Cookie Policy

What are cookies

Definition

Cookies are small text files that are placed on your computer, smartphone, tablet, or other device when you visit a website. They are widely used to make websites work more efficiently, provide a better user experience, and supply information to the website operators.

How cookies work

1. When you visit our website, our server sends a cookie to your device.
2. Your browser stores the cookie on your device.
3. When you return to our website, your browser sends the cookie back to our server.
4. This allows us to recognise your device and remember certain information about your previous visits.

Types of storage

In addition to traditional cookies, we may also use other similar technologies, including:

1. Local Storage: A web storage mechanism that allows websites to store data locally within the user's browser with no expiration date.
2. Session Storage: Similar to local storage but data is cleared when the browser session ends.
3. Web Beacons (Pixel Tags): Small, transparent images embedded in web pages or emails that track whether a page or email has been viewed.
4. JavaScript Tags: Code snippets that collect usage data and enable certain website functions.
5. ETags: Identifiers assigned by a web server to a specific version of a resource, which can be used for tracking purposes.

Throughout this policy, we refer to all of these technologies collectively as "cookies."

How we use cookies

We use cookies and similar technologies for the following general purposes:

1. Authentication and Security: To identify you when you sign in, keep your session active, and protect the Service against automated abuse.
2. Preferences and Functionality: To remember your settings and choices, such as your light or dark display preference.
3. Analytics and Performance: To understand how visitors use the Service, which pages and tools are most useful, and how quickly pages load, so we can improve it (see below).

We do not use cookies for advertising, retargeting, or cross-site tracking.

Cookie duration

Cookies can be classified by their duration:

1. Session Cookies: These are temporary cookies that expire when you close your browser. They are used to maintain your session while you navigate the Service.
2. Persistent Cookies: These remain on your device for a set period or until you manually delete them. They are used to remember your preferences and recognise you on subsequent visits.

Cookie origin

1. First-Party Cookies: Set on our website (novitora.com). This includes the Google Analytics and PostHog cookies, which their scripts set on novitora.com and which are not read on other websites.
2. Third-Party Cookies: Set by external services we rely on to run the Service, such as our authentication provider (Clerk) and our security and content-delivery provider (Cloudflare).

Types of cookies we use

Strictly necessary cookies and storage

These keep the Service secure, signed in and working, and remember the choices you make about cookies. They do not need your consent, and they cannot be switched off in our preference centre.

Note: Blocking these in your browser may stop the Service from working, for example signing in or completing a conversion.

We also keep a few items in your browser's storage rather than in cookies: the same consent records (novitora_consent, novitora_consent-notice, novitora_consent-vendors) in local storage, Clerk's copy of our sign-in settings (__clerk_environment), and, for two minutes at most, a file you send from one tool to another (novitora-handoff, IndexedDB). None of these is used for analytics or advertising.

Legal Basis: These are strictly necessary to provide the Service you request and to keep it secure (PECR regulation 6 and Schedule A1).

Preference cookies

These are set only when you pick a display or a language, or open a page in another language, and they remember that choice.

Analytics

We use three analytics tools, Umami, Google Analytics and PostHog, only to improve the Service. All three follow the same Analytics choice in our banner and preference centre, described under "Where it runs" below, and in Cookie preferences you can also switch any one of them off while leaving the others on.

Umami is a privacy-friendly analytics tool that we host ourselves in the European Union (Frankfurt). It sets no cookies. When it runs, its script sends our own server the page you visited (without its query string or fragment), the website that sent you, reduced to its address, your browser, operating system, device type, screen size and language, and your approximate location (country, region and city), derived from your IP address. Your IP address itself is not stored: Umami keeps only a one-way hash of it, your browser and a secret that changes every month, so it can count visits rather than people. We look at this data only as totals.

Google Analytics, provided by Google, shows us how people use the Service: which pages and tools they open, how they arrive, and whether conversions and downloads succeed. It is never used for advertising: Google signals, advertising features and the settings that let Google use our data for its own purposes are switched off, and Google processes the data only on our behalf. It is loaded by Google Tag Manager, which sets no cookies of its own.

When analytics is allowed, Google Analytics sets the cookies below and sends Google:

1. The page you visited, without its query string or fragment except campaign tags (utm_ parameters), its title, and the website that sent you, reduced to its address (for example https://example.com).
2. What happened on the page: how far you scrolled, whether a conversion finished or failed (with the error code we showed you), the type of a file you downloaded (for example pdf), and which suggested tool you opened next. Never the names or the contents of your files.
3. Your browser, operating system, device type, screen size and language.
4. Your approximate location (country, region and city), which Google works out from your IP address. For visitors in the UK, the EU and Switzerland, Google uses the IP address only for this and then discards it without storing it.

Google deletes the visit-level data linked to these identifiers after 14 months. The reports we keep are totals that identify no one.

PostHog, provided by PostHog Inc. and hosted in the European Union (Frankfurt), shows us how our tools work for the people who use them: whether files upload, whether conversions succeed, and where they go wrong before a download. PostHog processes the data only on our behalf. When analytics is allowed, our pages send PostHog the items below, and it keeps the identifiers in the table on your device:

1. The page you visited, without its query string or fragment except campaign tags (utm_ parameters), its title, and the website that sent you, reduced to its address.
2. The steps of a conversion: that you opened a tool, that your files were uploaded (with the type of the first file, for example heic), whether the conversion finished or failed (with the error code we showed you), the type of a file you downloaded, and which suggested tool you opened next. Never the names or the contents of your files.
3. Your browser, operating system, device type, screen size, language and time zone.
4. A random identifier for your browser and one for your visit, so the steps can be counted in order.

PostHog does not receive your location: we switch its location lookup off, and it does not store your IP address. We do not record your screen, clicks or mouse movements, we do not build a profile of you, and we never tell PostHog who you are, even when you are signed in. PostHog keeps these events for one year on our current plan, after which it may delete them.

PostHog keeps a copy of the same identifier in your browser's local storage, and the state of your visit in session storage, under names that start with ph_. When you withdraw your consent, we delete all of them.

Where it runs, and how you control it (all three tools):

1. United Kingdom, European Economic Area, Gibraltar, Québec, and any visitor whose location we cannot tell: Umami, Google Analytics and PostHog's analytics load only after you accept analytics in our banner or preference centre. Until then, your browser sends nothing to any of them for analytics.
2. Everywhere else: they run unless you object. Our banner tells you about it on your first visit, and you can turn it off at any time with "Manage preferences" or Cookie preferences.

When you refuse or withdraw analytics, or switch one tool off, we delete the cookies and storage that tool set on novitora.com.

If your browser sends a Global Privacy Control signal, we treat it as an objection to analytics wherever analytics would otherwise run without your consent. You can also block Google Analytics on every website with Google's opt-out browser add-on.

Legal Basis: Consent in the UK, the EEA, Gibraltar and Québec, and wherever we cannot tell where you are. Elsewhere, our legitimate interest in understanding how the Service is used, which you can object to at any time.

Performance

For visitors outside the European Union, Cloudflare Web Analytics, part of the network service Cloudflare provides us, measures page views and page load times in aggregate, using a script that reads your browser's performance data. It sets no cookies, and Cloudflare states that it does not collect or use visitors' personal data. Cloudflare adds it to our pages itself, so it does not follow the choices in our banner.

Marketing and advertising cookies

Novitora does not use marketing or advertising cookies. We run no advertising networks, retargeting pixels, or cross-site advertising trackers, and we do not sell or share your data with advertisers. If that ever changes, those tools will load only after you consent, and we will update this policy first.

Third-party cookies

Overview

Some cookies on our Service are placed by services we rely on to run it. They are subject to the respective third party's privacy policy.

Third-party services

1. Clerk

   • Purpose: Account sign-in and session management (the __client, __client_uat and __session cookies described above). Clerk's script loads on every page, so the first two cookies are set even if you never sign in.
   • Privacy Policy: https://clerk.com/legal/privacy

2. Cloudflare

   • Purpose: Security, bot protection, content delivery, and the Turnstile challenge shown on file uploads (the cf_clearance, __cf_bm and _cfuvid cookies described above), and Cloudflare Web Analytics outside the European Union (described above).
   • Privacy Policy: https://www.cloudflare.com/privacypolicy/

3. Google (Google Analytics and Google Tag Manager)

   • Purpose: Analytics (the _ga and _ga_<id> cookies described above), only where your choices allow it. Google acts as our processor under its data processing terms.
   • Privacy Policy: https://policies.google.com/privacy
   • How Google uses information from sites that use its services: https://policies.google.com/technologies/partner-sites

4. PostHog

   • Purpose: Analytics (the ph_ cookies and storage described above), only where your choices allow it. PostHog processes the data only on our behalf.
   • Privacy Policy: https://posthog.com/privacy

Our cookie banner and preference centre are built with c15t, an open-source consent tool that runs on our own website. Your choices are stored in your browser. When you make one, your browser also sends it to our own server, which records it so we can show that we asked and what you chose: a random identifier, the time, the version of this policy you were shown, the language of the banner, and your choice, including any tool you switched off. We do not store your IP address or details of your browser or device with it. The record is kept in our own database in the European Union (Frankfurt), and nothing is sent to c15t or anyone else. To show you the right banner, your browser asks our server which rules apply where you are, worked out from the country Cloudflare reports for your connection.

Responsibility

While we carefully select our third-party partners, we are not responsible for the cookies they set or the data they collect. We encourage you to review the privacy and cookie policies of these third parties.

Cookie management

Cookie banner

When you first visit our website, our banner shows the choices that apply where you are:

1. In the United Kingdom, the European Economic Area, Gibraltar, Québec, or if we cannot tell where you are: "Accept all" and "Reject all", with equal weight, and "Manage preferences" to choose by category or tool by tool. Nothing optional runs until you choose.
2. Everywhere else: a notice about our analytics with "Got it", and "Manage preferences" to object.

You can change your choices at any time from Cookie preferences in the footer of every page. When you withdraw a choice, the page reloads so that nothing you have turned off keeps running, and the cookies and storage of each tool you turned off are deleted. We ask again only if the choices we offer or the tools behind them change, or when a choice expires: after 6 months in the United Kingdom, the European Economic Area and Gibraltar, and after 1 year elsewhere.

Browser settings

Most web browsers allow you to control cookies through their settings. You can typically:

1. View Cookies: See which cookies are stored on your device.
2. Delete Cookies: Remove some or all cookies from your device.
3. Block Cookies: Prevent some or all cookies from being set.
4. Allow Cookies: Permit specific types of cookies.

Here are links to cookie management instructions for common browsers:

1. Google Chrome: https://support.google.com/chrome/answer/95647
2. Mozilla Firefox: https://support.mozilla.org/en-US/kb/clear-cookies-and-site-data-firefox
3. Apple Safari: https://support.apple.com/en-gb/guide/safari/sfri11471/mac
4. Microsoft Edge: https://support.microsoft.com/en-us/microsoft-edge/delete-cookies-in-microsoft-edge-63947406-40ac-c3b8-57b9-2a946a29ae09

Mobile devices

For mobile devices, you can manage cookies and similar technologies through your device settings:

1. iOS: Settings > Safari > Privacy & Security.
2. Android: Settings > Privacy > Clear browsing data (in Chrome or other browsers).

Your choices

Summary of options

1. Cookie banner and Cookie preferences: Accept, reject or object to analytics, and change your mind at any time.
2. Global Privacy Control: If your browser sends this signal, we treat it as an objection to analytics.
3. Browser Settings: Block or delete cookies through your browser.
4. Do Not Track: We do not respond to the older "Do Not Track" signal, which has no agreed standard; Global Privacy Control replaces it.

Impact of disabling cookies

1. Strictly Necessary Cookies: If blocked, the Service may not work correctly. You may be unable to sign in, keep a session, or complete conversions.
2. Analytics: If you reject or object to analytics, we will not count your visits, which limits our ability to improve the Service.
3. Preference Cookies: If blocked, your light or dark display and your language may not be remembered.

Consent withdrawal

You may withdraw your consent, or object to analytics, at any time by:

1. Clicking Cookie preferences in the footer of our website.
2. Clearing cookies through your browser settings.
3. Contacting us at privacy@novitora.com.

Please note that withdrawing consent does not affect the lawfulness of processing based on consent before its withdrawal.

Legal framework

Applicable regulations

Our use of cookies is governed by:

1. UK Privacy and Electronic Communications Regulations 2003 (PECR), as amended by the Data (Use and Access) Act 2025: consent is required for storage and access technologies, except where they are strictly necessary or fall under one of the exceptions in Schedule A1, such as statistics to improve a service, provided users are told and can object.
2. UK General Data Protection Regulation (UK GDPR): Governs the processing of personal data collected through cookies.
3. EU General Data Protection Regulation (EU GDPR): Applies to users in the European Economic Area.
4. ePrivacy Directive (2002/58/EC): The EU directive on privacy and electronic communications, which requires consent for analytics.

Consent requirements

Where consent is required:

1. We ask before setting or reading anything that is not strictly necessary.
2. Consent must be freely given, specific, informed, and unambiguous, so rejecting is as easy as accepting.
3. You are given clear information about the cookies we use and their purposes.
4. You can withdraw your consent as easily as you gave it.

Updates to this policy

Changes

1. We may update this Cookie Policy from time to time to reflect changes in the cookies we use, changes in applicable law, or changes to our practices.
2. When we make material changes, we will update the "Last Updated" date at the top of this policy and notify you through:
   • A notice on our website.
   • An email notification (for material changes that affect how we process personal data through cookies).
3. We encourage you to review this policy periodically.

Previous versions

Previous versions of this Cookie Policy are available upon request by contacting privacy@novitora.com.

Contact us

If you have any questions or concerns about our use of cookies or this Cookie Policy, please contact us at:

Uptraff Ltd 124 City Road London, England EC1V 2NX

Email: privacy@novitora.com

General Legal Inquiries: legal@novitora.com

Website: novitora.com

We will make every effort to respond to your inquiry within 30 days.

By continuing to use Novitora, you acknowledge that you have read and understood this Cookie Policy.