VektoVAT

Cookie Policy

Effective 6 August 2026. How VektoVAT uses cookies and similar technologies, and how you stay in control — under the GDPR and the Dutch Telecommunications Act.

1. What are cookies?

Cookies are small text files that a website stores on your device. Similar technologies — local storage, session storage and pixels — do the same job and are covered by this policy. They can remember that you are signed in, keep a payment secure, or measure how a page is used.

Cookies are "first-party" when set by VektoVAT and "third-party" when set by a service we rely on, such as Stripe.

2. Strictly necessary cookies (no consent required)

These are required to deliver the service you asked for: authentication, session security and payment processing. Under Article 11.7a of the Dutch Telecommunications Act they are exempt from consent, and the app cannot function without them.

sb-<project>-auth-tokenVektoVAT (Supabase auth, first-party local storage)Keeps you signed in and refreshes your session so you don't have to log in on every page.Until you sign out; refresh token valid up to 30 days
sb-<project>-auth-token-code-verifierVektoVAT (Supabase auth)Secures the OAuth/PKCE sign-in exchange, including Google sign-in.Session (deleted right after sign-in completes)
vektovat.cookie-consentVektoVAT (first-party local storage)Remembers your cookie choices so we don't ask again on every visit.12 months
__stripe_mid / __stripe_sidStripeFraud prevention and payment security during checkout and billing portal sessions.__stripe_mid: 12 months · __stripe_sid: 30 minutes
mStripeDetects the device used for a payment to prevent fraudulent transactions.Up to 24 months

3. Optional cookies (only with your consent)

Preference and analytics cookies are switched off by default. Nothing in these categories is loaded, written or sent anywhere until you opt in through the consent banner, and rejecting them has no effect on your ability to use VektoVAT.

Preference storageVektoVAT (first-party local storage)Remembers UI choices such as filters, export ranges and dismissed hints.Up to 12 months
Analytics identifiersPrivacy-friendly analytics provider (only if you allow analytics)Aggregated, anonymised statistics about which features are used and where errors occur.Up to 12 months

We do not use advertising, retargeting or social-media tracking cookies, and we never sell data collected through cookies.

4. Third-party cookies

  • Stripe — payment processing and fraud prevention. Stripe sets its own cookies on checkout and billing pages and acts as an independent controller for them. See stripe.com/cookies-policy/legal.
  • Supabase — authentication, database and file storage. The auth token is stored first-party in your browser; Supabase does not set tracking cookies.
  • Google — only if you choose to sign in with Google, Google may set cookies on its own sign-in domain as part of that flow.
  • Analytics provider — loaded only after you allow analytics cookies, and configured for anonymised, aggregated measurement.

5. How long cookies are stored

Durations are listed per cookie in the tables above. Session items disappear when you close the browser; persistent items last from 30 minutes up to 24 months. Your consent choice itself is stored for 12 months, after which we ask again. We also ask again whenever this policy changes materially.

6. Changing or withdrawing your consent

Withdrawing consent is as easy as giving it. Use the button below, the "Cookie settings" link in the footer of every page, or the Cookies card in Settings when you are signed in. When you switch a category off we immediately delete the related cookies and storage.

You can also block or delete cookies in your browser settings. Blocking strictly necessary cookies will sign you out and break uploads and checkout.

7. Changes and contact

We update this policy when we add or remove cookies or change providers; the effective date above always reflects the latest version. Questions or a privacy request? Email privacy@vektovat.nl. You may also complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).