Devence Lab Cookie Policy

Effective September 29, 2026

This Cookie Policy explains how Devence Lab, Inc. ("Devence Lab", "we", "our", or "us") uses cookies and similar technologies on devencelab.com and any subdomain we operate (the "Site"). It should be read together with our Privacy Policy, which describes how we handle Personal Data more generally.

We use few cookies, and we set none that are not strictly necessary until you have told us we may.

1. What cookies are

A cookie is a small text file that a website asks your browser to store on your device. On a later visit the browser returns it, which lets the site recognise the browser. Similar technologies — including local storage, session storage, pixels, and software development kits — achieve comparable results by different means. In this Policy, "cookie" refers to all of them.

A first-party cookie is set by the site you are visiting. A third-party cookie is set by another domain. A session cookie is deleted when you close your browser; a persistent cookie remains until it expires or you delete it.

2. The legal position

Under Article 5(3) of the ePrivacy Directive, as implemented in national law, and the consent standard of the GDPR, storing or accessing information on your device requires your prior, informed, freely given, specific, and unambiguous consent — unless the storage or access is strictly necessary to provide a service you have expressly requested.

We apply that distinction literally:

• Strictly necessary cookies are set without consent, because the Site cannot provide what you asked for without them.
• All other cookies, including analytics, are set only after you consent through our cookie banner. If you decline, or close the banner without choosing, they are not set. Continuing to browse is not treated as consent.

Consent is not a condition of using the Site. Declining costs you nothing: every page, article, and form works identically either way.

3. Cookies we use

3.1 Strictly necessary

We set no other strictly necessary cookies. The Site is a static export and does not use session cookies, authentication cookies, load-balancing cookies, or a shopping basket.

Our web server does keep short-lived, hashed request counters to enforce the rate limits described in our Security page. These are held on our server, not on your device, and are therefore outside the scope of consent under Article 5(3).

3.2 Analytics — consent required

We use Google Analytics 4 to count visits and to understand which of our articles and insights are read. It is measurement, not advertising, and we have deliberately limited it:

• Google Signals is disabled. We do not receive or use cross-device or demographic data.
• Advertising features and remarketing are disabled. We do not build audiences and we do not retarget.
• Data retention is set to 14 months, the shortest period the product permits.
• We do not combine analytics data with anything you submit through a form.
• We do not use analytics data to identify you, and we do not attempt to reverse the identifiers it sets.

Google processes this data as our processor and, for its own limited purposes, as a controller. Its handling is governed by Google's Privacy Policy. Google receives your IP address as an unavoidable consequence of your browser contacting its servers.

3.3 Support chat — loaded for everyone

The assistant on this Site is provided by Crisp, and it is loaded for every visitor rather than waiting for a decision about cookies. We would rather someone who needs help could ask for it without first having to reason about a consent banner, and a support channel that is absent until you accept cookies is not a support channel.

What that means for you. Crisp writes a conversation identifier to your browser's local storage, not to a cookie, and this happens whether or not you accept analytics. We rely on the exemption in Article 5(3) of the ePrivacy Directive for storage that is necessary to provide a service you have asked for — here, the ability to contact us and receive an answer. We think that is the right reading for a support tool, and we would rather state the basis we rely on than leave you to infer it.

What it is not used for: analytics, advertising, profiling, or tracking you across other sites. Crisp processes this in the European Union. See our Subprocessors page.

If you would rather it stored nothing, clear site data for this domain in your browser, or use a private window. The rest of the Site works normally without it, and you can reach us at the addresses in our Legal Notice instead.

3.4 Services that do not set cookies

Two third parties receive a request from your browser but do not, to our knowledge, set cookies through the Site. We name them because the request itself discloses your IP address, which is Personal Data.

Our Subprocessors page lists every provider that processes Personal Data on our behalf.

4. What we do not use

We state this plainly because it is unusual enough to be worth saying:

• No advertising, retargeting, or conversion cookies.
• No Meta Pixel, no LinkedIn Insight Tag, no TikTok Pixel, no advertising SDK of any kind.
• No session recording, heatmapping, or mouse-tracking (no Hotjar, FullStory, or equivalent).
• No fingerprinting or probabilistic identification.
• No cross-site tracking, and no data broker relationships.
• No sale or sharing of Personal Data for behavioural advertising.

5. Your choices

5.1 The banner

On your first visit, a banner offers three options, each equally prominent and equally easy to select:

• Accept all — sets the analytics cookies in Section 3.2 and, where offered, the chat cookies in Section 3.3.
• Reject all — sets nothing beyond the strictly necessary cookie in Section 3.1.
• Manage preferences — lets you consent by category.

Your choice is stored in the dl_consent cookie for six months, after which we ask again. There is no pre-ticked box, and closing the banner without choosing is treated as a refusal.

5.2 Changing your mind

You may change or withdraw your choice at any time using the Cookie settings link in the footer of every page. Withdrawal is as easy as consent, as Article 7(3) GDPR requires. Withdrawing does not affect the lawfulness of processing carried out before you withdrew.

5.3 Browser controls

You can also block or delete cookies in your browser settings. Because our non-essential cookies are gated behind consent, this is not necessary in order to avoid them, but it is available to you:

Chrome · Firefox · Safari · Edge

Deleting cookies removes the dl_consent record of your choice, so the banner will appear again.

5.4 Opting out of Google Analytics everywhere

Google offers a browser add-on that prevents Google Analytics from collecting data on any site you visit.

5.5 Global Privacy Control

We honour the Global Privacy Control signal. If your browser or extension sends a GPC signal, we treat it as an instruction to refuse non-essential cookies, and we do not set them regardless of any banner interaction.

6. Changes to this Policy

We will update this Policy when we add, remove, or change a cookie. The effective date at the top records when the current version took effect. Where a change introduces a new non-essential cookie, we will ask for your consent again before setting it.

7. Contact

Questions about this Policy may be sent to privacy@devencelab.com.