This is a notice, not a consent banner, and section 3 explains why we think that is the honest form for it to take.
1. What Supligo sets
Supligo sets exactly one kind of cookie: the one that keeps you signed in. There are three, one per application, and they do the same job for different audiences.
| Cookie | Who gets it | What it is for |
|---|---|---|
os_sess | Supplier staff signed into the Supligo workspace | Keeps you signed in between page loads. |
sf_sess | A buyer signed into a supplier’s storefront | Keeps a buyer signed in while they order. |
ctl_sess | Supligo’s own operators | Keeps an operator signed into the internal console. |
All three are httpOnly — JavaScript on the page cannot read them, which is what stops a script injected into a page from stealing a session. They contain an opaque identifier, not your name, your email or anything about you. They expire when the session ends or when you sign out.
2. What Supligo does not set
There is no analytics cookie, no advertising cookie, and no third-party script setting cookies on any Supligo page. We do not run trackers, pixels, or session recorders. The internal operator console goes further and forbids third-party script entirely through its Content-Security-Policy.
3. Why this is a notice and not a consent request
A cookie that is strictly necessary to deliver a service the user asked for does not require consent — under PIPEDA, and under the ePrivacy Directive’s equivalent carve-out. A session cookie for a service you have signed into is the textbook example: without it, you cannot stay signed in.
Asking for consent to something you cannot decline is not consent, and a banner that appears on every page for a cookie nobody can refuse trains people to dismiss banners that matter.
The day Supligo sets a single analytics or marketing cookie, this stops being true and this notice becomes a consent flow with a genuine refusal. That is written here so the change cannot be made quietly.
4. Controlling cookies
Your browser can block or delete cookies. Blocking ours means you cannot stay signed in to Supligo — that is the whole of what they do. Questions: [email protected].