Cookie policy

1. Strictly necessary cookies (always on)

No consent required (LSSI-CE Art. 22.2 technical exception):

• Supabase Auth session cookies — session only.
• `prolio_country_v1` — language/country preference, 1 year.
• `prolio_consent_v1` (localStorage) — banner decision with policy version, timestamp and scope, 1 year.

2. First-party attribution cookies

If you arrive via a campaign link carrying utm_* parameters, we store them in our own cookies so a later form submission (e.g. the waitlist) keeps its source attribution. First-party only: no third party reads them, no external script loads, never used for advertising or profiling.

• `prolio_utm_source`, `prolio_utm_medium`, `prolio_utm_campaign`, `prolio_utm_content`, `prolio_utm_term` — first-touch campaign attribution, 30 days. Basis: legitimate interest in first-party campaign measurement.

3. Analytics cookies (only with your consent)

• Google Analytics 4 — Google LLC (USA), SCCs. Cookies `_ga`, `_ga_*`, up to 2 years. Opt-out: https://tools.google.com/dlpage/gaoptout
• PostHog Cloud US — PostHog Inc. (USA), us.i.posthog.com, SCCs. `ph_*` + localStorage entries, 1 year.

4. Marketing cookies

Prolio does not use advertising, remarketing, social or profiling cookies. The banner's Marketing toggle stays off by default.

5. Accept / reject / change

The first-visit banner offers Accept all, Reject all, and Customise with equal visual weight. Change your choice any time via the footer "Cookie preferences" link.

6. Cookie-less technologies

We use error monitoring (Sentry): when the site fails, the browser sends a technical report (error message, page, browser, IP). It sets no cookies and does not identify you across sessions; basis is our legitimate interest in security and diagnostics. See the Privacy policy (sections 4 and 7).

7. Consent evidence

Every decision is logged with policy version, timestamp and a non-reversible IP hash, retained for 24 months as AEPD evidence.

8. Changes

When the non-strictly-necessary cookie set changes we bump the policy version and the banner reappears.