Cookie and Storage Policy
Last updated: 1 November 2026
Klyvelo uses no advertising cookies and no tracking pixels. On klyvelo.com only, and only if you say yes, we use Google Analytics to count visits. What we do keep in your browser or on your device is listed here, every item, with what it is for and how long it lasts.
The short version
- Visits counted only if you say yes. On klyvelo.com only, and only if you say yes, we use Google Analytics to count visits (ads off, IP not stored by Google Analytics 4). Google's tag loads on every page, but until you say yes it sets no cookies and sends Google only a basic, cookie-free signal that the page was opened (Google's consent mode). Never in the app, the counter or the console. We don't sell data or show ads. We use no Meta pixels, ad networks or other tracking tools anywhere.
- Our own cookies. One opens the website to testers before launch, one remembers which sales representative sent you, one remembers your yes or no to counting visits, and one keeps Klyvelo's own staff signed in to our console. If you say yes on klyvelo.com, Google Analytics adds two of its own.
- Browser storage. The account pages and the point of sale keep a few things in your browser so you stay signed in, your choices are remembered, and the point of sale keeps selling when the internet drops.
- You stay in control. "Cookie settings" at the bottom of every page on klyvelo.com changes your answer at any time. You can clear all of it in your browser's settings. Signing out removes your sign-in.
1. Cookies and storage, in plain words
A cookie is a small text file a website asks your browser to keep, and to send back on later visits. Browser storage works in a similar way but stays in your browser and is never sent to us by itself: local storage lasts until it is removed, session storage ends when you close the tab, and the origin private file system (OPFS) and IndexedDB hold larger data, such as the point of sale's database. On phones and tablets the Klyvelo app uses the device's secure store (the iPhone keychain or Android keystore) and the app's own files.
"Essential" below means the service cannot do what you asked without it. "Preference" means it only remembers a choice, and the service works without it.
2. The rules we follow
South Africa has no separate cookie law. The Protection of Personal Information Act (POPIA) applies when a cookie or storage item holds or links to personal information: it must be for a clear purpose, no more than needed, and explained to you. Using cookies to market to you is direct marketing, which needs your consent (section 69 and the Information Regulator's guidance on direct marketing). We use no cookies for marketing. Counting visits to klyvelo.com with Google Analytics is optional: our website asks you first, it stays off until you say yes, and it stays off if your browser asks sites not to track you (Do Not Track or Global Privacy Control). Everything else runs the service or remembers your choices.
4. Storage on our website and account pages
Our account pages (sign-up, sign-in, the dashboard and back office) keep these items in your browser:
| Name | Where kept | What for | How long | Type |
|---|---|---|---|---|
klyvelo.session | Local storage | Your sign-in: the access and refresh tokens that keep you signed in, and your e-mail address. Our main website also checks whether it is there, to show "Dashboard" instead of "Sign in". | Until you sign out (the tokens renew while you use Klyvelo) | Essential |
klyvelo.ref | Local storage | The sales representative's code, with the date you arrived (see klyvelo_ref above). | 30 days, then ignored and replaced | Preference (functional) |
klyvelo.plan | Session storage | The plan you chose on the pricing page, carried into sign-up. | Until you close the tab, or sign-up finishes | Essential |
klyvelo.pending | Session storage | What you typed on the sign-up form (your name and surname, e-mail, mobile number, business name and kind, the plan and any representative's code; never your password), so set-up can carry on after you click the link in our e-mail. | Until your business is created, or you close the tab | Essential |
klyvelo.docs.approved-seen | Local storage | Remembers that you have seen "your documents are approved", so it shows once. | Until cleared | Preference |
klyvelo.bo.location | Local storage | The store you last chose in the back office. | Until cleared | Preference |
klyvelo.bo.stock.group | Local storage | How you like the stock list grouped. | Until cleared | Preference |
kv-theme | Local storage | Light or dark, if you chose one in the dashboard (Auto keeps nothing and follows your device). | Until cleared, or you choose Auto | Preference |
klyvelo.demo, klyvelo.demo.state, klyvelo.bo.demo.*, klyvelo.bo.demo.settings | Session storage | Only in the demo (a link with ?demo=1): the made-up shop and the changes you try out. Nothing is sent to us. | Until you close the tab | Essential (for the demo) |
Our main website (the marketing pages) keeps only klyvelo.ref, klyvelo_consent and the cookies above, and reads klyvelo.session as described. Our account pages, the point of sale and the console never load Google Analytics.
5. Storage in the point of sale
The point of sale is built to keep selling when the internet drops. To do that, the device keeps its own copy of the shop's data and syncs it with our database when it can. That copy is the shop's information, which we process for the shop (see our Data Processing Terms).
| Name | Where kept | What for | How long | Type |
|---|---|---|---|---|
| The point of sale database | OPFS in a browser; the app's files on a phone or tablet | The shop's products, stock, sales, members, staff and settings, so the device sells offline. Members' ID numbers are kept only as a one-way code or encrypted. | Until the device is unlinked from the business, or the browser's data is cleared | Essential |
klyvelo-device | IndexedDB in a browser; the secure store on a phone or tablet | The device's link to the business (its activation secret), so it stays linked after a restart. | Until the device is unlinked | Essential |
pos.pairing | Local storage in a browser; the secure store on a phone or tablet | Which point of sale server this device is paired with. | Until unpaired | Essential |
pos.staffToken | Local storage in a browser; the secure store on a phone or tablet | The signed-in staff member's session after their PIN. Never the PIN itself. | Until that person signs out, or the session ends | Essential |
klyvelo.setupSession, klyvelo.pendingSignup | Local storage in a browser; the secure store on a phone or tablet | The owner's sign-in and sign-up details (name, e-mail, business name and kind, never the password) while the business is being set up in the app. | Until set-up is finished | Essential |
pos.deviceName | Local storage; the secure store on a phone or tablet | The name given to this device, such as "Front counter". | Until cleared | Essential |
klyvelo.waiter.queue | Local storage; the app's files on a phone or tablet | Orders a waiter has taken that are waiting to be sent, so none are lost when the connection drops. | Until sent | Essential |
pos.prefs, pos.orderType, klyvelo.backoffice.prefs, klyvelo.products.lastCategory, klyvelo.kitchen.screen, klyvelo.kitchen.stations, klyvelo.setup.essentials.seen, klyvelo.upgrade-moment | Local storage; the app's files on a phone or tablet | Choices made on this device: light or dark, which side the cart sits on, the last order type and product category, which kitchen stations this screen shows, report settings, and which set-up tips and plan messages were already shown. | Until cleared | Preference |
On phones and tablets the app also keeps the latest app update it downloaded (through Expo), so it opens quickly and works offline.
6. Storage in Klyvelo's staff console
Only Klyvelo's own staff use the console. It keeps kv-console-theme (light or dark), kv-console-hide-numbers (whether figures are hidden on screen) and kv-console-recent (the last six businesses opened: their id, name and short name) in local storage, until cleared. Its demo uses klyvelo.demo.console in session storage.
7. Other companies' cookies
- Google Analytics. On klyvelo.com only, and only if you say yes, Google Analytics 4 counts visits for us. Google receives your IP address to make the connection but Google Analytics 4 does not store it; ads, ad personalisation and Google signals are off. Google acts under Google's privacy policy. You can also use Google's opt-out add-on.
- Paystack. When you pay, you do it on Paystack's own page, which may set its own cookies under Paystack's privacy and cookie policy.
- Google Fonts. Our account pages load fonts from Google, which receives your IP address. Google says its font service sets no cookies.
- Cloudflare Turnstile, when switched on for sign-up, checks technical signals from your browser to tell people from bots.
- Xero and Yoco. When an owner connects them, the sign-in happens on Xero's or Yoco's own pages, under their policies.
8. How to remove them
- Cookie settings at the bottom of every page on klyvelo.com lets you change your yes or no to counting visits.
- Sign out to remove your sign-in from the browser.
- Clear site data in your browser's settings (for example in Chrome: Settings, Privacy and security, Third-party cookies and site data; in Safari: Settings, Advanced, Website Data) to remove everything on this list.
- On a point of sale, clearing its data also removes any sales not yet synced. Check that the device shows it is up to date first, or ask us.
- Blocking essential items stops the service from working: for example, you will not stay signed in.
9. Changes and questions
When we add or change an item, we update this page and the date at the top. Questions: write to our help address. Our Privacy Policy explains everything else about how we handle personal information.