What are cookies?
Cookies are small text files stored on your device when you visit a website. They help websites work properly and provide information to the site owners.
Cookies we use
Sessional uses essential cookies to provide the service and Google Analytics cookies to count visits. Google Analytics loads without asking for consent. We do not use advertising cookies. Our own cookieless visit counter also continues to report page views to our server without setting a cookie, as described in section 10 of the privacy notice.
Most essential cookies are set once you are signed in. Four essential cookies can be set for someone who has no Sessional account, and each only after that person has done something: the document-link unlock cookie (after entering the code on a link a professional sent them), the booking request draft (after sending a request form that needs correcting), the feedback card marker (after sending feedback from a printed card) and the short-lived message cookie (after a form or link could not be completed). Reading a public page can set Google Analytics cookies, subject to the exclusions below.
| Cookie | Purpose | Duration | Type |
|---|---|---|---|
| _ga | Google Analytics identifier used to distinguish browsers and count visits | Up to 2 years, renewed on a visit; your browser may shorten this | Analytics |
| _ga_<id> | Google Analytics session state for this site | Up to 2 years, renewed on a visit; your browser may shorten this | Analytics |
| ss_session_v2 | Keeps you signed in to your account | 4 hours, or 30 days with Remember me | Strictly necessary |
| ss_role | Stores your account type for page access | 4 hours, or 30 days with Remember me | Strictly necessary |
| ss_verified | Records whether your email has been verified | 4 hours, or 30 days with Remember me | Strictly necessary |
| csrf_token | Protects forms and requests against cross-site request forgery. Set when you sign in, not when you are reading a public page. | 24 hours | Strictly necessary |
| ss_demo | Marks a read-only demo session, so demo accounts cannot change data | 4 hours, or 30 days with Remember me | Strictly necessary |
| ss_impersonating_as | Marks an assisted-support session, the mode in which a member of our staff views your account with your permission in order to help you. Set on the staff member's browser, never on yours. | 30 minutes, with no extension | Strictly necessary |
| ss_ds_unlock_… | Records that you entered the correct code on a locked document link, so the documents on that link open without asking again. One per link, and only on the browser that unlocked it. | 30 minutes | Strictly necessary |
| ss_bounce, ss_bounce_landed, ss_role_bounce, ss_role_refresh, ss_imp_bounce | Short-lived breakers that stop a stale sign-in state sending your browser round a redirect loop. Each holds the value 1 and nothing else. | 10 seconds | Strictly necessary |
| xero_oauth_state, xero_pkce_verifier | Set only while you are connecting Xero, so we can confirm the reply from Xero belongs to the request you started | 10 minutes | Strictly necessary |
| ss_request_draft | Set only when a booking request form is sent back to you to correct, so what you typed is still there. It holds the details you entered on that form and nothing else, and it is removed when the request goes through. | 10 minutes | Strictly necessary |
| ss_notice | Set only when a form you sent or a link you followed could not be completed, so the page you are returned to can show you why. It holds that one message and a status number, nothing about you, and the page removes it as soon as the message has been shown. | 30 seconds | Strictly necessary |
| ss_fb_sent_… | Set only after you send feedback from a printed feedback card, so the same browser is not asked to answer that card twice. One per feedback round. It holds the value 1 and nothing else: nothing about you and nothing about your answers. | 60 days | Strictly necessary |
Where Google Analytics runs
Google Analytics runs on public pages and in the signed-in dashboard. It does not load on internal admin or preview pages, onboarding, or pages for feedback, workplace invoice and booking links, document shares, compliance passports, booking links and cancellations, referrals, report verification or unsubscribing. It also stays off booking-request confirmations, password resets, email verification and email changes, magic links and account invitations, and any address with a credential query parameter.
We send a page path without the query string or fragment. Dashboard record identifiers and public profile slugs are replaced with placeholders. We do not send your account ID, name, email address or plan to Google. See the privacy policy for the data Google receives.
As a courtesy, we do not load Google Analytics when your browser sends Global Privacy Control or Do Not Track set to 1. You can also use the Google Analytics opt-out browser add-on. Dismissing our cookie notice only hides the notice; it does not turn analytics on or off. Our own cookieless visit counter is separate and continues to operate.
What we store on your device
As well as the cookies above, we use your browser’s own storage to remember small preferences. None of it is sent to our servers on its own, none of it is used to identify you, and clearing your browser data removes all of it.
- ss_invoice_import_v1: the invoice you were drafting on the free tool, on your device only, so it survives the click through to signup and does not have to be typed again. It holds what you typed, including the organisation and the line items. This stored copy reaches us only if you create an account and choose to carry it over. Separately, when you press Download or Email on the tool, the invoice is sent to us to make the PDF and we keep a record of it for 180 days, never your bank details: section 3 of the privacy notice lists exactly what.
- ss_invoice_tool_draft_v1: the free invoice form as you have typed it, without your bank details, so a reload does not empty it. It stays in the tab and is cleared when you close it.
- ss_inv_count: how many invoices you have downloaded from the free tool in this browser, so the page can welcome you back.
- ss-theme: whether you chose light or dark mode.
- sessional-cookie-consent: that you have seen the cookie notice, so it is not shown again.
- promo-banner-dismissed-v2: that you closed the promotional banner.
- sessional.cta-dismissed: that you closed the sign-up prompt at the bottom of the page. Cleared when you close the tab.
- sessional.desktop-nudge-dismissed-at: when you last closed the “this works better on a bigger screen” note, so it stays away for ten minutes. Cleared when you close the tab.
- sessional.pricing-interval: whether you last looked at monthly or annual prices on the pricing page. Cleared when you close the tab.
- sessional.v5-account-hint: when you first saw the note pointing to the account menu, and whether you closed it, so it stops appearing.
- sessional.cpd.sandy-seen: that you have already seen the introduction to the reflection assistant.
- sessional:draft:v1:… and sessional:draft-owner: what you have typed into a form you have not saved yet (a new session, an invoice being built, a reflection), so a reload or signing in again does not lose it. Passwords, bank details and National Insurance numbers are never kept. It stays in the tab, lasts 24 hours at most, and is cleared when the form is saved, when you sign out and when you close the tab.
- sandy:…: your current conversation with the assistant, so a reload does not empty it. Cleared when you close the tab.
- onboarding:step: which set-up step you were on, so a reload returns you to it. Cleared when you close the tab.
- email-change-requested: that you have asked to change your email address in this tab, and the two addresses involved, so the page can keep telling you to check your inbox. Cleared when you close the tab.
- ss_page_invoices: the page and page size you last chose on the invoice list. Cleared when you close the tab.
- sessional:verify-email-dismissed:…: that you closed the reminder to confirm your email address. Cleared when you close the tab.
- admin-sidebar-collapsed and ssml.admin.accounts.savedViews: layout and saved filters, on our own staff’s browsers in the admin console only.
While a member of our staff is writing a reply to you, their browser may hold that unsent draft in tab storage so a page reload does not lose it. It is cleared when the tab is closed.
Third-party cookies
Google Analytics loads a script from Google and sets the analytics cookies listed above on sessional.co.uk. We do not load advertising scripts. Some emails use similar technology: Postmark open-tracking pixels and rewritten links record opens and clicks, including IP address, user agent and time. Postmark records opens and link clicks for booking, invoice-notification, account, system and admin emails to account holders. Open and click tracking are disabled for security, sign-in, password reset and receipt emails, invoice letters, automated replies, and messages treated as no-account or third-party mail. Those exclusions include feedback invitations and reminders, organisation messages, document shares, account invitations and deletion confirmations. Separately, staff personal and research emails track opens only, not link clicks.
When you subscribe or change your payment method, we send you to Stripe’s own checkout and billing pages, and Stripe sets its own cookies there. Those are governed by Stripe's privacy policy. The same is true of Xero’s pages if you connect Xero.
Managing cookies
Sign-in cookies last 4 hours by default, or 30 days if you tick Remember me when signing in with a password. Magic-link and invitation sign-ins last 4 hours.
You can control cookies through your browser settings. Blocking strictly necessary cookies may prevent you from signing in or using the service. You can block or delete analytics cookies separately from the essential cookies.
Your rights
Under the Privacy and Electronic Communications Regulations (PECR) and UK GDPR, you have the right to know what cookies are being used and why. If you have questions about our use of cookies, contact us at support@email.sessional.co.uk.
Last updated: 12 October 2026