Legal

Cookie policy

Last updated 1 September 2026

The short version, in plain words

Six cookies keep the site working: signing you in, protecting the forms, remembering your currency, your country and this choice, and counting the free monthly allowance.
Two more count visits. They are not set unless you say yes, and until you do, no analytics script is requested from Google at all.
Two things your browser fetches from other companies on every page — the display typeface and one graphics library — set no cookie, but they do see your IP address. They are listed in section 5 below.
No advertising cookies. No cross-site tracking. Nothing sold to anyone.
You can change your mind at any moment, from the button below or from “Cookie settings” in the footer of every page.

Change your choice

This reopens the same banner you saw on your first visit. Accepting takes effect on this page; rejecting takes effect from the next page you load, because we cannot un-send what this one already sent.

1. What a cookie is here

A small piece of text your browser stores for this site and sends back on the next request. Veloque uses them for exactly two jobs: keeping a session working, and — only with your consent — counting visits. We use no advertising, retargeting, fingerprinting or cross-site tracking technology of any kind, and we do not embed third-party pixels or share buttons that would set cookies of their own. Two third-party asset requests are made on every page — neither sets a cookie, and both are set out in section 5.

2. Strictly necessary — always set

These are exempt from consent because the site cannot do what you asked of it without them. They are all first-party, all set by veloque.in, and none is used to profile you.

Cookie	What it does	How long
`vq_sess`	Keeps you signed in. Without it every page would ask for your password again.	Up to 30 days, or until you sign out
`vq_csrf`	Proves a form submission came from a page we served, and not from another site pretending to be you.	2 hours
`vq_consent`	Remembers whether you accepted or rejected analytics, so we neither count you against your wishes nor ask again on every page. It holds one word — "granted" or "denied" — and nothing about you.	180 days
`vq_currency`	Remembers the currency you picked in the switcher, so prices stay in the currency you read them in.	1 year
`vq_geo_cc`	Caches the coarse country worked out from your IP address, so the calculators show the right tax rules and prices show in a sensible currency without repeating the lookup on every page. It holds a two-letter country code and nothing else.	30 days
`vq_fid`	A random identifier, tied to nothing, that counts the free monthly allowance for people who are not signed in. It exists so the free tier can be a real number rather than a per-IP guess — which on shared mobile networks would hand one allowance to an entire city.	400 days

All of them are marked Secure and SameSite=Lax, so they travel only over HTTPS and are not sent when another site links into ours in a way that could be abused. Every one of them except vq_consent is additionally HttpOnly, so page scripts cannot read it even if something managed to inject one; vq_consent is the exception because the banner has to be able to write it in the browser, and it is the one cookie whose entire content is a word you chose.

3. Analytics — only if you accept

We use Google Analytics 4 to see how many people visit, which pages they read, and roughly where in the world they are — at city or country level, worked out from the IP address. It tells us that a page is being read; it does not tell us who you are, and it never receives what you type into your company profile or the trade tools.

Cookie	What it does	How long
`_ga`	Google Analytics: tells one returning browser from another so a visit is not counted twice.	2 years
`_ga_*`	Google Analytics: keeps the state of the current session for the specific property.	2 years

Set by Google LLC (United States) as a processor for us, under Google Consent Mode v2 with IP anonymisation on. The transfer basis is in section 7 of the privacy policy. Google Analytics is not linked to Google Ads, and no advertising or personalisation signal is enabled on the property.

4. How the consent actually works

Worth stating precisely, because a lot of consent banners do not do this:

Every page starts by telling Google's consent framework that all storage is denied. That runs before anything else.
Google's analytics script is only requested at all when your vq_consent cookie already says granted. If you have not answered, or you said no, no request is ever made to Google's analytics servers — the refusal is the absence of the call, not a flag we pass along with it. This is about analytics only; the unconditional font request in section 5 is a separate thing and goes to a different Google service.
The banner is what sets that cookie. It has no X to dismiss it, because closing a banner is not consent, and it does not treat continued browsing as agreement.
Accept and Reject are the same size and prominence, on purpose.
A "no" is remembered as a no, so you are not asked again on every page. That is why rejecting still writes a cookie — it holds the word "denied" and nothing about you.

5. Requests that set no cookie, but are still third parties

Two files on every page are fetched from someone else's server: the display typeface, from Google Fonts, and one graphics library, from Cloudflare's public cdnjs. Neither sets a cookie and neither can identify you across sites — but both receive your IP address and browser user agent as part of the request, and unlike analytics they are not behind the consent gate, because the page cannot render without them. We are moving the typeface onto our own server, which removes the first of the two entirely. Both are listed, with what reaches them and on what basis, in the sub-processor register at Security → sub-processors.

6. Other storage we deliberately do not use

Veloque does not use localStorage, sessionStorage or IndexedDB to hold anything about you, and the on-site chat assistant keeps its conversation in memory only — reload the page and it is gone. There is nothing in your browser to clear beyond the cookies listed above.

7. Turning them off in your browser instead

You can block or delete cookies from your browser's own settings, and doing so overrides anything on this page. Be aware that blocking the strictly-necessary ones will sign you out and will stop forms from submitting — not as a punishment, but because those cookies are literally how a session and a form token work.

8. Changes

If we add a cookie, this table changes on the same day, and if the new one is not strictly necessary you will be asked again before it is set. Material changes are signalled by the "Last updated" date above.

This page goes with our Privacy policy and Terms of use. Questions: support@veloque.in.