Cookie Policy

1. What This Policy Covers

This Cookie Policy explains how Dutiva Canada Inc. ("Dutiva," "we," "us," or "our") uses cookies, local storage, session storage, and similar technologies on our website and application. These technologies store or read small pieces of information in your browser so the service can remember session, preference, security, and workflow state.

This Policy should be read together with our Privacy Policy.

2. Strictly Necessary Cookies and Storage

Dutiva uses necessary cookies and browser storage to provide core service functions, including:

• Authentication: Supabase session storage keeps you signed in and supports secure magic-link authentication.
• Security and reliability: Infrastructure providers may use operational cookies, logs, and request metadata to route traffic, prevent abuse, maintain availability, and protect the service.
• Public-site security trustmark: the marketing site loads TrustedSite (Halo Security) so visitors can see website security-scan status. That script may set cookies or similar storage on TrustedSite's domain. It is not loaded in the signed-in workspace and is not used for advertising.
• Workflow continuity: In-browser state helps prevent disruption while you move through onboarding, document, Advisor, and workspace flows.
• Billing and checkout: Stripe may use cookies or similar technologies when you access checkout, invoices, the billing portal, or related payment workflows.
• Without necessary storage, account access, security features, billing workflows, and core application features may not work.

3. Preference Storage

Dutiva stores preference values in browser storage so the interface remains usable across visits. Current examples include language, theme, onboarding context, workspace settings, and in-browser feature state.

Preference storage is not used for advertising, sale of personal information, or third-party marketing profiles.

4. Analytics

Dutiva uses two kinds of analytics: first-party support analytics and optional third-party website analytics (Google Tag Manager / Google Analytics 4). Both are optional and off by default — nothing is collected until you accept analytics through the consent banner, and you can change your choice at any time from the "Cookie preferences" link in the footer. First-party support analytics (Help Centre searches, article views, helpfulness votes, and support ticket events) are sent to a Dutiva-operated edge function in Canada and do not use third-party cookies. These events carry a daily-rotated anonymous visitor identifier for Help Centre activity or the workspace (organization) identifier for authenticated ticket events, never an individual user identifier. Raw event data is retained for 90 days; daily aggregates are retained indefinitely.

Google Tag Manager, if enabled, loads only when a container ID is configured and the user has granted consent through the consent banner. Google Analytics 4 may then fire from that container, or load on its own when a measurement ID is configured and Tag Manager is not. Where analytics or similar optional technologies require consent, notice, or preference controls under applicable law, Dutiva will provide appropriate controls before using those technologies for that purpose.

• Analytics are configured to minimize personal information, including IP anonymization, IP masking, or other privacy-preserving settings where supported.
• Dutiva does not intentionally send sensitive document text, payment card numbers, social insurance numbers, medical records, bank details, or highly sensitive employee information in analytics events.
• Analytics are not used for third-party advertising retargeting or cross-site marketing profiles.

5. Consent and Optional Technologies

Strictly necessary cookies and storage are used because they are required to deliver and secure the service. Optional analytics, marketing, tracking, profiling, or similar technologies are not required for core account access.

If Dutiva introduces optional technologies that collect personal information, identify or locate a person, perform profiling, or otherwise require consent or additional controls under applicable law, Dutiva will update this Policy and provide appropriate notice and controls before using them.

6. Marketing Cookies

Dutiva does not currently use third-party advertising cookies, social media pixels, or cross-site marketing trackers. If we add optional marketing cookies later, we will update this Policy and provide appropriate notice and controls before using them.

7. Third-Party Providers

Our service providers may use cookies, browser storage, or similar technologies for operational purposes, including authentication, payment checkout, fraud prevention, hosting, performance, AI inference support, network security, and the public-site TrustedSite trustmark. These providers may include Supabase, Vercel, Stripe, Cloudflare, DigitalOcean Gradient AI, TrustedSite, and Google Tag Manager or Google Analytics if analytics are enabled.

Third-party providers process information according to their own terms and privacy notices when acting independently. When they act as Dutiva service providers, their processing is limited to the services they provide to Dutiva, subject to applicable contractual and legal requirements.

8. Your Controls

You can block, clear, or limit cookies and browser storage through your browser settings. If you clear required storage, you may be signed out and some preferences or in-progress workflows may reset.

Common browser controls include:

• Chrome: Settings > Privacy and security > Delete browsing data.
• Firefox: Settings > Privacy & Security > Cookies and Site Data.
• Safari: Settings > Privacy > Manage Website Data.
• Edge: Settings > Privacy, search, and services > Clear browsing data.

9. Retention

Session storage usually expires when your session expires, you log out, or your browser clears it. Preference storage remains until you change the preference, clear site data, or the application overwrites it. Infrastructure logs and analytics events are retained according to the applicable provider and Dutiva retention practices.

10. Changes to This Policy

Dutiva may update this Policy to reflect changes to the website, application, service providers, analytics configuration, legal requirements, or privacy practices. Material changes will be communicated through the website, application, email, or another reasonable method where required.

11. Contact

Questions about cookies, browser storage, or similar technologies can be sent to privacy@dutiva.ca.