Zyflow Cookie Policy
Version: 1.1 · Effective date: 19 October 2026 · URL: https://www.zyflow.eu/legal-pages/cookie-policy
This Cookie Policy explains how HERKO d.o.o., Pševska cesta 10, 4000 Kranj, Slovenia ("we"), uses cookies and similar technologies on the websites zyflow.eu, app.zyflow.eu and navigate.zyflow.eu. More about how we process personal data is in our Privacy Policy. Contact: legal@zyflow.eu.
1. What are cookies?
Cookies are small text files that a website stores in your browser. Similar technologies include the browser's local storage and tracking pixels (small pieces of code that send information to a provider when a page loads). In this policy, "cookies" covers all of them.
2. Our current use of cookies
At the moment our websites use no analytics, advertising or other non-essential cookies. Only technically necessary storage may be used, for example to keep you signed in where a sign-in is offered. Our hosting provider Vercel delivers the websites and processes technical request data (see our Privacy Policy).
Without using cookies or running any code on your device, our hosting server counts page views anonymously: for each page request it sends only the page address, language and the referring website's domain to our analytics provider PostHog (EU cloud, acting as our processor), with no IP address, device information or identifier, to measure website reach (legitimate interest, Art. 6(1)(f) GDPR).
3. Planned cookies – only with your consent
We plan to use Google Tag Manager, Google Analytics 4 and PostHog (EU cloud, to understand how our websites are used; session recording is off on the marketing site) and the Meta (Facebook) Pixel (to measure and improve our advertising on Facebook and Instagram). These tools are blocked and do not load until you actively agree in our cookie banner. If you do not agree, they are never loaded. Necessary cookies do not need consent (Article 157 of the Slovenian Electronic Communications Act, ZEKom-2, implementing Art. 5(3) of the ePrivacy Directive). For all other cookies we ask for your consent (Art. 6(1)(a) GDPR).
4. Cookie categories
- Necessary – required for the website to work and to remember your cookie choice. Always active.
- Analytics – Google Analytics 4 via Google Tag Manager, and PostHog (EU): statistics about visits, pages viewed, device and approximate location (country/city), plus key actions such as app store clicks. Off until you consent. Session recording is not used on zyflow.eu.
- Marketing – Meta Pixel (and Google advertising tags, if we add them): measuring the success of our ads and showing relevant ads on other platforms. Off until you consent.
5. Cookie table
| Name | Provider | Purpose | Category | Duration | Status |
|---|---|---|---|---|---|
cc_cookie |
Zyflow (CookieConsent, first party) | Stores your cookie choices so we do not ask again on every page | Necessary | 182 days | When the banner goes live |
zyflow_ft |
Zyflow (first party) | Keeps first-touch campaign values (utm_source / utm_medium / utm_campaign) so App Store and Google Play links stay attributed after you open another page | Necessary | 90 days | Active |
_ga |
Google Ireland Ltd. (Google Analytics 4) | Distinguishes visitors with a random ID for statistics | Analytics | 2 years (default documented by Google) | Planned, only after consent |
ph_*_posthog |
PostHog (EU cloud) | Anonymous visitor id shared across *.zyflow.eu | Analytics | 1 year | Only after analytics consent |
_ga_<ID> (one per Google Analytics measurement ID) |
Google Ireland Ltd. (Google Analytics 4) | Keeps the session state for statistics | Analytics | 2 years (default documented by Google) | Planned, only after consent |
_gcl_au |
Google Ireland Ltd. (Conversion Linker) | Links ad clicks to actions on our site | Marketing | 90 days (as documented by Google) | Only if we add Google advertising tags, and only after consent |
_fbp |
Meta Platforms Ireland Ltd. (Meta Pixel) | Identifies your browser to measure and deliver ads | Marketing | 90 days (as documented by Meta) | Planned, only after consent |
_fbc |
Meta Platforms Ireland Ltd. (Meta Pixel) | Stores the ad click ID when you arrive from a Meta ad | Marketing | 90 days (as documented by Meta) | Planned, only after consent |
Meta cookies on facebook.com (e.g. fr) |
Meta Platforms Ireland Ltd. (third party) | Ad delivery and measurement by Meta, if you use Facebook/Instagram in the same browser | Marketing | 90 days (as documented by Meta) | Planned, only after consent |
Google Tag Manager itself only loads the tags above, and only after you consent. We will update this table before any new cookie is used.
6. Recipients and transfers
Google (Google Ireland Ltd.; parent company Google LLC, USA) processes analytics data on our behalf. PostHog (EU cloud) processes website product analytics on our behalf after you consent; session recording is disabled on the marketing site. Meta (Meta Platforms Ireland Ltd.; parent company Meta Platforms, Inc., USA) receives data from the Meta Pixel; for the collection and transmission of this data, Meta and we may act as joint controllers (Art. 26 GDPR), as described in Meta's terms for its business tools. Data may be transferred to the USA; depending on the provider, we rely on the EU-US Data Privacy Framework or on Standard Contractual Clauses of the European Commission (details on request at legal@zyflow.eu). Google's and Meta's own privacy policies apply to their further processing.
7. Consent, withdrawal and changing your settings
- When you first visit, the banner offers "Accept all", "Reject all" and "Manage preferences". Rejecting is as easy as accepting. If you close the banner or do nothing, only necessary cookies are used.
- You can change or withdraw your consent at any time via the "Cookie settings" link in the footer of every page. Withdrawal does not affect the lawfulness of processing before it. When you withdraw consent, we stop loading the tools and delete our own analytics and marketing cookies where technically possible.
- We store your choice for 182 days and ask again when it expires or when we add new cookies or purposes.
- We keep a record of your consent (a random consent ID, date and time, your choices and the policy version) to be able to prove it. We keep this record only as long as necessary to prove your consent and to defend legal claims, and then delete it.
- You can also block or delete cookies in your browser settings; some parts of the site may then not work properly.
8. Zyflow mobile app
The Zyflow mobile app does not use browser cookies. It stores some data in your device's local storage so that it works: your login session (in the device's secure storage), your settings, your last known location and recent searches. Our crash-reporting tool (Sentry) stores a pseudonymous identifier on the device. Our analytics tool (PostHog) only runs and stores an identifier if you agree in the app; you can change this anytime in Settings. Details are in the Privacy Policy, section 3.14.
9. Changes
We update this Cookie Policy when we change the cookies we use. The current version and date are shown at the top.