Cookie Policy
Effective as of April 10, 2026 · Last updated: September 21, 2026
A complete list of every cookie we use, why, and how to turn off the ones you don't want. Questions? privacy@incluxa.com
What Are Cookies?
Cookies are small text files placed on your device by a website. We also use similar technologies such as local storage for specific functional purposes — all subject to the same controls in this policy.
Types of Cookies We Use
- Strictly necessary — Required for authentication, security, and payment processing. Cannot be disabled without breaking the site.
- Functional — Remember your preferences like theme and layout, and Google Sign-In cookies if you choose Sign in with Google. Optional.
- Analytics — Aggregate, anonymized usage data to improve the product. Optional. Disabled by default in the EEA.
We do not use advertising cookies, tracking pixels, or third-party marketing cookies. The only third-party cookies are the Stripe and Cloudflare security cookies and, if you choose Sign in with Google, Google's sign-in cookies.
Cookies We Set
| Cookie name | Type | Provider | Purpose | Duration | Optional? |
|---|---|---|---|---|---|
| __Host-incluxa_session | Strictly necessary | incluxa.com | Encrypted session cookie (AES-256, iron-session). Stores your login session. Host-only (no subdomain scope), HttpOnly, Secure, SameSite=Strict. Required for authentication. | 8 hours (sliding) | No |
| __Host-incluxa_device | Strictly necessary | incluxa.com | Trusted device token set after successful two-factor authentication. Allows your browser to skip the 2FA challenge on subsequent logins for up to 30 days. Host-only, HttpOnly, Secure, SameSite=Strict. Cleared on logout or when you revoke the device in Security Settings. | 30 days | No |
| __stripe_mid, __stripe_sid | Strictly necessary | Stripe | Required by Stripe during checkout to prevent fraud and ensure secure transactions. | 1 year / session | No |
| _cfuvid, cf_clearance | Strictly necessary | Cloudflare | Cloudflare security cookies for bot detection and DDoS protection. | Session / 1 year | No |
| incluxa_consent | Strictly necessary | incluxa.com | Stores your cookie consent preferences. | 12 months | No |
| incluxa_prefs | Functional | incluxa.com | Remembers your portal preferences such as sidebar state, theme, and table display options. | 12 months | Yes |
| Google Sign-In cookies | Functional | Google (accounts.google.com) | Set by Google on accounts.google.com only if you choose Sign in with Google. Used to run the sign-in flow and remember your Google sign-in state. Governed by Google's privacy policy. | Set by Google | Yes |
| _a11y_analytics | Analytics | incluxa.com | Aggregate, anonymized analytics. No personal identifiers. IP anonymized before storage. | 13 months | Yes |
Widget Cookies (Third-Party Websites)
When the INCLUXA widget is embedded on a customer's website, it may set a cookie (_a11y_prefs) to save that visitor's accessibility preferences. This cookie contains an encrypted token — no personal identifiers. The website operator's cookie policy governs this cookie.
How to Control Cookies
Privacy Choices: Use the "Privacy Choices" link in our footer to update your functional and analytics cookie preferences at any time.
Browser settings:
- Chrome: Settings → Privacy and security → Cookies and other site data
- Firefox: Settings → Privacy & Security → Cookies and Site Data
- Safari: Settings → Privacy → Manage Website Data
- Edge: Settings → Cookies and site permissions
Blocking strictly necessary cookies will prevent you from logging in to the INCLUXA portal.
Updates and Contact
We update this policy when we add or remove cookies. Material changes are announced on incluxa.com. The "last updated" date at the top reflects the current version.
Questions: privacy@incluxa.com