Política de cookies

Scope of this document

This is the only cookie policy of Voice Scan Lab, S.L. It covers the real cookies of both sites:

• the informational website voicescanlab.com (WordPress exported to static); and
• the platform app.voicescanlab.com.

Before this version, the public WordPress site had its own text (portal_wordpress/seed/pages/cookies.md), which correctly declared "technical cookies only" but did not mention the Umami analytics the site already uses (portal_wordpress/mu-plugins/10-analitica-umami.php). That text is replaced by this one, not corrected separately — see EVALUACION_TEXTOS_WORDPRESS.md and PLAN_ARMONIZACION.md.

1. What cookies are (and what else this document covers)

Cookies are small files a website installs in your browser to remember information about your visit or your session. The same legal regime (article 22.2 of Spanish Law 34/2002, LSSI-CE) applies to any access to information already stored on your device, so this document also covers the platform's use of the browser's localStorage and sessionStorage, even though they are not technically cookies.

2. Cookies and storage on the public website (voicescanlab.com)

Item	Type	Purpose	Duration
WordPress session cookies (wordpress_*, wp-settings-*)	Technical, strictly necessary	Only set if Voice Scan Lab's authorised staff log into the admin area. A normal visitor to the public site receives none of these	Browser session, or up to 14 days if "Remember me" is checked; wp-settings-* up to 1 year
Umami analytics (analytics.voicescanlab.com)	Analytics, cookieless	Measuring aggregate visits to the public site (page views, referrer, device)	Not applicable: no identifier is stored in your browser

About Umami — why no consent is needed for this: Umami is an analytics tool that we host ourselves on our own infrastructure (it is not a third party we share data with), does not set any cookie or use persistent fingerprinting to identify you, and does not cross-reference your visit with your visits to other sites. It measures visits in aggregate, without building an individual profile of you that survives the session. For that reason we understand that the prior-consent duty under LSSI art. 22.2 — designed for access to or storage of information on the terminal equipment — does not apply here. This is our own interpretation, consistent with how other cookieless analytics implementations on the market are treated; if we ever change tool or configuration and it stops meeting these three conditions (self-hosted, cookieless, no persistent individual profile), we will update this document before the change.

3. Cookies and storage on the platform (app.voicescanlab.com)

The platform exclusively uses technical cookies and storage, necessary for it to work. We do not use analytics, advertising or third-party cookies on the platform.

3.1 Cookies

Cookie	Type	Purpose	Duration
VOISCESCAN_PHPSESSID	Technical, strictly necessary	Securely identifying you while you use the platform after logging in	Browser session
user_language	Technical, strictly necessary	Remembering which language you want to view the platform in	1 year
Internal support cookies for Voice Scan Lab's authorised staff	Technical, strictly necessary	Internal diagnostic and development tools, not accessible to a normal user	Not applicable to platform users

Internal note on the "support" row: the platform's code (UsersController.php, the CS_MASTERPASSWORD_COOKIE_ENABLED/NAME/VALUE variables, and a check of a csdebug cookie in BaseController.php) contains an internal cookie mechanism for authorised staff, as anticipated in this assignment. It is described here in generic terms, without detailing how it works, for evident security reasons: publishing the exact name and mechanism of a cookie that grants privileged access would be a security problem, not just a transparency one. This does not exempt us from raising an underlying question that is not ours to solve but that should be flagged to whoever is responsible on the technical team: a privileged-access mechanism via cookie, if it can bypass normal authentication, is a security risk surface that should be reviewed independently of this legal assignment.

3.2 Browser local storage (localStorage / sessionStorage)

Key (or key family)	Storage	Purpose	Duration
vs_legal_privacy_accepted	sessionStorage	Not asking you to accept the privacy policy again within the same anonymous recording session if you already accepted it	Browser session
Audio capture parameters (device, gain and recording settings)	localStorage	Remembering your recording preferences between visits, so you do not have to reconfigure them each time	Persistent until you clear the site's data
voicepro_token	localStorage	Keeping your application session (authentication token)	Persistent until logout or token expiry
voicepro_auth_visited	localStorage	Remembering that you have already visited the login screen, for minor interface adjustments	Persistent until you clear the site's data
Per-page interface preferences (uiPrefs)	localStorage	Remembering display settings you have chosen (for example, a table's columns)	Persistent until you clear the site's data
Install prompt (PWA) state	localStorage	Not showing you the "install the app" prompt again if you already installed it or dismissed it	Persistent until you clear the site's data

All of these uses are strictly functional: none are shared with third parties, none serve advertising purposes or build a browsing profile, and their sole purpose is to make the platform work and remember your preferences from one use to the next.

4. Why no consent banner is needed

Article 22.2 of Spanish Law 34/2002 (LSSI-CE) exempts from the duty to request prior consent those cookies "strictly necessary for the provision of a service expressly requested by the user". The cookies and local storage described above — both on the public site and on the platform — fall within that exemption: without them, you simply could not use the service you requested (logging in, viewing the platform in your language, not losing your recording settings). That is why we do not show a cookie banner — showing one when it is not needed would, in fact, go against the criteria of the Spanish Data Protection Agency's (AEPD) Cookie Guide (July 2023 version, updated in May 2024), which requires that accepting and rejecting be equally easy when a banner is actually needed, and that it not be used as decoration when it is not.

A real example of what can go wrong if this rule is not respected: the AEPD fined Iberia €30,000 (file PS-00032-2020, later upheld by the Audiencia Nacional) for not offering the option to reject cookies as easily as accepting them. That is why, on the day either site adds any cookie that is not strictly necessary, the banner added must offer accept, reject and configure at the same first level, with buttons that have no colour or shape differences that make the reject option harder to find — see BENCHMARK_WEBS.md.

If in the future either site adds cookie-based analytics, advertising, or any other cookie or storage that is not strictly necessary, this policy must be updated before it is activated, and that prior consent banner would then be required.

5. How to disable cookies and local storage

You can configure your browser to block or delete cookies, and clear the site's local storage from its privacy settings. Keep in mind that, since all of them are necessary for the service to work, disabling them may prevent you from logging in or using the website or the platform normally.

6. More information

For any question about this policy, write to us at legal@voicescanlab.com.

---

Change log

• v1.1 (2026-09-16): Scope section; explicit coverage of the real cookies and local storage of both sites (it previously only covered the platform); table of the platform's cookies and localStorage/ sessionStorage with real names and durations verified in the code (VOISCESCAN_PHPSESSID, user_language with a 1-year duration, voicepro_token, capture parameters, etc.); section on the public site's Umami analytics, absent from the WordPress text this replaces; the Iberia AEPD fine as an example; contact email; English version (COOKIE_POLICY_EN.md).
• v1.0 (2026-09-16): initial drafting, platform only.