Legal · Document
Cookie Policy
Effective: 2026-07-27. This Cookie Policy describes the cookies and similar storage technologies that Galan ERP, LLC (“Galan”) uses on galan.com and any subdomain thereof,and the choices you have about them.
1. What Is a Cookie?
Cookies are small text files set by your browser at our request. They are used to maintain session state, remember preferences, and provide basic site functionality. Some cookies are strictly necessary; others (including analytics and advertising cookies) require your consent under the ePrivacy Directive (EU) and equivalent US state laws, including CCPA, CPRA, Colorado CPA, Connecticut CTDPA, Virginia VCDPA, and others.
2. Cookies We Use
The table below lists every cookie set by galan.com and its subdomains. Strictly-necessary cookies cannot be disabled because the site cannot operate without them; preference and analytics cookies are subject to your consent via the cookie banner shown on first visit.
| Cookie | Purpose | Type | Duration |
|---|---|---|---|
| galan_session | Encrypted session token (iron-session, HttpOnly). Maintains your authenticated session across requests. | Strictly necessary | Session |
| gpc_signal | Records whether your browser sends the W3C Global Privacy Control (Sec-GPC: 1) signal. Honored under CCPA §1798.135. | Preference | 1 year |
| cookie_consent | Records your cookie-banner choice (accept all or essential only). | Preference | 1 year |
| sidebar_state | Records whether the in-app navigation sidebar is open or collapsed. | Strictly necessary | 7 days |
We do not use third-party advertising cookies, the Meta Pixel, Google Analytics advertising features, or any cross-context behavioural tracking cookie. We do not sell or share any personal information collected via cookies or otherwise. Our complete subprocesser list is at /subprocessors.
3. Global Privacy Control (GPC)
Galan honours the W3C Global Privacy Control signal (Sec-GPC: 1). CCPA §1798.135(b) treats a GPC-enabled browser request as a valid opt-out. When we detect the signal we:
- Suppress non-essential cookies by default (the banner does not appear with marketing prompts).
- Record the GPC signal in your privacy request audit trail when you submit a privacy request.
- Treat your browser signal as a Do-Not-Sell-or-Share request for as long as it remains set.
4. Your Choices
- Accept or decline non-essential cookies via the consent banner shown on your first visit.
- Do Not Sell or Share. File a verifiable consumer-rights opt-out via Do Not Sell or Share (redirects to the privacy intake).
- Browser controls. Clear or block cookies in your browser settings at any time.
- Targeted advertising. Since we do not engage in targeted advertising, no separate opt-out is required.
5. Changes to This Cookie Policy
We will update this Cookie Policy when our cookie usage changes, when new cookies are added, or when applicable law changes. Material changes will be highlighted by an updated effective date at the top.
6. Contact Us
For questions about this Cookie Policy, contact privacy@galan.com. For our full privacy practices, see our Privacy Policy.
7. Tenant-Specific Cookies
If you are visiting a Galan customer’s branded subdomain (e.g. acme.galan.com), note that the customer may have additional cookies set by their own customer-facing integrations (paid-feature timestamping, customer preference overrides). Those cookies are governed by the customer’s own cookie disclosures, not this policy. Reach the customer’s privacy contact via the privacy intake form on their subdomain.