we stop loading its tools and delete their cookies from our domain; if you remove «Marketing», also the stored partner code and campaign. If they were running, we reload the page to stop them. Withdrawing does not affect what happened before. Data already received by Google, Meta or PostHog is kept by each of them according to its settings and policy.

3. Necessary cookies (no permission needed)

YourLegacy Tech sets them on its own domain and does not share them. Without them, signing in, your language or remembering your cookie choice would not work.

• yl-cookie-consent

  Type:

  Local storage

  What it does:

  Remembers what you chose in the cookie notice: each category, the notice version and the date and time

  Duration:

  12 months

• yl_demo_token

  Type:

  Cookie (HttpOnly, Secure)

  What it does:

  Keeps you signed in to the team area or the demo portal

  Duration:

  Up to 24 hours; closes after 1 hour of inactivity

• yl-sesion-ultima-actividad

  Type:

  Local storage

  What it does:

  Records your last activity so the session closes on time

  Duration:

  While the session lasts

• gate_access

  Type:

  Cookie (HttpOnly, Secure)

  What it does:

  Lets you open a private document after entering its code

  Duration:

  12 hours

• yl_afiliado

  Type:

  Cookie (HttpOnly, Secure, SameSite=Strict)

  What it does:

  Affiliates only: keeps your portal open after you enter with your private link, so the link does not stay in the address bar. It is only sent to the part of the site that serves the portal data

  Duration:

  Up to 8 hours (never longer than your link); deleted with the «Salir» (sign out) button

• yl_invitado

  Type:

  Cookie (HttpOnly, Secure, SameSite=Strict)

  What it does:

  Guests only: keeps the document portal open after you enter with your private link, so the link does not stay in the address bar. It is only sent to the part of the site that serves the portal documents

  Duration:

  Up to 8 hours (never longer than your link)

• yl_propuesta

  Type:

  Cookie (HttpOnly, Secure, SameSite=Strict)

  What it does:

  Clients only: keeps your proposal open after you enter with your private link, so the link does not stay in the address bar. It is only sent to the part of the site that serves the proposal

  Duration:

  Up to 8 hours

• ag_gate_<id>, demo_access_token

  Type:

  Session storage

  What it does:

  Remember that you unlocked a private page or the demos

  Duration:

  Until you close the tab

• yl-diagnostico-a-contacto

  Type:

  Session storage

  What it does:

  Carries your answers from the website check to the contact form when you choose to use it; deleted once read

  Duration:

  Up to 30 minutes or until you close the tab

• yl-locale, hub_lang, gl-lang, demo_lang, mip_lang

  Type:

  Local storage

  What it does:

  Remember your language

  Duration:

  Until you clear it

• theme

  Type:

  Local storage

  What it does:

  Remembers light or dark mode

  Duration:

  Until you clear it

• yl_compass_pos

  Type:

  Local storage

  What it does:

  Remembers where you placed the floating menu on /nfc

  Duration:

  Until you clear it

• yl-nfc-contact:<card>

  Type:

  Local storage

  What it does:

  Remembers that you already shared your contact from a digital card, so we do not ask again

  Duration:

  180 days

• Demo states (for example, costera-demo-huracan)

  Type:

  Local storage

  What it does:

  Remembers what you closed or chose inside a demo

  Duration:

  Until you clear it

Team only: when signing in with Google, Firebase (Google) keeps the sign-in in the browser (IndexedDB), and the dashboard remembers some display preferences (yourlegacy_sidebar_collapsed, yl_notifications_v2).

4. Analytics (only if you allow «Analytics»)

They count visits and tell us what works on the site. They belong to US companies and process the data in the United States (section 7).

• Google Analytics 4 — Google LLC (US)

  Cookies:

  _ga, _ga_<ID>

  Purpose:

  Count visits, page views and conversions (for example, a submitted form), to learn what works on the site.

  Duration:

  2 years

• PostHog — PostHog, Inc. (US)

  Cookies:

  ph_<key>_posthog (cookie and local storage)

  Purpose:

  Product analytics: page views, page exits and conversions. No automatic click capture and no session recording.

  Duration:

  1 year

When you submit a form, these tools receive the event (for example, «contact» with the type of service, or the step and sector of a questionnaire). We do not send them your name, email, phone or message.

Google Analytics starts with no advertising storage or signals (Google’s «consent mode» with advertising denied, and no Google Signals): allowing analytics is not used for Google ads.

5. Marketing (only if you allow «Marketing»)

They measure our ads and tell us who referred you. The Meta Pixel belongs to a US company and processes the data in the United States (section 7). We keep the partner code, the campaign and the card source ourselves, in your browser: if you arrive from a partner link (?ref=CODE) or a campaign (utm_…), we use it to know who referred you and to pay their commission if you hire us.

• Meta Pixel — Meta Platforms, Inc. (US)

  Cookie or storage:

  _fbp; _fbc only if you arrive from an ad

  Purpose:

  Measure the results of our ads on Facebook and Instagram and show them to people who may be interested. Meta may combine this data with data it already has about you and also use it for its own purposes, under its policy.

  Duration:

  90 days

• Partner code — YourLegacy Tech

  Cookie or storage:

  yl_ref (local storage)

  Purpose:

  Remembers the code of the partner who sent you (the latest partner link replaces the previous one)

  Duration:

  90 days

• Campaign — YourLegacy Tech

  Cookie or storage:

  yl_utm (local storage)

  Purpose:

  Remembers the first campaign or website you came from and your first page

  Duration:

  90 days

• Card source — YourLegacy Tech

  Cookie or storage:

  ylt_referral (local storage)

  Purpose:

  Remembers which card or bio link you came from

  Duration:

  30 days

When you submit a form, the Meta Pixel receives the event (for example, «contact» with the type of service). We do not send it your name or your message; your email and phone can only reach it as a hash, as explained next.

Meta Conversions API (only with «Marketing»): when you send the contact form or the website check, our server may tell Meta about that enquiry, with the same identifier as the pixel event so it is not counted twice. It sends your email and phone as a SHA-256 hash (a code, not the text), which Meta compares with those of its accounts to know which ad brought the enquiry, together with your IP address, your browser details and the _fbp and _fbc cookies if present. We do not send your name, company, answers or message. With «Reject» or «Analytics» only we send nothing. Meta may also use this data for its own purposes, under its policy.

Without «Marketing» we do not store the partner code, the campaign or the card source: the code only travels in the page address while you browse and is sent with the form if you write to us during that visit. If you write to us, the code stays with your request in our customer system so we can pay the commission; the Privacy Policy explains this.

6. Third-party services that do not set cookies on our site

These services receive technical data, such as your IP address and browser type, when the page connects to them:

• Sentry — Functional Software, Inc. (US)

  When:

  On every visit

  What it receives and why:

  Technical error reports to fix the site, with emails, phone numbers and keys removed, and without your cookies or browser headers. It sets no cookies. We use it under our legitimate interest in keeping the site working.

• Cloudflare Turnstile — Cloudflare, Inc. (US)

  When:

  When you submit some forms

  What it receives and why:

  Browser signals to check that you are not a bot.

• unpkg.com, cdnjs.cloudflare.com and images.unsplash.com

  When:

  Some static pages, such as /nfc and the digital cards

  What it receives and why:

  They serve the page’s icons, libraries or images.

• Stripe — Stripe, Inc. (US)

  When:

  When you pay

  What it receives and why:

  The checkout page is on Stripe’s domain and uses its own cookies, under its policy.

• ElevenLabs — ElevenLabs, Inc. (US)

  When:

  Voice demo in the demo portal (signed in only)

  What it receives and why:

  Your voice and the conversation with the assistant, which is an artificial intelligence. You are told before the call: the conversation is recorded and kept for 30 days.

7. Transfers to the United States

Google, Meta, PostHog, Sentry, Cloudflare, Stripe and ElevenLabs are US companies and the data they receive is processed there. For visits from the European Union, the transfer relies on the EU-US Data Privacy Framework where the provider is certified or, otherwise, on the European Commission’s standard contractual clauses. Even so, US authorities may request access to that data under US law. That is why analytics and marketing only load with your permission, each with its own category’s.

If you live in California: the Meta Pixel may count as «sharing» data for advertising. It does not load without your «Marketing» permission, and choosing «Reject» or leaving «Marketing» unticked keeps it off.

8. How to manage cookies in your browser

You can also block or delete cookies and site data in your browser settings (Chrome, Safari, Firefox, Edge). If you block the necessary ones, some parts may not work, such as signing in or remembering your language.

Google offers an add-on to opt out of Google Analytics (tools.google.com/dlpage/gaoptout), and Meta lets you manage your ads in your account settings.

9. Changes to this policy

When we add, remove or change a cookie, we will update this page and its date. If the change affects what needs your permission, we will ask you again.

NFC cards and save memory

The contact works if you choose «Reject». We remember your cookie choice in this browser. On an NFC card link, the page reloads once after choosing if the browser can retain that choice.

For up to 180 days, per card and in this browser, we remember whether you requested the card or confirmed saving it. This local memory contains only the status and date: no photo or personal details, no address-book access, and no newsletter or WhatsApp permission. Clear this site’s browser data to remove it. If storage is blocked, the card still works but your choice will not be remembered between visits.