Cookie notice
Draft for review — not approved for publication
priv-01-2026-10-04.2
Necessary-only configuration
The PRIV-01 configuration enables no optional analytics, advertising, external-media tracking or session replay. Necessary services support authentication, security and explicitly requested features. Cookie settings remains accessible without requiring consent.
Browser storage inventory
pg_dev_session supports the main API session and has a maximum helper lifetime of eight hours; the session can expire sooner. planGrcMarketingLanguage remembers an explicit language for up to 180 days. planGrcPrivacy stores only the local privacy choice, random receipt capability and expiry for up to 180 days. Supplier access uses session storage. Application and employee portals also use scoped interface/navigation preferences. Provider-side security cookies and remaining per-key application storage require live verification before publication.
Choices and evidence
Where approved optional services exist, acceptance and refusal must be equally accessible and each purpose must be explained. We do not infer permission from scrolling, silence, login or closing a panel. Withdrawal stops future optional processing. A minimal server receipt preserves the decision and the wording shown; its retention is separate from the browser cookie lifetime.
Control and limitations
You can clear browser storage through your browser settings. This may sign you out or remove remembered choices. Clearing a browser cookie does not erase server records or establish a new grant. Necessary processing and providers' security logs are assessed separately. The inventory and retention schedule must be reconciled with live behaviour before this draft is published.
Browser storage in this release
Source-reviewed on 4 October 2026. These entries belong to PlanGRC features and are used when those features are opened or a preference is saved. This is not a completed live inventory of infrastructure or every third-party service. Optional analytics, advertising and session replay remain off.
| Name / storage | Purpose | Lifetime |
|---|---|---|
pg_dev_sessionCookie | Sign-in session; HttpOnly | Up to 8 hours; inactivity or sign-out can end access earlier |
planGrcMarketingLanguageCookie | Requested website language | 180 days |
planGrcPrivacyCookie | Privacy choice and receipt reference after an explicit action | 180 days |
plangrc.guided.locale policy-languageLocal storage | Requested language in Advisor or employee policies | No automatic expiry; until cleared or replaced |
planGrcMarketingRegion planGrcWorkspaceDataPurpose planGrcSidebarCollapsed planGrcScopeMismatchWarningHiddenLocal storage | Selected region, workspace mode, sidebar and warning preferences | No automatic expiry; until cleared or replaced |
plan-grc-guided-v1:<tenant>:<user>Local storage | Resume a saved core setup draft; may include project/evidence titles and owner references | No automatic expiry; until cleared or replaced |
plan-grc-session-eventLocal storage | Coordinate session activity and sign-out between tabs | No automatic expiry; until cleared or replaced |
tpr-session:<assessment>:<member>Session storage | Invited supplier session credential | Until the tab session ends or sign-out |
plan-grc-return-sectionSession storage | Return to the previous workspace after session expiry | Up to 8 hours in this tab |
plan-grc-session-exitSession storage | Explain an inactivity sign-out | 15 minutes in this tab |
policy-selection:<user>Session storage | Selected employee policy | Until the tab session ends or sign-out |
Clearing browser storage removes preferences and local references; it does not delete server-side workspace records. Do not share a browser profile when it contains a saved work draft.
Star Worldwide Trading Limited
268 Lees Road, Oldham, United Kingdom, OL4 1PA+44 7883 27 1160
[email protected]
Privacy enquiries: [email protected]. You can also write to our registered office.