This Cookie Policy was last updated in June 2026 and applies to visitors from the European Economic Area, the United Kingdom, and Switzerland.
1. About this policy
This policy explains the cookies and similar technologies used by the XLS Padlock website, https://www.xlspadlock.com, what each one does, how long it stays, and how you can control or remove it. For how we handle personal data more broadly, see our Privacy and Data Protection Policy.
2. What are cookies and similar technologies?
A cookie is a small text file that a website stores in your browser. We also use two related technologies:
- Local storage: data your browser keeps on your device. It is similar to a cookie but is not sent automatically with every request.
- Web beacons: a small network request used to count a page view or a download click, with nothing stored on your device.
3. Cookies and storage we set
We keep this to the minimum needed to run the site, remember your choices, and credit affiliate partners. Several items below are set only when you take a specific action, such as signing in, following an affiliate link, or dismissing the language banner. All cookies we set are first party and use SameSite=Lax.
Cookies
| Name | Purpose | Category | Retention |
|---|---|---|---|
| Account session cookie | Keeps you signed in and refreshes your session securely. Set by our account backend on www.xlspadlock.com when you sign in, removed when you sign out. | Strictly necessary | Session |
xls_locale_pref | Remembers your language choice, or that you dismissed the language suggestion banner. | Functional | 180 days |
xls_aff | Attributes a visit or order to an affiliate partner. | Affiliate attribution | 30 days |
xls_visit | Tracks a visit that came from an affiliate link or attribution campaign. | Affiliate attribution | 30 days |
The strictly necessary and functional cookies above do not require consent. Under EU rules, the two affiliate attribution cookies (xls_aff and xls_visit) are marketing cookies that require your consent: they are set only if you accept marketing cookies in our cookie banner and then arrive through an affiliate link (a URL containing aff=). If you refuse, they are never set, the site works normally, and you can review your choice at any time (see section 6).
Local storage
| Key | Purpose | Retention |
|---|---|---|
starlight-theme | Remembers whether you chose the light or dark theme. | Until you clear it |
xp_access_token | Holds your account access token so you stay signed in as you move between pages. Cleared when you sign out or when it expires. | Until sign-out or expiry |
4. Analytics (no cookies)
We measure how the site is used with our own self-hosted Matomo analytics (nova.gdgsoft.com). It records the page address, the page you came from, and clicks on download links. It is configured without cookies and without local storage, anonymizes IP addresses, sends no credentials, and does not build a cross-site profile of you. Because it is cookieless, first-party, and IP-anonymized, it runs regardless of your cookie choice.
We also use Ahrefs Web Analytics (analytics.ahrefs.com) to correlate site traffic with our search-engine data. It is cookieless too, but it is a third-party provider, so it loads only after you accept analytics cookies and never before. See the Ahrefs Privacy Policy.
5. Third-party services
Some features rely on outside providers. These set cookies only when you use the feature concerned, and under their own privacy terms.
| Service | Used for | What it may set |
|---|---|---|
| Cloudflare Turnstile | Anti-spam check on the contact and newsletter forms. | A temporary Cloudflare cookie to tell human visitors from automated ones. See the Cloudflare Privacy Policy. |
| Paddle | Our payment provider (Merchant of Record). Its secure overlay opens on the checkout page. | Cookies set by Paddle to process and secure your payment. See the Paddle Privacy Policy. |
| FastSpring | Alternative reseller. The “Buy with FastSpring” button sends you to FastSpring’s own store. | Cookies are set on FastSpring’s site, not ours. See the FastSpring Privacy Policy. |
| YouTube (privacy-enhanced) | Embedded video tutorials, loaded through youtube-nocookie.com. | No cookie until you start a video. If you play one, YouTube may set cookies. See the Google Privacy Policy. |
Our web fonts are served from our own server, so no font provider receives your IP address.
6. Managing and removing cookies
When you first visit, a cookie banner lets you accept or refuse analytics and marketing cookies and stores your choice. Ahrefs Web Analytics loads only if you accept analytics cookies, and the affiliate attribution cookies are set only if you accept marketing cookies; the strictly necessary cookies, the functional cookie, and our cookieless first-party Matomo analytics are not affected by that choice. To review your decision, clear this site’s storage in your browser and the banner appears again.
You can also control cookies directly in your browser:
- Delete existing cookies and local storage for this site at any time.
- Block or limit cookies, or ask to be warned before one is set.
The strictly necessary account cookie is required for the signed-in account area to work, so if you block it you will not be able to stay signed in. The functional items (theme and language) only add convenience, and the site still works without them.
7. Your data protection rights
Cookies and storage can involve personal data. Your rights, including access, rectification, erasure, objection, portability, and withdrawing consent, are described in our Privacy and Data Protection Policy.
8. Changes to this policy
We may update this policy when the cookies or services used by the site change. The date at the top shows the latest revision, so please check this page from time to time.
9. Contact
For questions about this Cookie Policy, contact G.D.G. Software:
G.D.G. Software SAS
Moselle, France
Website: https://www.xlspadlock.com
Email: [email protected]