Cookies Policy

1. What cookies are

Cookies are small text files placed on your device when you visit a site. We also use closely-related technologies — local storage, session storage, and pixel tags — which we collectively refer to as "cookies" in this policy.

2. How we use cookies

We use cookies to keep you signed in, remember preferences, secure your session, measure how the site is used, and — only if you allow it — measure which of our adverts brought you to us. We do not sell cookie data, and nothing beyond strictly-necessary cookies is set on yezda.co.uk until you choose to allow it.

3. Categories we set

Strictly necessary — required for the site to work (auth, CSRF, load balancing). No consent required under PECR reg. 6(4).
Functional — remember your choices (language, theme, dismissed banners). Set only with your consent.
Analytics — Google Analytics and PostHog (EU hosting), so we can see which pages are used and improve the site. Set only with your consent. If you then sign up, PostHog links these visits to your account so we can see which pages led to it.
Advertising — tags from the ad platforms we advertise on (Google Ads, LinkedIn, Meta, Microsoft Advertising, Reddit, TikTok and X) that tell us which adverts led to a visit or a sign-up. Set only with your consent. We use them to measure our own campaigns; we do not let these platforms run on the customer portal.
Security — bot detection and abuse prevention on the public verification page. Set under legitimate-interests / strictly necessary.

4. Cookies we use

Name	Purpose	Category	Expiry
yz_session	Authenticated session	Strictly necessary	Session
yz_csrf	Cross-site request forgery token	Strictly necessary	Session
yz_lb	Load-balancer affinity	Strictly necessary	1 hour
yz_consent	Stores your cookie choices and a random consent ID	Strictly necessary	12 months
yz_pref_density	Remembers UI density choice	Functional	12 months
yz_pref_theme	Remembers light/dark choice	Functional	12 months
yz_attr	Remembers the campaign or advert that brought you to yezda.co.uk, so it can be credited if you sign up	Analytics / Advertising	90 days
_ga, _ga_*	Google Analytics: distinguishes visitors and sessions	Analytics	2 years
ph_*_posthog	PostHog: distinguishes visitors and sessions (shared with portal.yezda.co.uk, which reads it but sets no cookie of its own)	Analytics	1 year
_gcl_au, _gcl_aw	Google Ads: links a visit or sign-up to an ad click	Advertising	90 days
_fbp, _fbc	Meta (Facebook/Instagram): links visits to Meta ads	Advertising	90 days
li_fat_id	LinkedIn: links a visit to a LinkedIn ad click	Advertising	30 days
_uetsid, _uetvid, _uetmsclkid	Microsoft Advertising (Bing): links visits to Microsoft ads	Advertising	1 day to 13 months
_rdt_uuid, _rdt_cid	Reddit: links visits to Reddit ads	Advertising	90 days
_ttp, ttcsid	TikTok: links visits to TikTok ads	Advertising	Up to 13 months
_twclid	X (Twitter): links visits to X ads	Advertising	Up to 2 years
yz_verify_rl	Rate-limit token on the public verify page	Security	15 minutes

5. Third-party cookies

If you allow analytics or advertising cookies on yezda.co.uk, the providers above load their own scripts, which may also set or read cookies on their own domains (for example linkedin.com, bing.com or x.com) under their own privacy policies. Those cookies let the platform recognise that a visit came from one of its adverts.

When you sign up for Yezda after allowing advertising cookies, we tell the relevant platforms that the sign-up, the start of a free trial and the first payment happened, using the ad click identifiers above and a hashed (one-way encrypted) copy of your work email and name, so they can match it to the advert. See our Privacy Policy. No candidate or screening data is ever shared with an ad platform.

The customer portal runs no analytics or advertising scripts and sets no third-party cookies. The candidate mobile app uses Firebase Cloud Messaging tokens for push delivery — these are device tokens, not browser cookies, and are described in the Privacy Policy.

On your first visit, you are asked to accept or reject non-essential cookies via our cookie banner. Under "Manage" you can allow analytics and each advertising platform separately — for example LinkedIn but not TikTok. You can change your choice at any time using the "Cookie settings" link in the footer. Withdrawing consent deletes the analytics and advertising cookies listed above, and if you have already signed up, removes the ad identifiers we stored with your sign-up for the platforms you withdrew. You can also opt out on the sign-up form itself.

So that we can show what you agreed to, we keep a record of each choice: the random consent ID from the yz_consent cookie, what you allowed, the version of the banner wording you saw, your browser type and the time. It contains nothing else about you and is deleted after 28 months. You can also block or delete cookies in your browser:

Blocking strictly-necessary cookies will prevent the customer portal from working.

7. Do Not Track

We honour Global Privacy Control (GPC) signals: if your browser sends GPC, we treat it as a refusal of non-essential cookies and do not show the banner. You can still opt in yourself from "Cookie settings".

8. Changes

If we add or change cookies, this page will be updated and the "Last updated" date revised. Material additions in non-essential categories will trigger a renewed consent prompt.

9. Contact

Questions: info@yezda.co.uk.