OXL-12
Cookie Policy
Version 1.0 · Issued 4 August 2026 · OXXON Advisors Pvt. Ltd.
Legal review required
Notice. Prepared from the implemented website. Not legal advice. Cookie consent obligations differ materially between jurisdictions and require review by qualified legal counsel in each market of publication.
1. Scope
This Policy describes every cookie the OXXON website sets, why it is set, how long it lasts, and how you control it.
Two categories are in play. Strictly necessary cookies make the products work at all and are set without asking, because you cannot use OXXON FAST or the OXXON VERIFY evaluation gate without them. Analytics cookies are set only if you allow them; they are not essential, and consent for them is requested in advance and can be withdrawn at any time.
This Policy forms part of OXL-01 Privacy Policy and is referred to by OXL-02 Website Terms of Use.
2. What a cookie is
A cookie is a small text file a website asks a browser to store and return on later requests. It allows a site to recognise a returning browser. Similar technologies — local storage, pixels, scripts that read device characteristics — raise the same considerations and are covered by this Policy where used.
3. Cookies set by OXXON
These are set by OXXON's own applications. They carry no advertising identifier and are not shared with any third party.
| Cookie | Product | Purpose | Type | Lifetime | Attributes |
|---|---|---|---|---|---|
fast_session |
OXXON FAST | Carries which account the browser is signed in as. Without it, an account cannot be used. | Strictly necessary | Session — cleared when the browser closes | HttpOnly, SameSite=Lax |
verify_funnel |
OXXON VERIFY | Records that the visitor has passed the business-email evaluation gate, so the gate is not presented again within the same visit. | Strictly necessary | Session — cleared when the browser closes | HttpOnly, SameSite=Lax |
Both cookies carry a signed token. Neither is readable by page scripts. Neither is used for advertising, profiling, cross-site tracking or any purpose beyond the one stated.
4. Cookies set by Google Analytics
Where a deployment has been configured with a Google Analytics 4 measurement identifier, the site loads Google's analytics script, which sets cookies in Google's own name.
| Cookie | Set by | Purpose | Type | Typical lifetime |
|---|---|---|---|---|
_ga |
Distinguishes one browser from another for visit measurement | Analytics | 2 years | |
_ga_<container-id> |
Maintains session state for the GA4 property | Analytics | 2 years |
These cookies are set only if you allow them. Nothing is requested from Google, and no analytics cookie exists, unless and until you choose "Accept all" or enable the Analytics category in the preferences dialog. See Section 7.
Analytics is additionally configuration-dependent. It is not compiled into the site: the measurement identifier is read from deployment configuration and, where it is absent, no analytics script is loaded, no analytics cookie is set, and no consent is requested — there would be nothing to consent to. The default is no analytics.
Where you have allowed analytics, data is processed by Google. Google's own privacy information applies to that processing in addition to OXL-01 Privacy Policy. Advertising and personalisation signals are disabled regardless of your choice, so the data is used for measurement only.
5. Cookies OXXON does not set
The site does not use:
- advertising or retargeting cookies;
- social media tracking pixels;
- cross-site tracking of any kind;
- data brokers, audience-matching or identity-resolution services;
- fingerprinting scripts.
OXXON does not sell personal data and does not share it for advertising purposes.
The site opts out of Federated Learning of Cohorts and denies geolocation,
camera, microphone, payment, USB and motion-sensor access through its
Permissions-Policy header.
6. The desktop software sets no cookies
OXXON AUDIT for Windows is not a browser application and sets no cookies. It contains no telemetry and no analytics of any kind. See OXL-11 Security & Privacy Statement Section 3.
7. Consent
Analytics cookies are set only with your prior, affirmative permission.
The strictly necessary cookies in Section 3 do not require consent in most jurisdictions, because they are essential to deliver a service you have asked for. The analytics cookies in Section 4 do require prior consent in the European Union, the European Economic Area and the United Kingdom.
OXXON asks everyone, not only visitors in those jurisdictions. The alternative would be to geolocate you in order to decide whether to ask your permission, which is both less accurate than it sounds and a worse privacy posture than simply asking.
7.1 What you are offered
On your first visit to a page where analytics is available, a notice offers three choices:
| Choice | Effect |
|---|---|
| Accept all | Strictly necessary and analytics cookies |
| Reject non-essential | Strictly necessary cookies only |
| Manage preferences | A dialog listing each category, with analytics as a switch you control |
"Accept all" and "Reject non-essential" are presented with equal visual prominence. Neither is styled to be easier to find or easier to press than the other.
7.2 Nothing loads before you choose
Until you grant permission, the page contains no Google script at all. The analytics tag is not merely inert — it is absent, and no request is made to Google. This is verifiable in your browser's own network inspector.
As a second, independent safeguard, Google Consent Mode is initialised with every storage category set to denied before anything else runs, so that no cookie could be set even if a tag were loaded.
7.3 Remembering your choice
Your decision is recorded in a first-party cookie named ox_consent, which
holds only the version of the categories you were shown, whether analytics is
allowed, and when you decided. It contains no identifier and is never
transmitted to OXXON.
| Lifetime | 180 days from the date you decided |
| Attributes | SameSite=Lax, path=/, Secure over HTTPS |
You are not asked again while that record stands, whichever OXXON product you
move between — corporate, /audit, /verify/ and /fast/ are one host and
share it.
If the categories change materially, the record is treated as expired and you are asked again rather than having your earlier answer applied to a question you were never shown.
7.4 Changing your mind
A Cookie preferences control sits in the footer of every page that can set an analytics cookie. Withdrawal is as easy as consent, and takes effect immediately.
Withdrawing consent after having given it also deletes the _ga cookies
already set, rather than merely stopping new ones.
7.5 Where analytics is not configured at all
Where a deployment carries no measurement identifier, no consent notice is shown. There would be nothing to consent to, and a notice asking permission for cookies that would never be set trains people to dismiss the notices that matter.
The engineering record of this implementation is docs/ANALYTICS_AND_CONSENT.md.
8. Managing cookies
A visitor may block or delete cookies through browser settings. Every current browser offers this, usually under privacy or site settings.
Blocking the strictly necessary cookies in Section 3 will prevent OXXON FAST and the OXXON VERIFY evaluation gate from working. That is a consequence of what those cookies do, not a restriction OXXON imposes.
Blocking analytics cookies has no effect on site functionality.
Google publishes a browser add-on that opts a browser out of Google Analytics across all sites.
9. Changes
This Policy will be amended where the site's cookie use changes, in particular on adoption of any course under Section 7. The version and issue date at the head of the document identify the current text.
10. Contact
partners@oxxonadvisors.com
Related documents
- OXL-01 Privacy Policy
- OXL-02 Website Terms of Use
- OXL-11 Security & Privacy Statement
OXL-12 · version 1.0 · issued 4 August 2026. Questions: partners@oxxonadvisors.com or +91 99303 97685. All legal documents.