This policy covers eCorpOS, the business platform at
os.ecorpit.com. It is separate from the
policy for ecorpit.com,
which describes a public marketing website and does not apply here.
eCorpOS sets two cookies, and both are required to sign you in. There is no analytics, no advertising, no tracking pixel and no third-party tag anywhere in the product — so there is nothing to consent to, and no banner asking you to.
A small file a site stores in your browser so it can recognise the same browser on the next request. HTTP has no memory of its own; without one, signing in would last exactly one page. “Cookies” here also covers similar technologies — local storage, session storage, pixels — none of which eCorpOS uses for tracking.
| Name | Purpose | Lasts | Category |
|---|---|---|---|
__Host-os_session | Keeps you signed in after you enter the code emailed to you. It holds a random session token and nothing else — no name, no email, no identifier that means anything outside our database. | 24 hours, or until you sign out | Strictly necessary |
__Host-os_support | Set only when an eCorpIT support engineer enters your organisation under a grant your administrator has explicitly approved. It records which grant is in use so every action taken can be attributed to it. | The life of the approved grant | Strictly necessary |
Both carry the same protections, which are visible in any browser’s developer tools:
__Host- prefix — the browser itself refuses the cookie unless it is secure, site-wide and has no domain set. It cannot be planted by a subdomain.HttpOnly — unreadable by JavaScript, so a script injected into the page cannot steal your session.Secure — sent only over HTTPS.SameSite=Lax — not sent on cross-site requests, which is what stops another site acting as you.Reporting inside eCorpOS is produced from your own records in your own database, not from tracking your browser.
Consent is required for cookies that are not essential. Both of ours are essential — under the ePrivacy Directive they are “strictly necessary for the provision of a service explicitly requested by the subscriber”, and under the DPDP Act, 2023 they are part of performing the service you asked for.
A banner asking permission for cookies you cannot decline and still sign in is not consent; it is a click. We would rather tell you exactly what the two cookies are.
Every browser can block or delete cookies, and you may do so at any time. Because both of ours are the sign-in mechanism, blocking them means eCorpOS cannot keep you signed in: you will be returned to the login page on every request. There is no reduced mode that works without them.
Signing out deletes the session cookie immediately and invalidates the session on the server, so a copy of the cookie taken beforehand stops working too.
eClock is a desktop application, not a browser, and uses no cookies. It authenticates with a device credential held in your operating system’s keychain. What it records is described in the Privacy Statement.
The session cookie is a random token that means nothing on its own; it identifies a row in our database and is only linkable to you by us. Where a cookie identifies a person indirectly, it is personal data and the Privacy Statement applies to it — including your rights and who to ask.
If eCorpOS ever sets a cookie that is not strictly necessary, this page will say so before it does, and consent will be asked for properly rather than assumed.