Cookie and local-storage policy

01 Purpose, scope and definitions

This Policy explains which technologies CORD uses to store or access information on the device of anyone who visits cordhq.app and its subdomains, uses the app, or opens a link a business shares through CORD, what it uses them for, and how that person can choose. “Flouvia”, “Customer”, “CORD” and other defined terms have the meaning given to them in the CORD Terms and Conditions. The controller and people’s rights are described in the Privacy Notice.

In this Policy, “cookie” includes HTTP cookies, localStorage, sessionStorage, scripts, tags, and any technology that stores or accesses information on the device; a cookieless tool is not automatically outside applicable rules.

CORD uses two categories: technologies necessary for authentication, security, preferences, and the flows a person requests, and optional analytics. Analytics depends on a single choice in the cookie notice: “Accept all” enables PostHog (product usage), Vercel Web Analytics (visits), and Vercel Speed Insights (page performance); “Necessary only” loads none of the three. It is a single choice because consent is requested by purpose, and all three serve the same one: measuring the use and performance of CORD. None is treated as exempt for being cookieless: all three run code in the browser and read device data such as the browser, operating system, device type, or load metrics.

CORD does not use behavioral advertising technologies or share browsing data with advertising networks.

02 Necessary and preference technologies

Session and sign-in challenge cookies are HttpOnly, carry the SameSite attribute suited to each flow and, in production, the Secure attribute; they expire within the periods in the table. Language, country, consent, and test-mode preferences are readable by the browser. These technologies are always on and cannot be turned off from the cookie notice. Flouvia does not use them for analytics or advertising; the only one related to analytics is cord_analytics_internal, which is written only in Cord team browsers.

Besides cookies, the table lists what the browser keeps in localStorage and sessionStorage: interface preferences, such as the theme or the sidebar state; local copies of drafts the person has not saved yet; and, in the public quote builder, the quote in progress, the logo, recent quotes, and prices used. That data does not leave the device unless the person saves it to their account.

03 Links received by the business’s customers

The quote, invoice, and customer portal links, and the embeds a business shares with its customer, are served with Referrer-Policy: no-referrer, so their address, which works as a credential, does not travel as the referrer to the next page or to third parties. Measuring the activity the business sees on those links stores no cookies or other data on the device of whoever opens them, and depends on where that person is:

• European Economic Area, United Kingdom, Quebec, and territories with equivalent rules. For anyone who opens the link from the European Economic Area or the United Kingdom, the page runs no measurement from the browser: no presence, no reading time, no sections viewed, and no typing indicator. The same applies to Gibraltar, Jersey, Guernsey, and the Isle of Man, to the province of Quebec in Canada, to anyone who arrives without an identifiable country, and to anyone who arrives from Canada without an identifiable province; the European Economic Area here includes the outermost regions of the European Union and the Åland Islands. The country and, in Canada, the province are taken from those the hosting provider associates with the connection. The business only sees when the link was first opened, which Cord’s server records when it serves the page, without counting opens by the business’s team, bots, or browser prefetches. On a quote, the page tells whoever opens it.
• Other visitors. The open page reports presence, reading time per section, actions such as opening the PDF, and whether the visitor is typing; the business’s team and bots never count as the customer. To count how many devices open a link, the server computes on each request an identifier with an HMAC function over the organization, the link, the truncated IP network (/24 for IPv4, /48 for IPv6), and the browser, using a salt derived from a server key that changes every calendar day in the business’s time zone. Neither the customer’s IP nor their browser is stored, and one day’s identifier cannot be linked to another day’s. The same device counts as a new visitor the next day, on another network, or with another browser, and two devices with the same browser on the same network may count as one.

The cord_q_visitor cookie, used until October 15, 2026, is no longer written and is deleted if a browser still sends it. On quote and invoice links, whoever opens them sees the cookie notice as on the rest of the site, and the optional analytics in section 5 loads only with their acceptance; the customer portal, the collections pages, and the embeds never load it.

04 Consent

Before acceptance, the browser does not download the PostHog SDK or the Vercel Web Analytics and Speed Insights scripts. PostHog starts only upon acceptance and with the opt_out_capturing_by_default and opt_out_persistence_by_default options turned on, so without a current acceptance it neither captures nor writes cookies or storage. The notice offers “Necessary only” and “Accept all” with equal visual weight, and rejection does not block the service.

The choice is stored in the cord_cookie_consent cookie, with SameSite=Lax, path=/ and, on Cord domains, Domain=.cordhq.app, so it applies across all subdomains. Its value records the decision, the notice version, and the UTC day it was given, for example accepted.2026-10-15.2026-10-15, and contains no identifiers or personal data. A cookie from another version, or the earlier value without a version, does not count as a decision and the notice asks again. The version changes when purposes, providers, or the notice text change. When the choice is recorded, Cord’s server sets the same cookie again with the same value so the browser does not shorten its lifetime (Safari caps cookies written by a page at 7 days). The server does not store the choice: the record is what the browser itself keeps.

When the choice is applied, Cord keeps PostHog’s acceptance flag in localStorage under cord_ph_consent, and sets or removes it from cord_cookie_consent before PostHog starts.

05 Browser analytics

PostHog. After acceptance, PostHog measures page views and feature usage. In the app, it identifies the person and their organization only by their internal identifiers, the plan, the role, and the organization’s sign-up date; it does not receive the email, the person’s name, or the organization’s legal or trade name. It keeps its state in the ph_<token>_posthog cookie (180 days, shared across Cord subdomains) and in localStorage and sessionStorage, under keys starting with ph_. Test, demo, and internal organizations carry flags so reports exclude them.

Before each send, Cord strips query strings and replaces identifiers in every address or path of the event and the profile (current page, referrer, session entry page, previous page, and their initial values), and reads the consent cookie again: if acceptance is no longer current, the event is not sent, even if it was withdrawn in another tab or subdomain. On the links a business shares with its customer (quote, invoice, portal, embeds, collections, invitations, and identity capture), PostHog records no clicks, recordings, or heatmaps, and the page view carries no page title.

Vercel Web Analytics and Speed Insights. According to Vercel’s documentation, Web Analytics uses no third-party cookies, identifies the visitor with a hash of the request that is discarded after 24 hours, and records the route, referrer, approximate geolocation, operating system, browser, and device type. Speed Insights records performance metrics (Web Vitals) with the route, network speed, browser, operating system, device type, and country, without associating them with a visitor. Before each send, Cord strips query strings and replaces identifiers in customer, document, dispute, single sign-on, invitation, public-link, and identity-capture routes.

Pages that load no analytics, such as the customer portal, the collections pages, and the embeds, load none of these tools. The hosting provider still handles the technical request needed to serve the site.

06 Server analytics

Separately, Cord’s server records business and MCP server events in PostHog, such as a quote sent or a payment confirmed. That processing does not depend on the browser cookie or preference and neither reads nor writes anything on the device. Its legal basis is Flouvia’s legitimate interest in measuring and improving the service, not the notice’s consent, and “Accept all” does not cover it. Anyone may object by writing to legal@flouvia.com.

Events refer to the organization, without a person profile, with two exceptions: account sign-up, recorded with the person’s internal identifier to learn where sign-ups come from, and public quote builder events, which are joined to the browser’s PostHog identifier only if the person accepted analytics; without that acceptance they are recorded with a fixed, anonymous identifier. No event carries emails, names, phone numbers, tax identifiers, addresses, or notes written by a person; voiding an invoice, for example, travels as a coded reason.

07 Changing or withdrawing the choice

A first visit with no current choice shows the two options. To change the choice, the “Cookie preferences” link in the footer of cordhq.app and of the documentation (docs.cordhq.app), the button of the same name in the app’s Settings › Preferences, and the “Manage cookie preferences” link in the Privacy Notice reopen the notice. Since the choice applies across all subdomains, changing it on one changes it on the others.

Withdrawal takes effect immediately on the open page: PostHog stops capturing and its cookie and storage are deleted, Web Analytics and Speed Insights stop sending and, on later pages, do not load. While there is no current acceptance, Cord deletes any PostHog traces it finds on the device. There is no separate choice per provider. Clearing the browser’s cookies or storage makes Cord ask again.

Withdrawing consent does not affect necessary technologies and does not by itself delete data already sent; for that, the person may exercise their rights under the Privacy Notice.

08 Third parties, changes and final provisions

PostHog and Vercel receive data under the conditions of this Policy. Sign-in providers, such as Google or Apple, and payment providers, such as Stripe (with its fraud checks and the payer’s bank authentication) or Mercado Pago, may set technologies on their own domains during the flow the person chooses, and their own policies apply there. Flouvia does not control cookies placed by linked external sites.

Before using a new purpose, provider, cookie, or storage, or materially changing the purpose, duration, or scope of existing ones, Flouvia will update this Policy and, when the change affects optional analytics, will raise the notice version to ask for the choice again.

This Policy is read together with the Privacy Notice, the Data Processing Agreement, the Third Parties and Sub-processors document, and the Retention Policy. Consent to optional analytics is not contract acceptance, and server analytics neither depends on nor is covered by the browser cookie. Governing law and jurisdiction are those in section 16 of the Terms, and amendments follow its section 17.