Legal

Cookie policy

Last updated 27 October 2026.

1. The short version

PrePro Selects sets three cookies to keep someone signed in, a short-lived one while a single sign-on is under way, and one to remember the language you picked. It also keeps a handful of entries in your browser's storage to keep you signed in and to remember your choices and unfinished work. None of them tracks you, none of them is shared with anyone, and the sign-in cookies never exist on the public pages of this website — a visitor who reads the pricing page receives no cookie at all unless they pick a language.

Article 5(3) of the ePrivacy Directive and regulation 6 of the UK Privacy and Electronic Communications Regulations (PECR) exempt storage that is strictly necessary to provide a service the user has explicitly asked for. That is why this site shows no consent banner: there is nothing to consent to. Exempt cookies should still be described somewhere, and this page is that description.

2. Cookies we set

Cookies set by PrePro Selects
Name	Set when	What it does	Lifetime
`sl_staff`	You sign in to the admin app	Keeps your staff session alive. It holds a refresh token that renews the short-lived access token the app works with	30 days, or until you sign out or revoke the session from the app
`sl_guest`	You sign in to a client gallery with the details a production company gave you	Keeps your gallery session	14 days, or until the login is revoked or you sign out
`sl_preview`	A staff member opens "Preview as client"	Lets the preview load images the way a read-only client would	2 hours
`pps_lang`	You pick a language with the language switch, or open a link with `?lang=`	Remembers the language you chose, so the site and our emails to you use it	12 months, or until you pick again
`sl_sso_state`	You sign in with your organisation's single sign-on	Ties the sign-in to the browser that started it, so a sign-in link cannot be used from anywhere else. Sent only to the sign-in address, never to other pages	10 minutes, or until the sign-in finishes

The sign-in cookies are first-party, strictly necessary, HttpOnly (JavaScript cannot read them) and SameSite=Lax (they are not sent when another site loads our resources). pps_lang is a first-party preference cookie, also SameSite=Lax; the page's own script reads it to show the language you chose, and it holds only en or es. Each is set on the host you are using — preproselects.com or a customer's own gallery domain — and never shared between them.

3. Browser storage

Local storage is data your browser keeps for one site only. Ours is never read by another site and is only ever sent to PrePro Selects, with the request it belongs to. Most entries only remember a choice or unfinished work on your own device; none of them tracks you, so none needs consent.

Local storage entries
Key	Where	What it holds	Kept
`sl.token`	Admin app	The one-hour access token that authenticates your requests after you sign in	Until you sign out; replaced each time it is renewed
`sl.g.<workspace>.<project>`	Client gallery	Your gallery session token, so a reload does not ask for the password again	Until you sign out or the login expires
`sl.name.<workspace>`	Client gallery	The first name you typed at "Who is looking?", so you are not asked twice	Until you clear the site's data
`sl.g.<workspace>.<project>.q`	Client gallery	Votes and notes made while the connection was down, waiting to be sent	Until they have been sent
`pps.lang`	Every page	The language you picked with the language switch or a `?lang=` link — the same choice as the `pps_lang` cookie	Until you pick again or clear the site's data
`pps.currency`	Home and pricing pages, plans screen in the app	The currency you chose for prices, euro or US dollars	Until you pick again or clear the site's data
`pps.intro`	Home page (session storage)	That the opening animation has already played during this visit, so it does not play again every time you come back to the home page	Until you close the tab
`sl.support.v1`	Pages with the help box, only when it is on	The reference of your help-box conversation and a token that lets this browser read the replies. The messages themselves stay on our servers	Until you start a new conversation or clear the site's data
`pps.ws`	Admin app	The web address of the workspace you last signed in to, so the sign-in screen can offer it	Until you clear the site's data
`sl.uploads.v1`	Admin app, upload links	The uploads in progress (file names, sizes and progress), so an interrupted upload can carry on	72 hours at most
`sl.staged.v1`	Admin app, upload links	The list of files waiting to upload. The files themselves are copied into your browser's private file storage for this site, so closing the tab does not lose them	Until they have uploaded, 7 days at most
`pps-apply` (IndexedDB)	Casting forms (street-casting and self-tape links)	On the phone that fills in the form: the answers as typed and the chosen photos and videos, so a send survives a lost signal or a reload	Until the files have arrived, 3 days at most
`sl-howto-lang`	How-to videos and guides	The language you chose for the guides and videos	Until you pick again or clear the site's data
`pps.preview.*`	The iPhone app preview page	The galleries you opened in the preview and their sign-in, as the app would keep them	Until you clear the site's data
`pps.mail.*`	Our own team's admin panel only	Which mailbox and signature a team member last used	Until they clear the site's data

Time in a gallery. While a client gallery is open and visible on screen, the page tells our server every few seconds that it is still open and which files were opened, using the sl_guest sign-in cookie it already has. Nothing else is stored on your device for this. It stops when the tab is hidden or closed. The production company that invited you sees the result. Our team sees it only to support them and keep the service secure.

4. What we do not use

No analytics cookies — no Google Analytics, Matomo, Plausible or anything like them. What we know about traffic comes from our own web server logs, kept 14 days.
No advertising or retargeting pixels, no tag manager, no A/B-testing snippet, no session recording, no heat maps.
No third-party fonts, scripts or content delivery networks: every file a page loads comes from preproselects.com, with one exception. When a team member chooses "Open in Google Sheets", the app loads Google's sign-in script from Google for that step, and Google's own terms and cookies apply to it.
No embedded video players from YouTube, Vimeo or anyone else.
No consent-management platform, because none is needed.

If any of that changes — if we ever add an analytics tool, for instance — this page changes first, and a consent request appears before the tool does, not after.

5. Embedded galleries

A gallery placed inside a customer's own website with our embed script sets no cookie in your browser. Its session is a token that the embedding page holds and passes with each request; images are fetched through short-lived signed links. Anything the customer's own site stores in your browser is that site's doing and is described in its own cookie notice, not this one.

6. How to remove them

Signing out deletes the session cookie and the token in local storage. Every browser also lets you delete the cookies and site data of preproselects.com from its privacy or site-data settings, and lets you block cookies for the site altogether. If you block them you will not be able to sign in to the app or to a gallery; the public pages work without any cookie.

7. Changes and contact

When this page changes we update the date at the top. Questions about it go to privacy@preproselects.com. How we handle personal data more generally is in the privacy policy.

Last updated 27 October 2026. See also the privacy policy and the legal notice.