Legal
Cookie notice.
Last updated: 12 May 2026
1. What cookies are
Cookies are small text files that a website stores on your device when you visit it. They let the site remember things about your visit — that you are signed in, what language you prefer, whether you have accepted analytics — so it can behave consistently the next time you load a page. Similar technologies (local storage, session storage, pixels, and device fingerprints) are used for the same purposes; in this notice we use the word “cookies” to cover all of them.
Yallo AI Certs is operated by YALLO Management Consultancies LLC, Dubai, UAE. For the full picture of how we handle personal data, see our privacy notice.
2. Cookie categories we use
- Strictly necessary. Required for the site to function — authentication, session continuity, security tokens, load balancing, and your cookie-consent choice itself. Without these the Service cannot be delivered. Retention ranges from the length of your session up to one year. Legal basis: necessary for the performance of the contract you have with us (Art. 6(1)(b) GDPR; Art. 5(c) UAE PDPL). No consent required.
- Functional. Remember preferences such as language, theme, and dismissed banners. Retention up to one year. Legal basis: legitimate interest in providing a coherent user experience, or your consent where required by local law.
- Analytics. Help us understand which lessons are useful, where learners drop off, and which pages perform. Wherever possible we use aggregated and pseudonymised metrics. Retention up to 14 months. Legal basis: your consent (Art. 6(1)(a) GDPR; Art. 6 UAE PDPL). You can withdraw it at any time.
- Security and anti-abuse. Detect automated traffic, prevent credential stuffing, and protect payment forms. Retention is typically short-lived (session up to 30 days). Legal basis: legitimate interest in keeping the Service and our learners safe (Art. 6(1)(f) GDPR; Art. 5(g) UAE PDPL).
3. Specific cookies and similar technologies
The table below lists the main cookies set when you use the site. Exact names may vary slightly as our providers update their SDKs; the patterns are stable.
| Provider | Name / pattern | Purpose | Type | Duration |
|---|---|---|---|---|
| Yallo AI Certs | yc_consent | Stores your cookie-consent choice. | Strictly necessary | 1 year |
| Supabase | sb-* | Authenticated session and refresh tokens. | Strictly necessary | Session up to 1 year |
| Yallo AI Certs | __Secure-next-auth.session-token | Server-side session for signed-in routes. | Strictly necessary | 30 days |
| Stripe | __stripe_mid, __stripe_sid | Fraud prevention on payment forms. | Strictly necessary | 1 year / 30 minutes |
| Cloudflare | cf_clearance | Turnstile bot-protection challenge result. | Security | 30 days |
| Google Analytics | _ga, _ga_* | Distinguishes unique visitors and sessions. | Analytics | 2 years / 13 months |
| PostHog | ph_* | Product analytics and funnel measurement. | Analytics | 13 months |
| Vercel | __vcl_* | Edge load-balancing and deployment routing. | Strictly necessary | Session |
Sanity and Resend do not set cookies on the public site; they operate server-side for content delivery and transactional email.
4. Third-party cookies and embeds
Some pages embed third-party surfaces that may set their own cookies when loaded. These are governed by the third party's own privacy and cookie policies, not ours.
- Stripe — payment forms set Stripe cookies for fraud prevention and to remember a returning purchaser.
- Cloudflare Turnstile — the bot-protection challenge embedded on contact, waitlist, and assessment forms.
- Embedded video — we use YouTube's privacy-enhanced mode (youtube-nocookie.com) where available, so that no tracking cookies are set until you press play.
- Sign in with Google — when you choose this sign-in option, Google sets its own cookies on the consent screen it serves.
5. How we ask for consent
Strictly necessary cookies are set as soon as you load the site, because the site cannot be delivered without them. Analytics and non-essential security cookies are only loaded after you accept them. Your choice is stored in a first-party cookie on your device, so we can honour it on subsequent visits without asking again.
You can change your choice at any time. A “Cookie preferences” link in the site footer will reopen the consent panel; until that link is in place you can email [email protected] and we will withdraw your consent on our side immediately.
6. How to manage cookies in your browser
Independently of our consent panel, every modern browser lets you inspect, block, or delete cookies. Some controls also let you treat third-party cookies more strictly than first-party ones.
Blocking strictly necessary cookies will prevent you from signing in or completing a purchase.
7. Do Not Track
Browser-level “Do Not Track” signals are not consistently defined or honoured across jurisdictions, and most modern browsers no longer ship them by default. We therefore treat your explicit choice in our consent panel — and any analytics opt-out you have set at the browser or operating-system level — as the canonical signal. If both indicate you do not want analytics, we do not load analytics cookies.
8. Changes to this notice
We will update this notice when cookies are added, removed, or materially change purpose. The “Last updated” date at the top of the page reflects the most recent revision. For material changes that affect how consent is collected, we will re-prompt you for consent.
9. Contact
Questions about cookies? Email [email protected]. For the full picture of how we handle personal data, see our privacy notice.
YALLO Management Consultancies LLC · Dubai, United Arab Emirates.
