Cookie Policy
Version 1.2 · Last updated 12 August 2026
This Cookie Policy explains how the AML Certification Centre OÜ Learning Platform uses cookies and similar technologies. It supplements the Privacy Policy.
1. Summary
On its signed-in pages, the AML Certification Centre Learning Platform sets only strictly necessary cookies — the ones required to authenticate you and protect against cross-site request forgery — and loads no analytics tag. While you browse signed out, our pages additionally use one first-party analytics tag, served from crm.amlcertification.com, which we operate ourselves. It creates a visitor identifier (§4) used only across AML Certification Centre's own sites; we rely on our legitimate interest for this (see §4 of the Privacy Policy), and §7 below explains how to remove the identifier or object.
You do not need to give consent for strictly necessary cookies under EU ePrivacy rules; they are exempt because they are essential for a service you have explicitly requested (signing in to use the Platform). The banner you see on your first visit is an information notice: it tells you about the cookies and the first-party analytics described here and links to this policy.
2. What is a cookie?
A cookie is a small text file a website stores in your browser. Cookies allow the website to remember things about you between page loads — for example, the fact that you are signed in.
The Platform also uses local-storage entries — small bits of data stored in your browser. Most of them stay on your device only and keep your preferences (light/dark mode, video-playback resume position); the analytics visitor id in §4 is the one exception — it accompanies analytics events sent to our own collector while you browse signed out.
3. Cookies we set
| Name | Purpose | Type | Lifetime |
|---|---|---|---|
| __Secure-next-auth.session-token (next-auth.session-token in development) | Holds your authentication session. HttpOnly, SameSite=Lax, Secure in production. | Strictly necessary | 30 days (rolling — refreshed at most once a day while you stay active) |
| amlcc_cookie_notice_ack | Records that you have seen this cookie notice, so the banner is not shown again. HttpOnly, SameSite=Lax, Secure in production. | Strictly necessary | 1 year |
| NEXT_LOCALE | Remembers the language you chose, so pages render in it. | Strictly necessary | 1 year |
| amlcc_native | Set only inside our iOS/Android app, so the platform can adapt its navigation to the app shell. | Strictly necessary | 1 year |
| __Host-wa_reg_challenge __Host-wa_auth_challenge | Short-lived challenge values used when you register or sign in with a passkey (WebAuthn). HttpOnly. | Strictly necessary | 5 minutes |
| __Secure-next-auth.csrf-token | Protects sign-in forms against cross-site request forgery. | Strictly necessary | Session |
| __Secure-next-auth.callback-url | Remembers where you should be redirected after sign-in. | Strictly necessary | Session |
All three are required to sign you in and keep you signed in. Disabling them will prevent you from using the Platform.
4. Local-storage entries we set
These are stored in your browser. All of them except amlcc_vid stay on your device and are never sent to our servers; amlcc_vid accompanies analytics events while you browse signed out. You can clear any of them at any time using your browser settings.
| Key | Purpose | Lifetime |
|---|---|---|
| amlcc:theme-mode | Your light/dark/system theme preference | Until you clear it |
| recording-watched:<id> | Cumulative seconds watched of a specific webinar recording — so you can resume from where you left off | Until you clear it |
| Per-video resume keys | Last-watched position in a course video — so you can resume playback | Until you clear it |
| Per-(submodule, block) scroll position | Last scroll position on long reading blocks — so you can resume reading | Until you clear it |
| amlcc_vid | First-party analytics visitor id, created by our tag while you browse signed out. Sent with analytics events to crm.amlcertification.com (which we operate) and linked to your account if you register, so your pre-registration visits and your learner record form one history. Never shared outside AML Certification Centre. | Until you clear it (see §7) |
| amlcc_sid | Per-tab analytics session id (sessionStorage) | Until the tab closes |
| amlcc_vid_linked | Marker that the visitor id above has already been linked to your account, so we do not link it again | Until you clear it |
5. Cookies from third parties
When the Platform embeds video or webinars from third-party services, those services may set their own cookies on their own domains as you interact with them. Specifically:
- Vimeo (
player.vimeo.com) — used for course-video and recording playback. We request playback in "Do Not Track" mode (dnt=1) so Vimeo limits the cookies it sets. Even so, Vimeo may set technical playback cookies. See Vimeo's cookie statement. - Zoom (
zoom.us) — used when you join a live AML Certification Centre webinar via the link in your registration confirmation. Zoom sets its own cookies on its own domain. See Zoom's cookie statement.
These third-party cookies are set on third-party domains, not on learn.amlcertification.com. We have no technical ability to read or set them. They are subject to the privacy and cookie policies of the relevant third party.
Separately, our own analytics collector at crm.amlcertification.com — operated by AML Certification Centre OÜ, so first-party in substance even though it is a different subdomain — sets one cookie on its own host only when your browser sends it analytics events. That cookie is never attached to requests to learn.amlcertification.com and cannot interact with your sign-in session.
6. What we do not set
For clarity:
- No Google Analytics, Google Tag Manager, Plausible, PostHog, Mixpanel, Amplitude, Segment, Hotjar, FullStory, Heap, LogRocket, Datadog RUM or any other analytics tool of our own.
- No advertising cookies, retargeting pixels or any marketing tracker.
- No social-media share pixels (Facebook Pixel, LinkedIn Insight Tag, Twitter Pixel, etc.).
- No third-party cross-site tracking of any kind. Our own first-party visitor id links your visits across AML Certification Centre's own sites only and is never shared with or readable by anyone else.
The first-party analytics visitor id is the only non-essential storage we create, it never feeds any of the tools listed above, and §7 explains how to remove it or object. If we ever adopt any third-party tracker of the kinds listed, we will update this policy and ask for your consent before it is set.
7. How to control cookies
You can:
- Clear or block cookies in your browser settings. Every modern browser lets you see what cookies a site has set, delete them, and block future cookies. Note that blocking the cookies in §3 will prevent you from signing in.
- Use private/incognito mode to ensure no cookies persist past your browser session.
- Withdraw a saved "I've seen the cookie banner" acknowledgement by deleting the
amlcc_cookie_notice_ackcookie in your browser's settings — the banner will reappear on your next visit. - Remove the analytics identifier by clearing the
amlcc_videntry from your browser's storage settings — a new one is only created the next time you browse our pages while signed out. Blocking storage for our sites in your browser prevents it entirely. - Object to the first-party analytics under GDPR Art. 21 by writing to [email protected] — see §8.4 of the Privacy Policy.
8. Changes to this policy
If we change the set of cookies we use, we will update this policy, refresh the last-updated date, and show a fresh banner asking you to re-acknowledge. We will also notify you by email if the change introduces any non-essential cookie, so you can give or refuse consent before it is set.
9. Contact
Questions about cookies: [email protected].