Legal
Cookie policy
Full disclosure of every cookie and browser storage item NDPA Compass uses. Last updated 27 September 2026.
Summary
NDPA Compass uses one cookie, and only when you sign in. It is essential for signing in. We do not use analytics, advertising, social media or any third-party cookies, we do not track you across websites, and no third-party scripts are loaded on the site.
At the start of every browser session we ask whether you accept the essential cookie. If you decline, you can still browse the site, use Ask the Act and read about your rights, but you cannot sign in.
Everything we store in your browser
| Name | Type | Purpose | What it contains | Duration | Set by |
|---|---|---|---|---|---|
| ndpa_session | Cookie, strictly necessary. HttpOnly (not readable by page scripts), Secure (HTTPS only), SameSite=Lax | Keeps you signed in and enforces automatic sign-out after 10 minutes of inactivity | A digitally signed token holding: your account ID, a session version number (used to end sessions after a password reset), whether you are a platform administrator, your organisation role, whether you must change your password, and the times it was issued and expires. It does not hold your name, email, organisation data or browsing history. | 10 minutes, renewed while you are active, 12 hours at most. Deleted when you sign out. | NDPA Compass (first party) |
| ndpa:cookie-choice | Browser session storage (not a cookie, never sent to our servers) | Remembers your answer to the cookie notice for this session | The word "accepted" or "declined" | Until you close the tab or window | NDPA Compass (first party) |
| ndpa:ask | Browser session storage (not a cookie) | Carries your chat to the full analysis page when you choose "Open full analysis" | The text of your chat messages | Deleted as soon as the analysis page reads it | NDPA Compass (first party) |
| ndpa:req | Browser session storage (not a cookie) | Only if you open the private link to your workspace request: keeps the link working if you refresh the page | The private access code from that link | Until you close the tab or window | NDPA Compass (first party) |
| ndpa-theme | Browser local storage (not a cookie, never sent to our servers) | Remembers whether you chose the light or dark appearance | The word "light" or "dark". Only set when you use the theme switch | Until you clear it or switch back | NDPA Compass (first party) |
| ndpa_last_activity | Browser local storage (not a cookie, never sent to our servers) | Signed-in users only: shares your last activity time between open tabs so the 10 minute inactivity sign-out is applied consistently | A time stamp | Overwritten while you are signed in | NDPA Compass (first party) |
What we collect during your session
- Not signed in: nothing is stored about you. Ask the Act enquiries are not stored anywhere.
- Signed in: the security events described in the privacy notice (sign-in, sign-out, failed attempts and account changes, with IP address and time), kept for 12 months.
- Records you create in your organisation's workspace belong to your organisation.
You can also delete cookies at any time in your browser settings. Deleting ndpa_session signs you out.