Cookie Policy

1. Cookies and local storage

A cookie is a small file that the site places in your browser and that the browser sends back with each request. Local storage is a space in the browser that the site can read and write, but which is never sent to the server automatically. MAYA uses both, solely to operate the service.

2. The cookies set by MAYA

Thirteen cookies, all strictly necessary. None of them is used to track you across sites.

• maya-auth — session token of a signed-in user. Inaccessible to scripts (httpOnly), sent only over HTTPS, lifetime two hours. Without it, no dashboard page is displayed.
• maya-refresh-token — renews the session without re-entering the password. Inaccessible to scripts (httpOnly), sent only over HTTPS, lifetime seven days.
• maya-locale — language of the back office (French or English). Readable by scripts, lifetime one year. The value is only fr or en.
• NEXT_LOCALE — the language chosen for the interface (French or English), so that it is restored on the next visit. Lifetime one year. This cookie contains no personal data.
• maya-maison — identifier of the open workspace, so that offline reading does not mix two workspaces. Readable by scripts: it is not a secret and it grants no access. Sent only over HTTPS, lifetime seven days, removed on sign-out.
• maya-google-oauth — Google sign-in in progress: protects the round trip to Google (anti-replay values). Not accessible to scripts (httpOnly), sent over HTTPS only, lifetime ten minutes, deleted on return.
• maya_choix_pages — Meta page selection in progress: opaque identifier of the session used to choose the Facebook pages and Instagram accounts to link to an entity. This cookie contains no Meta token. Not accessible to scripts (httpOnly), sent over HTTPS only, lifetime fifteen minutes, deleted after the selection is confirmed.
• maya-microsoft-oauth — Microsoft sign-in in progress: same role, same lifetime, same deletion on return.
• maya-gmail-oauth — Gmail mailbox connection in progress: carries the state and the PKCE verifier, ten minutes, deleted on return from Google.
• maya-teams-oauth — Teams messaging sign-in in progress: protects the round trip to Microsoft (anti-replay values, PKCE verifier). Not readable by scripts (httpOnly), sent over HTTPS only, lifetime ten minutes, erased on return.
• maya-slack-oauth — Slack messaging sign-in in progress: protects the OAuth round trip (state and PKCE). Not readable by scripts (httpOnly), sent over HTTPS only, lifetime ten minutes, erased on return.
• maya-saml-demande — sign-in through your organisation's directory in progress: keeps the request identifier, so that only the response to THIS request is accepted. Not accessible to scripts (httpOnly), sent over HTTPS only, ten-minute lifetime, deleted on return.
• maya-identite-externe — identity confirmed by Google, Microsoft or your organisation's directory, while the sign-in completes (second factor, workspace choice). Not accessible to scripts (httpOnly), sent over HTTPS only, lifetime ten minutes, deleted when the session opens.
• maya_visiteur — random number that identifies the browser on a published site, before any script, so the same version of a tested block is shown. Not accessible to scripts (httpOnly), lifetime one year. No personal data.
• maya-interface — interface chosen for the dashboard ("ruche" or "classique"). Readable by scripts, one-year lifetime. The value is limited to ruche or classique; no personal data.
• maya-att — attention colour chosen for the hive interface (cyan, coral, emerald, glow or gold). Readable by scripts, one-year lifetime; no personal data.
• maya-inscription-google — Google identity confirmed while a trial signup is finished (house name, country). Not accessible to scripts (httpOnly), sent over HTTPS only, lifetime ten minutes, deleted when the house is created. It is not a session.

3. Browser local storage

For a signed-in user, MAYA keeps in the local storage of their browser, on their device only:

• display preferences: light or dark theme, country selected in configuration screens, last opened view;
• elements of their session (token and profile), which let the interface display without querying the server again on every page. They are cleared at sign-out.

4. Audience measurement

The site maya-erp.com embeds no audience measurement tool, whether from TW MICRONICS SARL or from a third party.

The websites that client organizations publish with MAYA (on their own domain or under maya-erp.com/site/…) count their visits using a random visitor identifier kept in the browser's local storage and sent to MAYA only. This measurement is specific to each organization, is not shared with any third party and does not link visits from one site to another. It falls under the privacy policy of the organization publishing the site.

When a visitor reaches one of these sites through a campaign link (utm_* parameters or an ad network click identifier), the site keeps that origin in a cookie of its own (maya_attribution, 90 days), so that a form sent later can be linked to that campaign. This cookie only holds what the address carried, is read only by MAYA on behalf of the organization, and is never shared.

These same sites set a technical cookie named maya_visiteur (a random number, one year) that identifies the browser before any script runs: it serves the same version of an A/B-tested block on every visit, from the first page. It holds no personal data and is read only by MAYA on behalf of the organisation.

5. Managing cookies

Since MAYA's cookies are strictly necessary, no consent banner is required. You can delete them at any time from your browser settings; you will then be signed out and the default language restored. For any question: [email protected]. The full privacy policy is at https://maya-erp.com/en/privacy.