Policy
Cookie Policy
An itemised list of what Complyra keeps in your browser or records about website use, why, and for how long, as far as we can verify it.
Draft prepared:
What these technologies are
- Cookies are small text files a website asks your browser to store and send back on later requests.
- Local storage is browser storage that stays on your device until it is cleared. It is not sent to a website automatically; the site's own scripts read it.
- Session storage is similar but is cleared when the browser tab closes.
- Server-side analytics records are events our servers store when your browser reports an action, for example a page view. They need no cookie.
- Network requests to third parties happen when a page loads something from another company, such as a font. That company receives the request, including your IP address.
Local storage and session storage are not cookies. We list them here because they are similar technologies and are covered by the same kinds of rules in many places. How they are classified is a point for legal review, noted in the tables.
What Complyra uses
Based on a review of the source code and a check of the public homepage on 19 October 2026:
- Complyra's own code does not write browser cookies, and the public homepage did not receive any cookie from our servers in that check. This statement does not cover other environments, other pages or what third-party services do.
- Complyra keeps items in local storage and session storage, listed below.
- Complyra records first-party analytics events on its own servers, without cookies.
- The website can load Google Analytics 4, Plausible Analytics and Cloudflare Web Analytics, but only when a build sets the matching setting and you have allowed Analytics. None of them was present on the public homepage in that check. Whether any is enabled in another environment cannot be verified from the code.
- The website fonts are served from the Complyra domain; in the current code no font request is sent to a font provider. On public pages, the sales assistant is loaded from a separate Complyra chat service, and only after you allow Functional and preferences.
- We found no advertising or marketing pixels.
Inventory of items Complyra stores
Durations: where the code sets no expiry we say so, and where a lifetime depends on server settings or on the provider we say it requires verification. Nothing here is a guess.
| Technology or identifier | Category | Purpose | Where it is kept | Duration | Provider | Status and notes |
|---|---|---|---|---|---|---|
| complyra_consent | Consent record | Remembers your cookie choice: which optional categories you allowed, when, and how you chose. It holds no name, email, IP address or other identifier. | localStorage | Persists until you clear site data. No expiry has been decided; a new decision is requested if the consent model changes. | Complyra | Implemented. Every optional technology reads it and stays off unless it allows that category. Classification: Awaiting classification |
| complyra_token | Sign-in and account | Holds the access token that proves you are signed in when the page calls the Complyra API. | localStorage | Persists until you sign out or clear site data. The token inside is short-lived (15 minutes by default; set on the server). | Complyra | Implemented Classification: Awaiting classification |
| complyra_refresh_token | Sign-in and account | Lets the page obtain a new access token without asking you to sign in again. | localStorage | Persists until you sign out or clear site data. The token inside is valid for 7 days by default (set on the server). | Complyra | Implemented Classification: Awaiting classification |
| complyra_user | Sign-in and account | A cached copy of your profile (such as name, email, organization id, role, plan and account type) so pages can show the right interface before the server answers. | localStorage | Persists until you sign out or clear site data. | Complyra | Implemented Classification: Awaiting classification |
| complyra_supplier_token, complyra_supplier_refresh_token, complyra_supplier_profile | Supplier portal sign-in | Keeps a supplier signed in to the supplier portal. The refresh token is stored only if the supplier chooses to be remembered. | localStorage | Persists until sign-out or clearing site data; duration of the tokens requires verification. | Complyra | Implemented Classification: Awaiting classification |
| complyra-theme | Preferences | Remembers your light or dark display choice. | localStorage | Persists until you clear site data. | Complyra | Implemented Classification: Awaiting classification |
| complyra_onboarded, complyra_mode, complyra_industry, complyra_first_query | Preferences | Remember your answers in the first-run setup (account mode, industry and a first query) so the setup is not repeated. | localStorage | Persist until you sign out (cleared by the sign-out routine) or clear site data. | Complyra | Implemented Classification: Awaiting classification |
| complyra_recent_searches | Preferences | Remembers your recent search text on this device to offer it back as suggestions. | localStorage | Persists until you use "Clear history", sign out or clear site data. | Complyra | Implemented Classification: Awaiting classification |
| complyra_uid | Experiment identifier | A random anonymous identifier used to assign you to a variant of an interface experiment (the RFQ panel) and attached to the experiment's events. Created only after you allow Analytics; removed if you withdraw it. Without it you see the control version. | localStorage | Persistent with no expiry set in the code until you clear site data or withdraw Analytics; not removed by the sign-out routine. | Complyra (events are sent to the Complyra API, and to PostHog if it is configured) | Implemented; created and used only with Analytics consent Classification: Optional |
| complyra_tour_done | Preferences | Remembers that you finished or dismissed the product tour so it does not start again. | localStorage | Persists until you clear site data; the sign-out routine does not remove it. | Complyra | Implemented Classification: Awaiting classification |
| mo_nav | Interface | A short-lived hint used to animate navigation between workspace pages. | sessionStorage | Session-based: cleared when the tab closes. | Complyra | Implemented Classification: Awaiting classification |
| complyra_landing, complyra_utm | First-party analytics | Remember, for this tab only, the page you arrived on and any campaign tags (utm_source, utm_medium, utm_campaign, utm_content) so later events can be attributed to that visit. Written only after you allow Analytics. | sessionStorage | Session-based: cleared when the tab closes, or when you withdraw Analytics. | Complyra | Implemented; written only with Analytics consent Classification: Optional |
| complyra_chat_id, complyra_chat_consent, complyra_chat_last | Sales assistant (chat widget) | Keep one conversation together (a random conversation id), remember that you ticked the consent box in the chat, and time out an idle chat. | sessionStorage | Session-based: cleared when the tab closes or the chat resets after inactivity. | Complyra chat service | Implemented; the widget's own source states it sets no cookies. The widget is only loaded after you allow Functional and preferences. Classification: Optional |
| Public page and tool events (page_view, cta_click, signup_click, tool_used, content_engaged) | First-party analytics | Counts how public pages, calls to action and tools are used. Each event carries the page path, the landing path, the referrer host, any campaign tags and a call-to-action label; the beacon sends no user id. Sent only after you allow Analytics; events from before that are discarded, never saved for later. | Server-side record | Retention period requires confirmation by the owner. | Complyra | Implemented; sent without cookies, and only with Analytics consent Classification: Optional |
Third-party services and optional analytics
These are services the website can load or call. Complyra does not control how a third party handles the requests it receives, and cannot verify its cookies or retention from here. Check the provider's own documentation.
| Technology or identifier | Category | Purpose | Where it is kept | Duration | Provider | Status and notes |
|---|---|---|---|---|---|---|
| Google Analytics 4 | Optional analytics (conditional) | Website analytics. Loaded only when the build sets NEXT_PUBLIC_GA4_ID AND you have allowed Analytics; configured to anonymize IP addresses. If you later withdraw Analytics, Complyra sets Google's documented opt-out flag and expires the _ga cookies, which stops further hits; data already sent cannot be recalled. | Cookie | Not verified: the provider documents its own cookies and their durations. | Implemented but conditional on the build and on your consent. Not present on the public homepage on 2026-10-19; production configuration of other environments is not verified. Classification: Optional | |
| Plausible Analytics | Optional analytics (conditional) | Website analytics. Loaded only when the build sets NEXT_PUBLIC_PLAUSIBLE_DOMAIN AND you have allowed Analytics. If you later withdraw Analytics, Complyra sets Plausible's documented plausible_ignore flag in local storage so its script ignores further events; the flag is removed if you allow Analytics again. | Network request | Not verified: the provider describes its service as cookieless; Complyra has not verified this. | Plausible Analytics | Implemented but conditional. Not present on the public homepage on 2026-10-19. Classification: Optional |
| Cloudflare Web Analytics | Optional analytics (conditional) | Website analytics. Loaded only when the build sets NEXT_PUBLIC_CF_ANALYTICS_TOKEN AND you have allowed Analytics. Once loaded it cannot be stopped from here if you later withdraw Analytics; it is not loaded again on later page loads. | Network request | Not verified: depends on the provider. | Cloudflare | Implemented but conditional. Not present on the public homepage on 2026-10-19. Classification: Optional |
| PostHog | Optional product analytics (conditional) | Experiment and product events. Used only if its key is configured: events can be captured by the PostHog script when present, and the API has a PostHog client. | Network request | Not verified. | PostHog | Implemented but conditional; whether it is enabled in production is not verified. Classification: Optional |
| Complyra chat widget script | Third-party resource | Loads the sales assistant from the separate Complyra chat service (a different host from the website) on public marketing pages when it is configured, and only after you allow Functional and preferences. Nothing is requested from the chat service before that. Once loaded it cannot be removed from the page if you later withdraw consent; it is not loaded again on later page loads. | Network request | Not applicable for the script itself; see the chat storage item above. | Complyra chat service | Loaded only with Functional consent (a business decision, see the owner actions). It was present on the public homepage on 2026-10-19, before this control existed. Classification: Optional |
The Privacy Policy describes the service providers used to run Complyra more generally: read the Privacy Policy.
Controlling browser storage
- Sign out. Signing out clears the sign-in items, cached profile, setup answers and recent searches for your account on that browser.
- Browser settings. Your browser lets you view, block and delete cookies and site data, usually under Privacy or Site settings. Clearing site data for getcomplyra.com removes every item above. You will be signed out, and preferences such as the display theme are reset.
- Tab storage. Session storage is removed when you close the tab.
- Tracking settings. Browser and extension settings that block analytics scripts will stop optional analytics from loading.
Blocking items needed to keep you signed in may stop parts of the service from working.
Your consent choices
Available. Pages built with the main site layout show a cookie banner with Accept All, Reject Optional and Customize, a preferences screen with an Analytics and a Functional and preferences category, and a Cookie Settings link in the footer to change your choice later. The choice is saved in this browser.
What your choice controls. Until you allow a category, its technologies stay off. Analytics covers the optional analytics scripts (when a build configures them), Complyra's first-party event counts, the campaign tags remembered for the tab and the experiment identifier. Functional and preferences covers the remembered display theme, setup answers, recent searches, product-tour flag, interface hints and the sales assistant chat. If you withdraw a category, the items it covered are removed and its technologies stop being used.
Limits. A script that is already running on the page you are viewing, such as an analytics or chat script, cannot be unloaded and may keep running until you leave or reload the page; Complyra applies the provider's own opt-out where one exists. Data already sent cannot be recalled. If your browser will not let Complyra save your choice, optional technologies stay off. The standalone sign-in, sign-up, password, shop, account, saved-products, pricing and supplier sign-up pages carry links to both policies and to Cookie Settings, which opens this same screen and brings you back; they do not show the banner themselves, they honour a choice made elsewhere on the site, and without one they leave optional technologies off. Fonts are served from the Complyra domain whatever you choose.
Updates and contact
When this policy changes, the date at the top changes. Privacy contact: OWNER ACTION: approved privacy contact