Cookie Policy
01AI LTD | 01ltd.com and app.01ltd.com | Last updated: 25 September 2026
1. Introduction
This Cookie Policy explains how 01AI LTD (“we”, “us”, “our”) uses cookies and similar technologies on 01ltd.com and on our client area at app.01ltd.com. It should be read alongside our Privacy Policy. We do not use cookies for analytics, advertising or tracking on either site: our analytics run without cookies for every visitor, whether or not you are logged in. The only cookies we use are strictly necessary ones: those that let you log in to the client area, and those set by the analytics opt-out form in our Privacy Policy.
2. What Are Cookies?
Cookies are small text files placed on your device when you visit a website. They are widely used to make websites function correctly and to improve user experience. Cookies can be temporary “session cookies” that delete when you close your browser, or “persistent cookies” that remain on your device. This Policy also covers similar technologies, such as pixels, web beacons, and your browser's local and session storage.
3. Types of Cookies We Use
- Strictly Necessary Cookies: These cookies are needed for a service you ask for, such as logging in to the client area or opting out of analytics, and cannot be switched off in our systems. They do not require your consent under applicable law. They are the only cookies we use, and all of them are listed in Section 3A.
- Analytics Cookies: None. Our analytics (Matomo) run in cookieless mode for every visitor, including logged-in users of the client area (see Section 4).
- Browser Storage: Two small items, each used only to make a page behave as you would expect. Neither contains an identifier or is sent to us. They are listed in Section 3B.
- Marketing and Targeting Cookies: We do not use any marketing or targeting cookies. We do not engage in behavioural advertising, retargeting, or any form of cross-site tracking.
- Payment Page: When you buy the AI Diagnostic online, payment is taken on a page hosted by Stripe at checkout.stripe.com, not on our sites. Stripe sets its own cookies on that page, for example to prevent fraud, under its own cookie policy.
3A. Cookie Inventory
The first two tables below list every cookie our sites set today. All of them are strictly necessary, and all are first-party cookies set by our own domains. “Session” means the cookie is deleted when you close your browser.
Logging in to the client area (app.01ltd.com)
Set only when you log in. A visitor who does not log in receives none of them.
| Cookie Name | Purpose | Duration | Set by | When |
|---|---|---|---|---|
| AUTH_SESSION_ID | Keeps track of a login while it is in progress | Session | Keycloak (our sign-in service) | When you log in |
| KC_AUTH_SESSION_HASH | Used by the login page to keep a login consistent across browser tabs | 60 seconds | Keycloak | When you log in |
| KC_RESTART | Lets a login that has timed out be started again | Session | Keycloak | When you log in |
| KEYCLOAK_IDENTITY | Keeps you signed in to our sign-in service | Session | Keycloak | After you log in |
| KEYCLOAK_SESSION | Identifies your sign-in session, so the client area can check that you are still logged in | Session | Keycloak | After you log in |
| __Secure-authjs.session-token | Keeps you logged in to the client area (may be split into numbered parts, such as .0 and .1) | 30 days after you last use the client area, or until you log out | Client area | After you log in |
| __Host-authjs.csrf-token | Protects logging in and out against forged requests from other sites | Session | Client area | When you log in or out |
| __Secure-authjs.callback-url | Returns you to the page you were on after you log in | Session | Client area | When you log in |
| next-auth.pkce.code_verifier | Secures the exchange between the client area and our sign-in service during login | 15 minutes | Client area | When you log in |
Analytics opt-out (matomo.01ltd.com)
| Cookie Name | Purpose | Duration | Set by | When |
|---|---|---|---|---|
| MATOMO_SESSID | Protects the analytics opt-out form against forged requests | Session | Matomo (our analytics service) | When you open our Privacy Policy, which contains the form |
| matomo_ignore | Remembers that you have opted out of analytics, on both sites | Until you opt back in or clear your cookies | Matomo | Only if you opt out |
Consent choices (not currently used)
We do not currently ask for your consent to any cookie, so these cookies are not set. If we ever do, your choice will be remembered by the cookies below, for no longer than 6 months.
| Cookie Name | Purpose | Duration | Set by | When |
|---|---|---|---|---|
| mtm_consent | Would remember that you gave consent | 6 months | Matomo | Not currently used |
| mtm_consent_removed | Would remember that you refused or withdrew consent | 6 months | Matomo | Not currently used |
3B. Browser Storage
| Name | Where | Purpose | Duration |
|---|---|---|---|
| ltd_auth_status | Session storage, 01ltd.com | Remembers whether you are logged in to the client area, so the menu shows the right link | Until you close the tab |
| auditsonar:last_country | Local storage, app.01ltd.com | Remembers the country a consultant last chose when setting up an assessment, to pre-fill the form | Until you clear your browser storage |
4. Our Analytics Approach
We manage our website analytics ourselves:
- Our analytics are powered by Matomo, an open-source analytics platform self-hosted on our own infrastructure within the European Union.
- Matomo runs in cookieless mode for every visitor, on both sites. No analytics cookies are placed on your device, whether or not you are logged in.
- When you are logged in to the client area, your page views also carry a pseudonymised identifier. It is sent with each page view and is not stored on your device. How we use it, and how to object, is set out in Section 6 of our Privacy Policy.
- IP addresses are anonymised (2 bytes masked) before storage.
- All data remains under our exclusive ownership and control.
- No analytics data is shared with any third party.
- No analytics data is transmitted outside the EU.
5. Managing Your Preferences
No Cookie Banner Required: We use no cookies that require consent, on either site, so no cookie consent banner is displayed.
Browser Settings: Most browsers allow you to view, manage, block, and delete cookies through their settings. If you block all cookies, you will not be able to log in to the client area, as logging in requires the cookies listed above.
Opting Out of Analytics: You can opt out of analytics on both sites with the form in Section 6 of our Privacy Policy. Your choice is remembered by the matomo_ignore cookie, so clearing your cookies also clears your opt-out.
Do Not Track: Our Matomo installation is configured to respect the Do Not Track (DNT) preference set in your browser. If you have enabled DNT in your browser settings, Matomo will not record your visits.
6. Updates and Contact
We may update this Cookie Policy from time to time to reflect changes in our practices, technologies, or legal requirements. If you have any questions about this Cookie Policy or our use of cookies, please contact our Data Protection Contact at:
Email: privacy@01ltd.com