kovacDRAFT — not legally reviewed.
This notice explains what Inteligenta AIX stores in your browser when you visit this website and when you use the kovac console. It supplements our Privacy Policy.
In short: this website sets no cookies and loads no analytics. The console stores only what is strictly necessary to sign you in and to remember choices you make in it. Because none of this is used for tracking, advertising or analytics, we do not show a consent banner.
1. This website
The public website (everything outside the console at /app/):
- sets no cookies;
- loads no analytics, advertising or tracking scripts;
- loads no third-party fonts or scripts: fonts and all other files are served from our own servers.
The website’s header checks whether a console sign-in token is present in your browser (see below) so that it can show “Open console” instead of “Sign in”. It only reads that value, never stores anything, and nothing is sent to us as a result.
If we ever add analytics, we will update this notice and ask for your consent first where the law requires it.
2. The kovac console
When you sign in to the console, the following are stored in your browser. All are first-party: they are set by and sent only to this domain.
Browser storage (localStorage and sessionStorage)
kovac.jwt(localStorage): your sign-in token, which the console sends with each request to prove who you are. It expires after about one hour and is renewed while you remain signed in. Removed when you sign out. Strictly necessary.kovac.jwt.setAt(localStorage): when that token was issued, so the console can renew it before it expires. Strictly necessary.kovac.returnPath(sessionStorage): the console page to return you to after signing in. Deleted when you close the tab. Strictly necessary.kovac-theme(localStorage): your choice of light or dark appearance, if you make one. Kept until you clear it. Remembers a choice you made.kovac-nav-collapsed(localStorage): whether you collapsed the navigation menu. Kept until you clear it. Remembers a choice you made.
Cookies set by the console
session: temporary state that protects the sign-in redirect between the console and the sign-in service against forgery. HTTP-only; expires after at most 14 days. Strictly necessary.kovac_refresh: lets the console renew your sign-in token without asking you to sign in again. HTTP-only, secure, sent only to the console’s sign-in endpoints; expires after at most seven days. Strictly necessary.kovac_id_token: lets the console end your session with the sign-in service when you sign out. HTTP-only, secure, sent only to the console’s sign-in endpoints; expires after at most seven days. Strictly necessary.kovac_active_tenant: if your account belongs to more than one workspace, which one you are working in. HTTP-only, secure, sent only to the console’s sign-in endpoints; expires after at most seven days. Strictly necessary.
Cookies set by the sign-in service
Signing in is handled by a dedicated identity service on this domain, which sets its own cookies, sent only to its own paths:
AUTH_SESSION_ID,KC_RESTARTandKC_AUTH_SESSION_HASH: keep track of a sign-in attempt in progress. Removed when the browser closes or, forKC_AUTH_SESSION_HASH, after one minute. Strictly necessary.KEYCLOAK_IDENTITYandKEYCLOAK_SESSION: keep you signed in to the identity service so you are not asked for your password on every visit. Expire with your sign-in session. Strictly necessary. [[Confirm names and lifetimes against the live service.]]
3. Chat widgets on customers’ websites
Organisations that use kovac can place a chat widget on their own websites. The widget stores, in the browser’s localStorage under that organisation’s widget key, an anonymous signed visitor handle (kovac.embed.h.…) and the identifier of your current conversation (kovac.embed.t.…) and, while a page action the visitor allowed is running, a record of it with its outcome (kovac.embed.actions.…, kept for at most a day) plus a per-tab identifier in sessionStorage (kovac.embed.tab), so that the conversation survives a page reload and limits can apply per visitor. It sets no cookies. The organisation operating the website is responsible for informing its visitors about this.
4. Managing storage
You can delete cookies and site data at any time in your browser’s settings. If you block them for this domain, the console cannot keep you signed in; the public website works without them.
5. Contact
Questions about this notice: [[DPO/contact]].