Legal / 06

Cookie notice

Last updated 8 October 2026

Essential storage

The account application uses an HTTP-only session cookie after sign-in to authenticate the browser, protect account data and maintain the selected organisation. It is secure in production and uses SameSite=Lax. This storage is necessary to provide the account service.

The THAVIQ_LOCALE cookie remembers your language choice for one year. On your first visit we use your browser's Accept-Language preference. You can always switch languages, including English. We do not redirect based on your IP address.

Optional Google Analytics

If you select “Accept analytics”, we load Google Analytics with measurement ID G-XKY3FJLEX0. We measure public marketing pages only. We do not initialise analytics on sign-in, customer reports or dashboard pages, and our explicit events omit URL queries, fragments, customer website URLs and account or scan identifiers. It helps us understand aggregate site use, including page visits, sessions, approximate location, browser and device information. Advertising storage, Google signals and ad-personalisation signals are disabled.

Google Analytics can set _ga and _ga_<container-id> cookies, which Google documents with a default expiry of two years. See Google's Google Analytics cookie documentation . No Google Analytics script or request is made before you opt in.

Payments and external sites

Paddle is loaded only when you open a checkout. Paddle may use storage needed to process payment and prevent fraud under its own notice. Links to external sources can take you to sites with their own storage practices.

Consent

Accepting analytics is optional, and rejecting it does not limit the service. Your choice is stored in your browser so we can respect it. Use “Cookie settings” at the bottom of any page to change or withdraw your choice. On withdrawal, analytics storage is denied and we make a best-effort attempt to remove Google Analytics cookies accessible to this site.

With your analytics permission, we store a random session journey ID to measure public visits, pricing views and plan selection. It contains no email, report token or website URL. Browser measurement is separate from operational scan/report/checkout events. Event rows are removed after 90 days.