Cookie and browser-storage notice

1. What this notice covers

In short: This website uses only a few small cookies and browser storage items, no advertising or third-party tracking cookies; analytics only starts if you accept it.

This notice lists every cookie and browser-storage item that the NINAWA website, the booking and proposal-request pages and Client Studio use, why, and for how long. NINAWA does not use advertising cookies, third-party tracking cookies, Google Analytics or social-media pixels.

2. Strictly necessary preference storage

In short: Two small cookies remember your privacy choice and your language; a session cookie protects forms and sign-in.

`ninawa_cookie_consent` is a host-only cookie on path `/` that records `v1:accepted` or `v1:necessary` for 180 days so NINAWA can remember your privacy choice. `preferred_locale` is a host-only, Secure, HttpOnly cookie on path `/` that remembers a language you explicitly select for up to 30 days after its most recent use. `session` is a host-only, Secure, HttpOnly cookie (SameSite=Lax) on path `/`. It holds a random token that protects forms against forgery and, once you sign in to Client Studio or the NINAWA administration, your account number and sign-in times; it is signed so it cannot be altered. It lasts until you close your browser; while you are signed in it expires at most 8 hours after your last activity, and Client Studio signs you out after 30 minutes without activity. Websites that clients build in Client Studio (addresses starting with `/s/`) set no cookies and use no browser storage.

The security cookie is called session. It is first-party, Secure, HttpOnly and SameSite=Lax, contains only a form-security token for visitors, and ends when you close the browser; after signing in to Client Studio it lasts at most 8 hours and ends after 30 minutes of inactivity.

3. Optional NINAWA analytics storage

In short: Only after you accept analytics does the site keep a visit identifier in your browser tab, and it is cleared when you change your mind.

After you accept optional analytics, NINAWA may create `ninawa_analytics_session_id` in `sessionStorage` for the current browser tab/session and short `ninawa:` session keys that prevent duplicate page-flow events. These values are not created or read before analytics consent. NINAWA clears its analytics session and deduplication keys when an earlier acceptance is withdrawn through Cookie settings.

4. Optional analytics processing

In short: With your consent, anonymous page statistics go to NINAWA's own analytics; never names, emails, messages or IP addresses.

After consent, browser interaction, form-state and engagement events may be sent to the first-party `/analytics/event` endpoint and the configured self-hosted Umami service. Events are limited to allow-listed fields such as page, locale, event labels and engagement timing; names, email addresses, phone numbers, typed form messages, raw IP addresses and raw user agents are not intentionally stored in analytics events. The application analytics store uses a 90-day default retention.

5. Necessary security services

In short: Where enabled, Cloudflare Turnstile checks forms against bots; it is a security service, not analytics.

Where anti-abuse protection is enabled, the consultation form may use Cloudflare Turnstile to distinguish legitimate requests from automated abuse. It is treated as a security service rather than analytics. Its current production configuration, provider role, browser storage behavior, processing locations and transfer safeguards must be verified before the legal launch gate is marked complete.

6. Accept, reject and withdraw

In short: You can accept or reject analytics in the banner and change your choice at any time through Cookie settings.

The first-layer banner provides both Accept and Reject optional analytics actions. Rejecting optional analytics does not block the website or consultation booking. A persistent Cookie settings link in the footer and booking page lets you reopen the choice. If you withdraw a previous analytics acceptance, NINAWA changes the preference to necessary-only, clears its optional analytics session storage and reloads the active page so new optional analytics stops.

• Use the Cookie settings link at the bottom of every page to change your choice.
• Your choice applies to this browser only; on another device you choose again.

7. Browser controls and recipients

In short: You can also delete site data in your browser; the data stays with NINAWA's own servers.

You can also remove site data through your browser. Necessary first-party preference storage is read by NINAWA. Optional analytics data is received by NINAWA's first-party analytics endpoint and, when configured, its self-hosted Umami service; the underlying infrastructure/provider location is verified in the controlled provider register before production release.

NINAWA's servers, including the self-hosted Umami analytics, are hosted in the EU by Hetzner and by a Belgian hosting company.

8. Changes to this notice

In short: If storage changes, this notice gets a new version first.

If NINAWA adds, removes or changes a cookie or storage item, its purpose or its duration, this notice is updated with a new version date before the change applies, and optional storage is never added without asking for your consent.