Cookie Policy

Version: cookie_policy_v1 | Effective date: 2026-06-26 | Locale: en

1. Scope

This Cookie Policy explains how the Flexas/Doory platform uses cookies and similar browser technologies in the public website, login, dashboard, checkout, booking, membership, and building-operation surfaces.

The current platform posture is necessary-cookie-only. The platform does not currently use marketing cookies, advertising pixels, behavioral replay tools, or third-party analytics tags in the web runtime.

2. Necessary Cookies

The platform uses necessary cookies and similar technologies to provide the service, keep accounts signed in, protect against cross-site request forgery, support secure session continuity, and allow authorized administrators to use controlled impersonation features.

• access_token for authenticated API session access.
• refresh_token for refresh session continuity.
• csrf_token for CSRF protection on cookie-authenticated mutating requests.
• impersonation_backup_token for admin impersonation restore safety.
• session for OAuth or session middleware state.

These cookies are required for security, authentication, and service operation. They are not used for advertising or cross-site marketing tracking.

3. Browser Storage

The platform may use browser storage for functional user-interface state such as active building scope, safe return paths after login, impersonation UI state, scroll restoration, and editor preferences.

Browser storage must not be used for access tokens, refresh tokens, password material, payment details, contract text, message bodies, DSAR payloads, or other high-risk personal data.

4. Non-Essential Cookies

Non-essential cookies, analytics SDKs, marketing tags, tracking pixels, behavioral replay tools, or cross-site advertising technologies must not be enabled unless they are reviewed, documented, and where required, supported by a consent or opt-out mechanism.

If non-essential technologies are introduced in the future, this policy will be updated before or at the time those technologies are enabled.

5. Controls

Users can control cookies through their browser settings. Blocking necessary cookies may prevent login, checkout, dashboard access, or other service features from working correctly.

6. Updates

This Cookie Policy may be updated when the platform changes its use of cookies or similar technologies. A new version will be published where material changes are made.

7. Contact

Questions about cookies or privacy controls should be sent to the privacy contact channel identified on the relevant website, checkout flow, invoice, account communication, or building communication for the applicable service.