1. What this policy covers
This policy explains how xeplans.com uses cookies and similar technologies, what we would ask your permission for, and how you control it. It forms part of our Privacy Policy at xeplans.com/privacy, which explains everything else we do with personal data.
2. The position today: this site sets no cookies
xeplans.com sets no cookies of its own. It does not use local storage, session storage, pixels, web beacons, device fingerprinting or any similar technology to identify you or to follow you across sites. It shows no advertising and runs no advertising network.
Because there is nothing that requires consent, the site shows no cookie banner. A banner that asked permission for nothing would be a dark pattern, not compliance. If this changes, section 5 governs what happens before any cookie is set.
The pages are static. The third-party services the site uses are described in section 8; on the date above, none of them sets a cookie on your device through this site.
3. What cookies and similar technologies are
A cookie is a small text file a site asks your browser to store and send back on later visits. A first-party cookie is set by the site you are visiting; a third-party cookie is set by another company whose code the site loads. Session cookies are deleted when you close the browser; persistent cookies stay until they expire or you delete them.
Similar technologies do the same job by other means: local and session storage, pixels and web beacons (a tiny invisible image that reports that a page or email was opened), software development kits inside mobile applications, and fingerprinting (recognising a device from its configuration). Wherever this policy says "cookie" it means all of them, because the law treats them the same way.
4. The categories, and the rule that applies to each
If the site ever uses cookies, every one of them will fall into one of these categories, will be listed in this section with its name, provider, purpose and lifetime before it is ever set, and will follow the rule in the last column.
| Category | What it does | Rule |
|---|---|---|
| Strictly necessary | Makes the site work: security, load balancing, fraud and bot prevention, remembering your cookie choice, remembering your language | Set without consent, because you asked for the page. Still disclosed here |
| Functional | Remembers a preference you chose, such as a theme or a saved form draft | Consent first |
| Analytics and performance | Counts visits and measures how pages perform | Consent first, except where a strictly anonymous, cookieless measurement is used and the law of your territory permits it without consent |
| Advertising, marketing and profiling | Builds a profile, targets advertising, measures campaigns, shares data with an advertising network | Consent first, always, everywhere. We do not currently use this category at all |
We will never place a cookie in the functional, analytics or advertising categories on your device before you have given consent where consent is required.
5. How consent works, if a cookie ever needs it
These rules bind us from today, before any cookie exists.
- Nothing non-essential is set first. No cookie outside the strictly necessary category is written, and no non-essential third-party script is loaded, until you have made a choice. Consent is asked for before the technology runs, not after.
- Refusing is as easy as accepting. The consent notice offers "Accept all" and "Reject all" with equal prominence, in the same style, at the same level, with no pre-ticked box, no dark pattern, no nagging repetition, and no cookie wall that denies access to the site if you refuse.
- Granular choice. You can accept some categories and refuse others. Consent is collected per category and, where a provider requires it, per provider.
- Silence is refusal. Closing the notice, pressing escape, ignoring it or scrolling past it is treated as a refusal, never as consent.
- Withdrawing is always available. A permanent control on every page lets you change or withdraw your choice at any time, in one step, as easily as you gave it. Withdrawal takes effect immediately, and cookies set under the withdrawn consent are deleted.
- Consent expires. A choice is remembered for no longer than 12 months, after which you are asked again. A new category, a new provider or a new purpose resets it and requires a fresh choice.
- Consent is recorded. We keep a record of what you were shown, what you chose, when, and the version of the notice, so we can demonstrate consent. The record itself is kept in a strictly necessary cookie and for no other purpose.
- Territory rules. Where the law of your territory requires prior consent — including the EU and UK ePrivacy rules with the GDPR, and the Saudi PDPL — we ask for it before anything is set. Where the law instead requires an opt-out — including the United States state privacy laws — we honour the opt-out, and we honour a Global Privacy Control signal as a valid opt-out of any sale or sharing. Where we cannot reliably determine your territory, we apply the strictest rule.
6. How to change your mind, and how to control cookies yourself
While the site sets no cookies there is nothing to change. If that changes, the control described in section 5 appears on every page.
Independently of us, you can always control cookies in your browser: block them all, block third-party cookies only, delete those already stored, or open a private window. Every major browser explains how in its own help pages, and every major browser also lets you send a Global Privacy Control or Do Not Track signal. We honour a Global Privacy Control signal. Blocking strictly necessary cookies may stop parts of a site working — not this one today, since it sets none.
7. Cookies we do not set, and never will without telling you
We do not, and will not without first updating this policy and asking for consent where it is required: sell or share data collected by a cookie; use a cookie to build an advertising profile of you; use fingerprinting to identify you where you have refused cookies; or place a cookie on a device belonging to a child.
8. Third-party services used by this site
| Service | What it does here | Storage on your device |
|---|---|---|
| Our hosting, security and rate-limiting provider | Serves every page and protects the site from attack and flooding | None set through this site. The provider may set a cookie only where it must challenge a request it believes is an attack, in which case it is strictly necessary |
| Our web analytics provider | Counts visits by page, country and browser | None. The provider states it uses no cookies, no local storage and no fingerprinting |
| Our bot-protection provider, on the brief form only | Checks that a form submission is not automated | None set for tracking. Any token it uses is strictly necessary to complete that check |
| Our error-reporting provider, on the home page only | Receives a fault report when a page error happens | Nothing stored. Its script reads your browser's identification text, language, time zone and calendar when an error happens, only to detect faults on the page you asked for; this is treated as strictly necessary. |
What each of these receives, and where it processes it, is set out in section 6 of the Privacy Policy. If we add a service that sets a cookie, this table is updated and section 5 applies before it runs.
9. Changes to this policy
We update this policy whenever the site's use of cookies changes, and always before the change takes effect. The version number and the date at the top identify the current text.
10. Contact
Questions about this policy, or about a cookie you believe this site has set: privacy@xeplans.com, subject PRIVACY. You may also complain to your supervisory authority, as section 19 of the Privacy Policy explains.