Cookie Policy

We use cookies and similar technologies (local storage, IndexedDB) to operate the Service, remember your preferences, and measure aggregated usage in a privacy-friendly way. We do not use advertising cookies, retargeting, or third-party advertising networks.

1. Categories

Strictly necessary - always on

Authentication session (Clerk), tenant context, CSRF protection, Stripe checkout. Without these, the Service cannot function.

Functional - opt-in

Theme preference, language preference, sidebar layout state.

Analytics - opt-in

Privacy-friendly analytics (Plausible - server-side hashed, no cross-site tracking). No third-party advertising IDs, no fingerprinting.

Advertising - none

We do not use advertising cookies. We do not allow third-party ad networks to set cookies through our pages.

2. Consent banner

On first visit, a banner offers Accept all, Reject all (one click), or Customise. Reject is as easy as Accept; no pre-ticked boxes; continued browsing is not consent. Re-display every 6 months or on policy change. The panel is reachable at any time from the footer link Cookie preferences.

3. Withdrawal

Withdraw consent at any time from the footer panel; existing cookies set under prior consent are removed within 24 hours. Browser-level blocking is also respected.

4. Global Privacy Control (GPC)

We honour the Sec-GPC: 1 header. When sent, we treat it as a withdrawal of consent for Functional and Analytics cookies.

5. Third-party embeds

When Stripe Checkout, embedded Calendly, or YouTube (privacy-enhanced mode) are used, those third parties may set their own cookies under their own policies. We embed in privacy-enhanced mode wherever supported.

6. Updates

Material changes (a new analytics provider, a new tracker category) trigger a re-display of the consent banner.

The full canonical text is available at docs/legal/templates/cookie-policy.md. This summary is a starting-point template that requires review by qualified French/EU legal counsel before customer-facing reliance.