Legal
Version 1.1 · Effective date: April 17, 2026
Last updated: April 18, 2026
Cookies: Small text files that websites store on the user's device via the browser. They allow information to be remembered between visits and requests.
localStorage / sessionStorage: Browser storage mechanisms that allow web applications to save data on the user's device without automatically sending it to the server on each request. CoreLab uses both mechanisms to ensure the Platform functions correctly.
| Name | Type | Duration | Purpose |
|---|---|---|---|
sb-[ref]-auth-token | Secure session cookie | Browser session + auto-renewal | Stores the access token and refresh token for the authenticated session. Configured as inaccessible by JavaScript where possible. |
sb-[ref]-auth-token-code-verifier | Temporary cookie | Short duration (OAuth flow) | Used temporarily during the Google authentication flow and password reset. Deleted upon completing the process. |
These cookies are strictly necessary for authentication. Without them, the user cannot sign in or maintain an active session.
| Name | Type | Duration | Purpose |
|---|---|---|---|
locale | Preference cookie | Persistent (~1 year) | Stores the user's language preference (Spanish or English). Read by the server to render the interface in the correct language. |
localStorage is accessible only from CoreLab's domain and is not automatically sent to the server.
Cache of authentication state: includes the authenticated user, active organization, and role. Used to prevent interface flickering when loading the application. Not the authoritative source of the session — that is always the authentication cookie. Deleted upon signing out or when an expired session is detected.
Interface theme preference: dark or light. Read when the page loads to prevent visual flash of unstyled content. Deleted when manually clearing browser storage.
Preferred language code. Complements the locale cookie for components that need to access this preference without querying the server.
Indicates whether the user has completed or dismissed the onboarding tutorial. Prevents showing the tutorial to users who have already completed it. Deleted when manually clearing storage.
sessionStorage exists only during the active browser session and is deleted when the tab is closed.
The Platform's typography is loaded from Google's external servers. This loading involves an HTTP request that may expose to Google the user's IP address, browser type, and request timestamp. Google may set its own cookies in relation to these requests. For more information: Google Fonts Privacy FAQ.
When the user accesses the payment flow or billing portal, they temporarily leave CoreLab's domain and access Stripe's domains. Stripe may set its own cookies on those domains. For more information: Stripe Privacy Policy.
CoreLab explicitly confirms that it:
| Storage Type | Legal Basis | Description |
|---|---|---|
| Authentication session cookies | Contractual necessity / Strictly necessary cookie | Without these cookies, the service cannot function. No explicit consent required. |
| Language cookie | Legitimate interest / Functional cookie | Improves experience by storing language preference. |
| Authentication state in localStorage | Technical necessity (same basis as session) | Functional cache to prevent interface flickering. |
| Theme preference in localStorage | Legitimate interest | Display preference chosen by the user. |
| Tutorial state in localStorage | Legitimate interest | Avoids showing a tutorial already completed. |
| Google typography | Legitimate interest | Typography loading necessary for interface design. |
Warning: Blocking authentication session cookies will prevent sign-in and use of the Platform.
To remove CoreLab's local storage: in Chrome/Edge, open developer tools → Application → Storage → Clear site data. Or directly from the browser's cookie/storage settings for CoreLab's domain.
Consequence: Theme, language preferences, and tutorial state will be lost. The authentication session may not be affected.
Any significant change in cookie usage will be communicated to active users by email at least 14 days in advance before the effective date.
CoreLab detects and respects the GPC signal. Since CoreLab does not sell or share personal data for advertising purposes, its activation does not modify Platform behavior — these commitments already apply universally.
To enable GPC:
CoreLab registers the DNT signal. Since no advertising tracking cookies or behavioral analytics systems are used, there is no practical difference in Platform behavior between users with and without DNT enabled.
CoreLab Creative
Email: info@corelabcreative.com
Suggested subject: [COOKIES] - brief description