COOKIE POLICY

1. WHAT THIS PAGE IS

This page is a complete, code-verified inventory of the cookies and similar technologies used on vazgro.com and in the Vazgro client, partner and staff portals. It is maintained alongside the software: every entry below corresponds to a named cookie or browser-storage key that actually exists in our codebase.

Cookies are small text files a website asks your browser to store. Related technologies — localStorage and sessionStorage — keep data on your device instead, and are never transmitted to our servers. Both are covered here.

Vazgro Ltd is the data controller. Where a cookie involves personal data, our Privacy Policy explains the lawful basis, retention and your rights.

2. WE DO NOT USE ANALYTICS, ADVERTISING OR THIRD-PARTY TRACKING

We want to be precise about this, because it is unusual. Vazgro runs one privacy-preserving analytics measurement (Vercel Web Analytics — cookieless, first-party, no cross-site identifier, aggregate page-view counts only), and no advertising or retargeting pixels, no social media trackers, no session-recording or heatmap tools, and no third-party tag manager. There is no Google Analytics, no Meta Pixel, no LinkedIn Insight Tag, no Hotjar, no PostHog and no A/B testing service. No advertising network receives data about your visit, and we do not sell or share personal data for advertising purposes.

Every cookie described below is a first-party cookie set by vazgro.com itself. None of them is used to build a profile of you, to follow you across other websites, or for advertising.

Because of this, we do not show a cookie consent banner. Under the Privacy and Electronic Communications Regulations (PECR) regulation 6, consent is required for cookies that are not strictly necessary — so the two attribution cookies listed in section 4 are disclosed here rather than hidden behind a banner nobody reads. If we ever introduce analytics, advertising or any third-party tracking technology, we will implement a consent mechanism before doing so, and update this page at the same time.

3. STRICTLY NECESSARY COOKIES

These cookies are required to deliver the service you have asked for. Without them, signing in, staying signed in, switching between workspaces, or seeing prices in your own currency would not work. They are exempt from the consent requirement under PECR regulation 6(4).

sb-<project>-auth-token (and its numbered chunks) — set by our authentication provider, Supabase. Holds your signed-in session and refresh token. Without it you would be signed out on every page load. Duration: for the life of your session, refreshed while you remain active; cleared when you sign out.

vz_active_account — remembers which client workspace you are currently viewing, for people who belong to more than one. Duration: up to 1 year. Contains an internal account identifier, not your name or email.

vz_active_partner — the same thing for partner organisations: which partner team you are acting within. Duration: up to 1 year.

vz_brand — remembers the selected brand inside a multi-brand client workspace, so your assets and requests stay filtered to the right brand. Duration: up to 1 year.

vz_cc — a two-letter country code, taken from your connection or from your own selection. Used to show prices in the appropriate currency and to apply the correct tax treatment at checkout. Duration: up to 1 year. It is a country code only — never a precise location.

vz_flash_error — carries a single error message across one redirect so a failed form can tell you what went wrong. Duration: seconds; deleted as soon as it is read.

vz_pf — a short-lived carrier for an email address you have just typed into a sign-in or registration form, so that we can pre-fill the next step WITHOUT putting your email address into a web address. Web addresses are recorded in browser history, in server access logs and in referrer headers; a five-minute cookie is not. Duration: 5 minutes, then it expires; it is also deleted immediately after it is used.

4. FUNCTIONAL COOKIES THAT ARE NOT STRICTLY NECESSARY

Two cookies support our referral programmes. They are not required for the website to work, so we disclose them explicitly here.

vz_ref — set when you arrive through a Vazgro partner's referral link (vazgro.com/r/...). It records the partner's public referral code so that, if you later become a client, the partner is credited with the referral and paid their commission. Duration: 90 days. It contains a partner code, not information about you. It is not used for advertising, is not shared with any third party, and is not read by anyone other than Vazgro.

vz_cref and vz_cref_m — the same mechanism for our client referral programme (vazgro.com/cr/...): they record which existing client, and optionally which member of their team, referred you, so the referral reward can be credited. Duration: 90 days.

If you would rather not have these set, you can block or delete them in your browser settings (section 7). Everything else on the site will continue to work normally — the only consequence is that a partner or client who referred you may not receive credit.

We also record a referral click event when one of these links is used. That record contains the referral code, the page you landed on, any campaign tags in the link, your browser's user-agent string, and a one-way salted hash of your IP address. The hash cannot be reversed to recover your IP address. These records are deleted automatically after 26 months.

5. BROWSER STORAGE ON YOUR DEVICE

The following are stored in your browser's localStorage. They hold interface preferences only, are never sent to our servers, and are not cookies — but we list them for completeness.

vazgro-vb-theme — light or dark appearance on the public website.

portal-theme — light or dark appearance inside the portals.

portal-nav-collapsed and portal-nav-open — whether your sidebar is collapsed and which navigation groups you have expanded.

vz.editor.sidebar — whether the sidebar is collapsed in the content editor.

vz.tour.<name>.v<number> — records that you have seen or skipped a guided product tour, so it does not reappear every time you sign in.

vz.coach.<name> — records that you have dismissed a one-off tooltip.

vz_geo_v1 — a short-lived cache of the currency and country lookup described in section 3, so we do not repeat the request on every page.

Clearing your browser storage resets these preferences. Nothing is lost except the preferences themselves.

6. EMAIL TRACKING

Cookies are not the only technology PECR covers. When we send you an email, our email provider (Resend) can report whether the message was delivered, whether it bounced, whether you reported it as spam, and — where open and click tracking is enabled — whether the message was opened or a link in it was clicked. Open tracking works by including a small invisible image in the message.

We rely on delivery, bounce and complaint reporting for a specific and necessary purpose: it is how an address that no longer works, or someone who has marked our mail as spam, is automatically added to our suppression list and never emailed again.

Open and click records are deleted automatically after 13 months. Most email clients let you block remote images, which prevents open tracking entirely. You can stop all marketing email from us at any time using the unsubscribe link in any message, or by emailing hello@vazgro.com — and we keep a record of that request permanently, precisely so that it is honoured.

7. HOW TO CONTROL COOKIES

Every major browser lets you see the cookies a site has set, delete them, and block future ones — usually under Settings, then Privacy. You can also browse in a private or incognito window, which discards all cookies when you close it.

Please note that blocking the strictly necessary cookies in section 3 will prevent you from signing in to the Vazgro portals, because your session cannot be maintained without them.

Your browser may also offer a Global Privacy Control or Do Not Track signal. As we operate no advertising or cross-site tracking, there is nothing for such a signal to switch off.

8. CHANGES AND CONTACT

We will update this page whenever we add, remove or change a cookie, and always before introducing any analytics or third-party tracking technology. The effective date above tells you when it was last revised.

Questions about this page, or about cookies and tracking generally, can be sent to hello@vazgro.com. You also have the right to complain to the Information Commissioner's Office (ico.org.uk), the UK supervisory authority.