1. About this policy
This policy explains how Sabasi uses cookies and similar technologies, why we use them, and how you can control them. It supplements, and should be read with, the Sabasi Privacy Policy.
Cookies are small text files placed on your device when you visit a website. Similar technologies include local storage and session storage, which store or read information in your browser in a comparable way.
Sabasi relies mainly on these browser-storage technologies rather than on a large number of cookies. In this policy, we refer to them collectively as "cookies" where appropriate.
2. How we approach cookies
We use only what is reasonably necessary to operate Sabasi securely and provide the features you use.
We do not use advertising cookies, cookies for cross-site behavioural advertising, or sell information collected through cookies.
We do not currently use browser analytics or performance-tracking cookies.
Where applicable law requires consent for a non-essential technology, we use that technology only after the required consent has been obtained. You may change or withdraw your choice at any time.
3. Categories we use
Strictly necessary
These technologies are required for the Platform to operate and remain secure.
They support functions including:
- keeping you signed in;
- authenticating requests;
- maintaining Platform security; and
- protecting sign-in, registration and other relevant flows against automated abuse.
Because these technologies are necessary for the service to operate, they generally cannot be disabled through Sabasi. You may be able to block them through your browser, but parts of the Platform may then stop functioning correctly.
Functional
These technologies remember choices and maintain product state so Sabasi features work as expected.
They may include:
- interface and product preferences;
- unsent survey drafts;
- survey-creation drafts;
- dashboard state;
- onboarding progress;
- help and announcement preferences;
- the current Ask AI conversation; and
- live-chat functionality.
Some functional technologies may require consent under applicable law.
Analytics and performance
Sabasi does not currently use browser analytics or performance-tracking cookies.
OI may introduce error or performance-monitoring technology in the future. Before enabling any technology that requires consent, we will update this policy and implement the required consent controls.
We do not use advertising or cross-site behavioural tracking cookies.
4. Cookies and storage set by service providers
Some technologies are provided by third parties that help us operate Sabasi.
Cloudflare Turnstile
Sabasi uses Cloudflare Turnstile on:
- sign-in;
- registration;
- one-time-password resend; and
- survey submission.
Turnstile helps distinguish legitimate use from automated abuse.
Cloudflare controls any cookies, storage or other technologies used by Turnstile. Sabasi does not define those third-party cookie names.
Turnstile is used as an anti-automation and abuse-protection mechanism.
Live chat
Sabasi uses Tawk.to to provide live-chat support.
Tawk.to may use cookies or browser storage to operate the chat service, recognise a returning visitor or preserve conversation context.
The names, storage methods and durations of these technologies are controlled by Tawk.to.
Where applicable law requires consent before optional live-chat technologies are activated, Sabasi will apply the appropriate consent mechanism.
Information about service providers that process personal data on OI's behalf is available in the Sabasi Subprocessor List.
5. Sabasi mobile application
The Sabasi mobile application does not use browser cookies and does not render web pages through WebViews.
Instead, the mobile application uses native local application storage where necessary to:
- maintain authentication and session state;
- store downloaded surveys for offline use;
- store draft responses;
- hold completed responses awaiting synchronisation; and
- support other offline and application functionality.
These technologies serve essential or functional purposes but are not browser cookies.
Further information about personal data processed through the mobile application is available in the Sabasi Privacy Policy.
6. Legal basis and your choices
Strictly necessary technologies are used where they are required to provide, secure and operate Sabasi.
Non-essential technologies are used with consent where applicable law requires it.
Where consent applies, you may give, withdraw or change your choice using the cookie preferences controls made available through Sabasi.
Withdrawing consent does not affect processing that lawfully occurred before withdrawal and does not disable strictly necessary technologies.
You can also manage cookies and browser storage through your browser settings. Most browsers allow you to:
- block cookies;
- delete cookies;
- clear local storage; and
- clear session storage.
Blocking strictly necessary technologies may prevent parts of Sabasi from working.
Clearing local storage may remove locally stored drafts, preferences and other product state that has not been synchronised or otherwise stored on Sabasi servers.
7. What Sabasi currently uses
The following reflects the technologies currently confirmed in the Sabasi application.
| Name / technology | Type | Purpose | Set by | Storage and duration |
|---|---|---|---|---|
sabasi_token | Strictly necessary | Keeps Users signed in and supports authenticated access. Configured as HttpOnly, SameSite=Lax, Secure in production, Path=/ | Sabasi | Persistent first-party cookie. Max-Age: 7 days |
| Cloudflare Turnstile | Strictly necessary | Anti-automation and abuse protection on sign-in, registration, OTP resend and survey submission | Cloudflare, embedded by Sabasi | Cloudflare-controlled. Turnstile response token is transmitted with the relevant request |
| Cloudflare edge security technologies, if enabled | Strictly necessary | May provide network-edge security, bot management or challenge handling in production | Cloudflare | Not yet confirmed. Controlled by Cloudflare if enabled |
sabasi_preferences | Functional | Stores interface and product preferences | Sabasi, localStorage | Persistent until cleared or removed by the application |
sabasi-survey-drafts | Functional | Stores survey draft state locally | Sabasi, localStorage | Persistent until cleared or removed by the application |
sabasi-survey-creator-drafts | Functional | Stores survey-creation draft state locally | Sabasi, localStorage | Persistent until cleared or removed by the application |
sabasi-dashboard-store | Functional | Stores dashboard product state | Sabasi, localStorage | Persistent until cleared or removed by the application |
sabasi-help-seen, onboarding and announcement state | Functional | Remembers help, onboarding and announcement status | Sabasi, localStorage | Persistent until cleared or removed by the application |
sabasi-ai-chat:<userId> | Functional | Stores the current Ask AI conversation for the active browser session | Sabasi, sessionStorage | Session-scoped and cleared when the applicable browser tab or session ends |
| Tawk.to live-chat technologies | Functional | Operate the live-chat service and may preserve conversation context | Tawk.to | Controlled by Tawk.to |
Sabasi does not currently set a separate CSRF or XSRF cookie.
Cloudflare Turnstile is used as an anti-automation and abuse-protection control on the flows identified above.
The sabasi_token authentication cookie persists for up to seven days and does not automatically disappear when the browser is closed.
Browser sessionStorage, including the current Ask AI conversation, is session-scoped.
Browser localStorage generally remains until it is cleared by the User, browser or application.
No browser analytics or performance-tracking technology is currently active.
8. Changes to this policy
We may update this policy to reflect changes to Sabasi, our service providers, technologies or applicable law.
The current version and effective date will be published with the policy.
Where a change materially affects the use of non-essential technologies, we will seek fresh consent where required by applicable law.
9. Contact and complaints
For questions about this policy or your cookie choices, contact:
Open Institute
9 Riverside Building
P.O. Box 50474-00100
Nairobi, Kenya
Email: hello@openinstitute.africa
If you believe your personal data has been handled unlawfully, you may lodge a complaint with the Office of the Data Protection Commissioner of Kenya.
Where another applicable data protection law applies, including the GDPR, you may also have the right to complain to the competent supervisory authority in your jurisdiction.