Cookie & Local-Storage Policy

Last updated: 30 October 2026 · Version 2.15

This Cookie & Local-Storage Policy explains how Propel (the “Service”, available at propeltech.io) and its provider, CLV LABS SL, a company incorporated in Spain, registered office at Calle Guerau de Liost 8, 08017 Barcelona, Spain, tax ID B05632997, use cookies and equivalent browser-storage technologies (local storage, session storage, IndexedDB, the service-worker cache and similar).

It is published under the Spanish Ley 34/2002 de Servicios de la Sociedad de la Información y de Comercio Electrónico (LSSI-CE), in particular its Article 22.2, the EU ePrivacy Directive (as transposed), the EU GDPR (Reg. 2016/679) and the Spanish LOPDGDD (Ley Orgánica 3/2018), and it follows the Agencia Española de Protección de Datos (AEPD) guide on the use of cookies. Read it together with our Privacy Policy and the Legal Notice.

1. What are cookies and local storage?

A cookie is a small text file that a website asks your browser to store on your device. On each later request to the same site, the browser sends it back, which lets the site keep you signed in, remember preferences and, in some cases, measure how it is used.

Browsers also offer related storage technologies, which this policy treats the same way:

• Local storage and session storage: key/value data kept in the browser. Local storage persists until cleared; session storage is cleared when the tab closes. Unlike cookies, it is not sent with every request.
• IndexedDB: a client-side database, which Propel uses only to hold large email drafts.
• Service worker and Cache Storage: a small script the browser keeps for the site, which Propel uses to show an offline page and to display notifications you have turned on.

References to “cookies” include these technologies, because the LSSI-CE / ePrivacy rules apply to any storage of, or access to, information on a user’s device, whatever the mechanism.

2. Who sets cookies: first-party vs third-party

• First-party: everything in section 4 is set on Propel’s own domain, except LinkedIn’s own cookies on linkedin.com (below), and all of it by Propel itself except the items that Google’s and LinkedIn’s scripts write on propeltech.io: the two cookies of Google Analytics if you accept analytics (section 3.3), and those of Google Ads (_gcl_au, _gcl_aw, and _gcl_ls in local storage) and LinkedIn’s li_fat_id if you accept advertising (section 3.4). The sign-in cookie is written by the app’s own script on the address the app is served from; the app’s API, on another address of Propel’s own backend, reads no cookie, because the app sends the session with each request. So the sign-in cookie is ours and not a provider’s.
• Third-party: only three providers’ scripts can set or read cookies here: Cloudflare Turnstile on the sign-in and account forms (section 7); on propeltech.io and only if you accept analytics or advertising, Google Tag Manager, which loads Google Analytics if you accept analytics (section 3.3) and Google Ads if you accept advertising (section 3.4); and, loaded by Google Tag Manager only if you accept advertising, LinkedIn’s Insight Tag (section 3.4), which also uses LinkedIn’s own cookies, set on linkedin.com domains and listed in section 4 as third-party. Section 7 lists the providers your browser does contact, and the flows that take you to a provider’s own site, such as Stripe’s pages for a payment, where it sets its own cookies. Two more scripts run unless you refuse analytics: Plausible’s statistics script and, on propeltech.io, Cloudflare Web Analytics (section 3.3); neither sets a cookie or stores anything in your browser.

3. Categories of cookies and storage we use

Propel is a business productivity tool, not an advertising product. We use the minimum needed to run it securely, and three optional categories that you decide on.

3.1 Strictly necessary, always on. Required to provide a service you asked for: keeping you signed in, knowing which organization’s data to load, applying the interface settings you chose, and remembering your cookie choice itself. Under Article 22.2 LSSI-CE these are exempt from consent; switching them off would break the Service.

3.2 Functional, set by using a feature. These remember choices you make while working: your language, saved views, list columns and sorting, board settings, open panels, snoozed items, email drafts and onboarding progress. They stay on your device, hold no identifier used to follow you elsewhere, and each one appears only because you used the feature it belongs to. They are also exempt from consent, as storage you requested.

3.3 Analytics: Plausible and Cloudflare Web Analytics unless you refuse them; Google Analytics and Propel’s own measurement only if you accept. Plausible (Plausible Insights OÜ, Estonia, on servers in the EU, acting for us) counts visits to propeltech.io, the help center and the app: the page (in the app, the screen, never the record or a search), the referring site, the browser, operating system and type of device, and the country, which it derives from your IP address without storing it. It sets no cookie, stores nothing on your device and cannot recognise you on another site or another day, so it counts your visit from the first page, until you press Reject or switch analytics off (section 6). Cloudflare Web Analytics (Cloudflare, Inc., acting for us) measures how fast the pages of propeltech.io load for the people who open them: the page address and the referring page, both without their parameters, load and display timings, the browser and operating system and their versions, and a random number that identifies that one page view and nothing else. It sets no cookie and stores nothing on your device either, it runs only on propeltech.io (not in the app or the help center), and it stops in the same way. Google Analytics (Google Ireland Limited, with Google LLC in the United States, acting for us), loaded through Google Tag Manager, measures visits to the website, propeltech.io, and nowhere else: not the app, the help center or the pages Propel serves for its customers. It records the pages you open and, where Propel’s Google Analytics property measures them, your interactions on those pages, the referring site, your browser, device and approximate location, and keeps a random identifier in two cookies, _ga and _ga_<id> (section 4), so that your later visits count as the same visitor’s. Because it stores and reads cookies, it is off by default and is loaded only after you press Accept or switch analytics on: never before you choose, and never after you refuse. Unless you also accept advertising (section 3.4), Google is told that advertising storage, the use of your data for advertising and ad personalisation are not allowed (Google’s consent mode). If you refuse later, its two cookies are deleted, Google is told at once that it may no longer use them, and it is not loaded again. Propel’s own product analytics records which screens are opened and which actions are used (for example, “opened the deals board”, “searched the inbox”), queues them in your browser and sends them to Propel’s own servers; screens are recorded by their route (/deals/:id), never by the record you opened, and Propel keeps them for 180 days. Because it stores data on your device, it is off by default and runs only after you press Accept or switch analytics on. Advertising is a separate category, which needs its own yes (section 3.4).

3.4 Advertising, only if you accept: Google Ads and LinkedIn Ads. On the website, propeltech.io, and nowhere else (not the app, the help center or the pages Propel serves for its customers), Google Tag Manager can load two advertising tags. Google Ads (Google Ireland Limited, with Google LLC in the United States) measures which of Propel’s ads lead to a demo request or a booked demo (conversion measurement), and may show you Propel’s ads on other sites (remarketing). With enhanced conversions, when you send a demo request, the email address you typed is passed to Google’s tag, which hashes it (SHA-256) in your browser before sending it, so that Google can match the conversion to a Google account; this happens only with your yes to advertising. Google also receives the conversion (demo request or demo booked), Propel’s identifier for that request (so that it is not counted twice), the page, the identifier of the ad click and your browser and device details. Its cookies _gcl_au and _gcl_aw, and _gcl_ls in local storage (section 4), set on propeltech.io, keep the identifier of the ad click that brought you for up to 90 days. LinkedIn Ads (LinkedIn Ireland Unlimited Company, with transfers to LinkedIn Corporation in the United States), through the LinkedIn Insight Tag, measures which of Propel’s LinkedIn ads lead to a demo request and may show you Propel’s ads on LinkedIn (retargeting). It sets li_fat_id on propeltech.io, which keeps the identifier of a LinkedIn ad click for up to 30 days, and uses LinkedIn’s own cookies on linkedin.com domains (li_sugr, bcookie, lidc, UserMatchHistory, AnalyticsSyncHistory; section 4). Google and LinkedIn also use the data for their own purposes as controllers, under their own privacy policies (Google, LinkedIn). Advertising is off by default and nothing is ticked in advance: it runs only after you press Accept or switch advertising on in Configure, Reject leaves it off, and a choice you made before 30 October 2026 counts as a no. Google’s consent mode allows advertising storage, ad user data and ad personalisation only with your yes to advertising (and Google Analytics’ storage only with your yes to analytics); until your choice has been applied on each page, all of them are denied. If you refuse later, Google is told at once, both tags stop, and the cookies and storage on propeltech.io (_gcl_*, _gcl_ls, li_fat_id) are deleted. LinkedIn’s own cookies on linkedin.com cannot be deleted by Propel: you can delete them in your browser’s settings (section 6), or manage them in LinkedIn’s ad settings, at linkedin.com/psettings/advertising. Propel uses no other advertising cookies and does not sell personal data. Adding any would require updating this policy and asking for your consent first.

3.5 Partner link, only if you accept. If you arrive through a Propel partner’s referral link, the partner’s code can be kept in this browser for up to 90 days, so the partner is credited if you sign up later. It is kept only if you accept “Partner link” in the cookie banner, and refusing it deletes a code already kept. Without it nothing is stored on your device, and a sign-up in the same visit is still credited, because the code then travels with the account.

4. Cookie & local-storage table

The <project> part of the session cookie is the first part of the address of the Propel backend the app signs in to, and the <id> part of the second Google Analytics cookie is the identifier of Propel’s Google Analytics property. LinkedIn’s own cookies, the last five rows, are third-party: LinkedIn sets and reads them on linkedin.com domains, and the durations are LinkedIn’s. We keep this table in line with each release.

5. Legal basis: necessity vs consent

• Strictly necessary items (section 3.1) are used without consent, because they are indispensable to a service you requested. The related processing relies on the performance of our contract with you and our legitimate interest in running and securing the Service (GDPR Art. 6(1)(b) and 6(1)(f)).
• Functional items (section 3.2) are written only because you used the feature they belong to, and store your own choice on your own device.
• Propel’s own product analytics (section 3.3) is used only with your prior consent (Art. 22.2 LSSI-CE; GDPR Art. 6(1)(a)). Continuing to browse, scrolling or closing the banner is not consent: until you press Accept or switch analytics on, it records nothing.
• Google Analytics, and Google Tag Manager, which loads it (section 3.3), are used only with your prior consent (Art. 22.2 LSSI-CE; GDPR Art. 6(1)(a)), because they store and read cookies on your device. Until you press Accept or switch analytics on, Google Analytics is not loaded at all, and once you refuse, it is not loaded again; Google Tag Manager is loaded only with a yes to analytics or to advertising. Google LLC receives the data in the United States under the EU–US Data Privacy Framework (section 8).
• Google Ads and LinkedIn Ads (section 3.4) are used only with your prior consent (Art. 22.2 LSSI-CE; GDPR Art. 6(1)(a)), because they store and read cookies on your device, and the email you type in a demo request reaches Google, hashed, only with that consent. Until you press Accept or switch advertising on, they do not run, and a choice you made before this category existed (30 October 2026) counts as a no for it. Google and LinkedIn also use the data for their own purposes as controllers, under their own privacy policies (Google, LinkedIn). Google LLC and LinkedIn Corporation receive the data in the United States under the EU–US Data Privacy Framework (section 8).
• Plausible (section 3.3) relies on our legitimate interest in knowing, in aggregate, how the site and the Service are used, so that we can improve them (GDPR Art. 6(1)(f)). It stores nothing on your device, identifies no one and keeps no IP address; its script reads only the page address, the referring site and the screen width, which tells the type of device. That is why it runs without asking first, and why you can object at any time and as easily: Reject in the banner, or analytics switched off in Cookie settings, stops it at once.
• Cloudflare Web Analytics (section 3.3) relies on the same legitimate interest, in knowing how fast the site loads for the people who open it, so that we can make it faster. It stores nothing on your device and identifies no one; its script reads the page address and the referring page without their parameters, the page’s load timings and the browser’s version. It runs without asking first for the same reason, and you can object to it in the same way, which stops it at once.

6. Your controls

The banner. On your first visit a banner offers Accept, Reject and Configure, with the same prominence, and links to this page. It does not block the page, and nothing that needs your consent is switched on in advance; Plausible and Cloudflare Web Analytics, which do not (section 5), run unless you press Reject. Configure shows each category and lets you turn each optional one (analytics, the partner link and advertising) on or off. Your choice is kept for 12 months, by each address separately: the choice you make on propeltech.io is the one that governs Google Analytics, Google Ads and LinkedIn Ads, which run only there.

Changing your mind. Use Cookie settings in the footer of the public site, or Settings → Data → Cookie settings in the app. Refusing analytics is as easy as accepting it and takes effect at once: the analytics queue on your device is deleted and nothing more is sent to Propel, to Plausible or to Cloudflare; Google Analytics’ cookies are deleted, Google is told that it may no longer use them, and Google Tag Manager is not loaded again unless advertising is on. Refusing advertising takes effect at once in the same way: Google is told at once, the Google Ads and LinkedIn tags stop, and the cookies and storage on propeltech.io (_gcl_*, _gcl_ls, li_fat_id) are deleted. LinkedIn’s own cookies on linkedin.com cannot be deleted by Propel: delete them in your browser’s settings (below), or manage them in LinkedIn’s ad settings, at linkedin.com/psettings/advertising.

Signing out clears the items that belong to your session: crm_auth, your mailbox and drafts, the assistant conversation, saved views, distribution lists, snoozed items, board settings, onboarding progress and recently viewed records. It keeps per-browser preferences (language, interface settings and your cookie choice), which are not tied to an account.

Browser controls. You can inspect and delete everything above from your browser:

• Google Chrome, Settings → Privacy and security → Third-party cookies / Site data.
• Mozilla Firefox, Settings → Privacy & Security → Cookies and Site Data.
• Apple Safari, Settings → Privacy → Manage Website Data.
• Microsoft Edge, Settings → Cookies and site permissions.

Deleting the strictly necessary items (the session cookie or crm_auth) signs you out. Deleting the functional items loses your saved views, drafts and preferences.

7. Third parties your browser contacts

Apart from Cloudflare Turnstile on the sign-in and account forms, the statistics scripts of Plausible and Cloudflare Web Analytics unless you refuse analytics, and Google Tag Manager on propeltech.io, with Google Analytics only if you accept analytics, and Google Ads and LinkedIn’s Insight Tag only if you accept advertising (all below), no third-party script runs on Propel’s pages. Your browser does, however, request some content directly from other providers, which lets them see your IP address and browser details, and some flows take you to a provider’s own site:

• Company logos: Propel’s server fetches a company’s logo from that company’s own website and shows it from Propel, so your browser contacts neither the company nor Google for it. No cookie of ours is involved.
• Contact photos: when a Google account is connected, contact photos may load from Google’s image servers.
• Sign-in and connections: connecting Google (Gmail, Calendar, Contacts) or Microsoft (Outlook) takes you to their sign-in pages, which set their own cookies under their own policies.
• Sign-in protection: the sign-in, sign-up, password-recovery and password-change forms load Cloudflare Turnstile from Cloudflare’s servers (challenges.cloudflare.com), which checks that a request comes from a person and not from an automated script. To do that it processes your IP address and signals from your browser and device, and may read or store information in your browser for that check, under Cloudflare’s policies. It is part of keeping accounts secure, so it is not one of the optional categories the banner controls, and it runs only on those forms.
• Payment: paying for a Plan or AI credits, or changing the card, in Settings → Plan & usage takes you to Stripe’s own pages (checkout.stripe.com, billing.stripe.com, invoice.stripe.com). The card form is Stripe’s: your browser sends the card details directly to Stripe, never to Propel, and Stripe sets or reads its own cookies there, under Stripe’s policies. If your bank asks you to confirm the payment (3-D Secure), that step is shown by Stripe and your bank. No Stripe script is loaded on Propel’s own pages.
• Statistics: unless you refuse analytics, your browser loads Plausible’s script from plausible.io and sends it each page you open here, cleaned first: on the site and the help center the page address without its parameters (except campaign tags such as utm_source), in the app only the screen (/contacts/:id), never a record or a search. Plausible Insights OÜ (Estonia) processes it for us on servers in the EU; it sees your IP address to work out the country and to count a visitor once a day, and does not keep it. It is not loaded on the pages Propel serves for its customers (forms, booking pages and quote links).
• Page speed: unless you refuse analytics, on propeltech.io your browser loads Cloudflare Web Analytics from static.cloudflareinsights.com and sends cloudflareinsights.com how the page loaded: its address and the referring page without their parameters, load and display timings, the browser and operating system and their versions, and a random number for that page view. Cloudflare, Inc. processes it for us; it sees your IP address, as it does for every request to propeltech.io, which it serves. It is not loaded in the app, the help center or the pages Propel serves for its customers.
• Google Analytics: only if you accept analytics, on propeltech.io your browser loads Google Tag Manager from www.googletagmanager.com, which loads Google Analytics and sends it, for each page you open on the website, its address and title, the referring page, your browser, device and screen size, the identifier in its cookies and, where Propel’s Google Analytics property measures them, your interactions on the page, to *.google-analytics.com and *.analytics.google.com. Google Ireland Limited processes it for us, with Google LLC in the United States. Google sees your IP address; Google states that Google Analytics uses it to estimate your approximate location and does not store it. Unless you accept advertising, Google’s consent mode tells it that advertising storage, ad user data and ad personalisation are not allowed. It is not loaded in the app, the help center or the pages Propel serves for its customers.
• Google Ads: only if you accept advertising, on propeltech.io your browser loads Google Tag Manager from www.googletagmanager.com, which runs Google Ads: it measures which of Propel’s ads lead to a demo request or a booked demo, and may show you Propel’s ads on other sites (remarketing). It sends Google the conversion (demo request or demo booked), Propel’s identifier for that request, the page, the identifier of the ad click and your browser and device details and, when you send a demo request, the email you typed, hashed (SHA-256) in your browser by Google’s tag (enhanced conversions), to Google Ads’ hosts (www.googleadservices.com, googleads.g.doubleclick.net, www.google.com, pagead2.googlesyndication.com). Google Ireland Limited receives it, with Google LLC in the United States, and sees your IP address; Google also uses the data for its own purposes as controller, under its own privacy policy (Google). Google’s consent mode allows advertising storage, ad user data and ad personalisation only with your yes to advertising. It is not loaded in the app, the help center or the pages Propel serves for its customers.
• LinkedIn Ads: only if you accept advertising, on propeltech.io Google Tag Manager loads the LinkedIn Insight Tag from snap.licdn.com, which measures which of Propel’s LinkedIn ads lead to a demo request and may show you Propel’s ads on LinkedIn (retargeting), and reports to px.ads.linkedin.com. It sets li_fat_id on propeltech.io and uses LinkedIn’s own cookies on linkedin.com domains (section 4). LinkedIn Ireland Unlimited Company receives the data, with transfers to LinkedIn Corporation in the United States, and sees your IP address; LinkedIn also uses the data for its own purposes as controller, under its own privacy policy (LinkedIn). It is not loaded in the app, the help center or the pages Propel serves for its customers.
• Notifications: if you turn on browser notifications, they are delivered through your browser vendor’s push service (for example Google, Mozilla or Apple).

Where one of these providers sets a cookie, it does so on its own domain as an independent controller. Email open and click tracking applies to messages Propel users send, not to visitors of this site; it is described in the Privacy Policy.

8. International transfers

The items in section 4 stay on your device or go to Propel’s own servers, except the Google Analytics cookies, whose identifier reaches Google with each page you open on propeltech.io, the Google Ads cookies, whose ad-click identifier reaches Google with a demo request or a booked demo, and LinkedIn’s cookies, which reach LinkedIn; with your yes to advertising, the email you type in a demo request also reaches Google, hashed. Google LLC and LinkedIn Corporation, in the United States, are certified under the EU–US Data Privacy Framework, the adequacy decision those transfers rely on. Where another provider in section 7 processes data outside the EEA, the safeguards for that transfer (such as the EU Standard Contractual Clauses or an adequacy decision) are described in the Privacy Policy.

9. Changes to this Cookie Policy

We update this policy when the cookies or storage we use change, or when the law does. A new optional category is never switched on by an earlier choice: either the banner asks again before it is used, or an earlier choice counts as a no for it; and the date above changes. So when Plausible joined analytics on 11 October 2026, the banner asked everyone again. Since version 2.5 of the same day Plausible runs unless you refuse it (section 5), and a refusal you gave earlier still stops it. Cloudflare Web Analytics joined it on the same terms in version 2.7, so a refusal you gave before then stops it too. Google Analytics joined analytics on 26 October 2026 (version 2.12), the first item there that sets cookies, so the banner asked everyone again: it is loaded only after a yes given since then. Advertising, a third optional category, joined on 30 October 2026 (version 2.14): a choice you made before then counts as a no for it, so the banner does not ask again, and it runs only after a yes given since then, in the banner or in Cookie settings. The same day (version 2.15) it widened to Google Ads remarketing and enhanced conversions and to LinkedIn Ads, with the same rule.

10. Contact

• Privacy and data-protection requests: team@clvlabs.tech
• Provider: CLV LABS SL, Calle Guerau de Liost 8, 08017 Barcelona, Spain, B05632997
• Or use the contact page on propeltech.io

You also have the right to lodge a complaint with the Spanish supervisory authority, the Agencia Española de Protección de Datos (AEPD), www.aepd.es. See also our Privacy Policy and the Legal Notice.

Published and in force as of the date above. It describes the cookies and browser storage the Service actually sets.