Cookies and Similar Technologies Policy

1. Essential cookies

• PHPSESSID (or an environment-specific PHP session name) — keeps a website or application session, sign-in state, and server-side form-security token. It is normally a browser-session cookie. The CSRF token itself is stored in the server session, not in a separate cookie.
• landing_locale — remembers the selected or negotiated website language for up to 1 year.
• mcp_workspace: remembers the company LiteTMS address you enter on mcp.litetms.eu, the page for connecting an AI app, so the next connection can suggest it. It holds only that address, is not sent to any other LiteTMS address, and lasts up to 1 year.
• remember_me — created only when “remember me” is selected at sign-in. It contains a random authentication token, not a password. It may remain for up to 90 days for a tenant account, 30 days for a Partner account, or 7 days for a privileged administrator account; server-side inactivity and revocation rules may end it sooner.

These cookies are limited to session, authentication, security, a requested language preference, and the company address entered to connect an AI app. They are used under the exception for storage or access necessary to provide an electronic service requested by the user (Art. 399(3) of the Polish Electronic Communications Law). Where personal data is involved, the legal bases are performance of the service and our legitimate interest in secure operation. Blocking them may prevent forms, sign-in, saved language, or the suggested company address from working.

2. Cloudflare Turnstile

When enabled, public forms load Cloudflare Turnstile to distinguish legitimate requests from bots. Cloudflare receives technical request, device, and network information and may use cookies or similar browser mechanisms required for the security check. These mechanisms are not used by LiteTMS for advertising and are treated as necessary to provide a secure form. Cloudflare controls any provider-set identifier and its duration under its own documentation.

3. Privacy-focused service analytics

1. When enabled, LiteTMS uses an Umami analytics endpoint for page views and coarse product events. The integration sends a page path and a short, allow-listed event description such as area, action, or status; it does not send form contents through event properties.
2. Our integration does not set an analytics cookie or write an analytics identifier to local storage, does not use advertising pixels, and does not track visitors across unrelated sites. Like any web request, the analytics endpoint receives connection and browser data such as IP address, user agent, and referrer. We use this limited data for our legitimate interest in operating and improving the service, subject to the right to object described in the Privacy Policy.

4. Local and session storage

1. The application uses local storage to retain requested interface state and preferences, such as theme, sidebars, table or map settings, filters, split-panel sizes, and dismissed hints. Some editing tools may keep a local draft. Session storage may keep short-lived state until the browser tab is closed.
2. These entries normally remain until the function replaces them or you clear site data. They are read only to restore the relevant feature and are not used for cross-site advertising. A locally stored draft may contain information you typed; do not use a shared device for sensitive work without clearing browser data or signing out.

5. No marketing cookies

LiteTMS does not currently use advertising, remarketing, or cross-site profiling cookies. If we introduce a non-essential technology that requires consent, it will remain disabled until valid consent is obtained, and this policy and the consent controls will be updated.

6. Your controls

1. Your browser lets you inspect, block, and delete cookies and site storage. Blocking essential storage can break sign-in, security checks, forms, language memory, or saved interface state.
2. You can end an authentication cookie by signing out and can revoke active sessions in the account controls where available. Clearing site data removes browser-side preferences and local drafts but does not by itself delete account data held on our servers.
3. Questions or objections about analytics can be sent to contact@litetms.eu.

7. Changes

We update this policy when the technologies or law change. The current version and date appear above, material changes will be communicated appropriately, and earlier versions are available on request.