Joqiva Cookie Policy

This Cookie Policy explains how Joqiva uses cookies and similar technologies that store information on, or access information from, your device. It applies to Joqiva websites, web applications, customer-facing quote and invoice pages, documented interfaces, communications and related services that link to this Cookie Policy. This Cookie Policy should be read together with our Privacy Policy. Where consent, refusal, objection or preference choices are required, they are handled through Joqiva Cookie Settings, app settings, account settings, a consent banner or another clearly labelled control where available.

Joqiva is operated by FOP Mykola Marchuk Mykolaiovych, an individual entrepreneur registered in Ukraine, trading as Joqiva. Joqiva's current legal entity details, trading name, website, country of establishment, establishment address, correspondence address, registration information, tax status, contact details, privacy contact and UK/EU representative details, where required, are maintained in the Legal Notice.

Cookies are small text files stored on your device when you visit a website or use an online service. This Cookie Policy also covers similar technologies that store information on, or access information from, your device. These may include: (a) cookies; (b) local storage; (c) session storage; (d) tracking pixels; (e) scripts and tags; (f) software development kits, also called SDKs; (g) device identifiers; (h) application storage; (i) link decoration and navigational tracking; (j) fingerprinting technologies; and (k) similar storage or access technologies. In this Cookie Policy, we refer to all of these as "cookies and similar technologies". Some security, audit, error, request and operational records do not necessarily store information on, or access information from, your device. Those records are explained in the Privacy Policy. Where a technology stores information on, or accesses information from, your device, this Cookie Policy applies.

Joqiva may use cookies and similar technologies to: (a) provide the Service; (b) keep you logged in; (c) authenticate users; (d) protect accounts and workspaces; (e) maintain security; (f) prevent abuse; (g) remember cookie choices; (h) remember preferences where enabled; (i) operate customer-facing pages; (j) support subscription checkout and billing where configured; (k) measure website and product performance where analytics cookies or similar technologies are used with consent, or where a lawful PECR exception applies; (l) understand how users interact with Joqiva where analytics cookies or similar technologies are used with consent, or where a lawful PECR exception applies; (m) improve the Service; and (n) comply with legal and security obligations. Joqiva does not treat advertising, remarketing, cross-site tracking, general business convenience or revenue generation as strictly necessary.

Joqiva uses a conservative cookie consent approach. Strictly necessary cookies and similar technologies are always on because they are needed to provide a service you request, transmit communications, authenticate users, secure accounts, prevent fraud or abuse, remember cookie choices, or otherwise operate essential parts of the Service. Non-essential cookies and similar technologies that store information on, or access information from, your device do not run before consent unless a specific PECR exception applies and Joqiva has implemented the required transparency and objection controls. Where consent is required, Joqiva will collect consent that is freely given, specific, informed and given through a clear positive action. This means that, unless an applicable legal exception clearly applies, we ask for consent before using: (a) functional or preference technologies that are not strictly necessary and do not fall within the appearance exception; (b) analytics or performance technologies; (c) marketing or advertising technologies; (d) non-essential third-party tracking technologies; and (e) non-essential SDK or device identifier features. If Joqiva later relies on the statistical purposes exception or the appearance exception instead of consent, Joqiva will provide clear and comprehensive information and a simple way to object free of charge. We do not use pre-ticked boxes for non-essential categories. We do not use silence, inactivity, continued browsing, or acceptance of Terms of Service as consent for non-essential cookies. Our cookie banner and settings are designed to allow you to: (a) accept optional cookies and analytics storage; (b) reject optional cookies and analytics storage; (c) manage settings; (d) choose available categories separately; (e) save your preferences; and (f) change, object to, or withdraw your choices later. Where non-essential cookies or similar technologies require consent, the consent mechanism should make "Accept", "Reject" and "Manage settings" choices clear and similarly accessible. Joqiva will not treat continued browsing, closing a banner without choosing, accepting Terms of Service, or using the Service as consent to non-essential cookies.

5.1 Strictly necessary cookies and similar technologies These are needed for Joqiva to work properly. They may be used for: (a) login and authentication; (b) session management; (c) workspace access; (d) account security; (e) fraud and abuse prevention; (f) request security and similar security controls; (g) load balancing; (h) customer-facing page access; (i) remembering your cookie consent choice; (j) maintaining checkout or subscription billing security where a billing provider is used; and (k) other functions necessary to provide the Service you request. Strictly necessary cookies and similar technologies are always active. You cannot switch these off through Joqiva Cookie Settings, because the Service may not work correctly without them. You may be able to block some of them through your browser or device settings, but doing so may stop Joqiva from working properly. 5.2 Functional and preference cookies These help Joqiva remember choices and improve usability. They may be used for: (a) language preferences; (b) display preferences; (c) interface preferences; (d) workspace-related preferences; (e) recently used settings; (f) timezone or regional display preferences; (g) accessibility preferences; and (h) other user preferences. Joqiva treats optional persistent functional and preference cookies as non-essential unless they are strictly necessary for a feature you request or fall within an applicable PECR exception. If Joqiva relies on the appearance exception for a functional or preference technology, Joqiva will provide clear information and a simple way to object. 5.3 Analytics and performance cookies These help us understand how Joqiva is used and how it performs. They may be used for: (a) page visits; (b) traffic sources; (c) feature usage; (d) performance measurement; (e) error trends; (f) signup flow measurement; (g) aggregate statistics; (h) product improvement; and (i) service reliability analysis. Joqiva does not use analytics or performance cookies or analytics browser storage before consent unless Joqiva clearly states that it relies on a lawful PECR exception and provides the required information and objection control. Where analytics cookies, browser storage, pixels, scripts, tags, device identifiers or similar technologies require consent, they will not run before valid consent is given. Where Joqiva uses limited analytics that do not store information on, or access information from, your device, those records may be explained in the Privacy Policy rather than this Cookie Policy. If Joqiva relies on the statistical purposes exception, Joqiva will use the technology only for statistical information about how the Service or website is used with a view to improving it, will provide clear information, and will provide a simple way to object free of charge. Joqiva does not intentionally use analytics providers to process customer quote content, invoice content, payment proof content, bank details, payment instructions, AI raw input or output, email bodies, customer names, customer email addresses, customer phone numbers, credentials, secrets or full URLs containing access information. The current PostHog integration does not use autocapture, session replay, heatmaps, personal profiles, automatic page views, performance capture or automatic exception capture. Joqiva also uses internal product analytics based on service activity and usage counters. Where product analytics uses cookies or similar technologies, this Cookie Policy applies. 5.4 Marketing, advertising and affiliate attribution cookies These technologies are not currently used by Joqiva. Joqiva accepts applications from potential partners and reviews them manually. This application review does not use referral tracking or affiliate attribution storage. They may be used for: (a) advertising measurement; (b) campaign performance; (c) remarketing; (d) social media advertising; (e) conversion tracking; (f) affiliate attribution; (g) marketing attribution; and (h) understanding engagement with Joqiva marketing. Joqiva does not currently run referral tracking, affiliate attribution, conversion tracking, advertising, remarketing or social-media tracking technologies. Active referral tracking, a commission ledger and a payout programme have not been launched. No external affiliate network is used or receives data. Before Joqiva launches any first-party affiliate attribution storage, it will update this Cookie Policy and Cookie Settings, document the exact key, purpose, duration and withdrawal behaviour, and request a fresh consent choice where required. Disabling the dormant integration does not require a fresh consent choice because no additional processing is introduced. 5.5 Security and fraud prevention technologies Some security and fraud prevention technologies are strictly necessary and always active. These may include technologies used for: (a) login protection; (b) session security; (c) suspicious activity detection; (d) abuse prevention; (e) request security; (f) audit logging where device storage or access is required; and (g) service integrity. Where a security technology is necessary to provide or protect the Service requested by the user, it is treated as strictly necessary. If Joqiva uses a security or fraud prevention technology that is not strictly necessary, Joqiva will treat it as non-essential unless another applicable legal exception clearly applies. 5.6 Email delivery information and tracking Joqiva processes the delivery information needed to operate email communications, such as delivery attempts, provider acceptance, failures and bounces, as described in the Privacy Policy. This is separate from using technologies to observe a recipient opening an email or following a link. Whether an email is marketing depends on what it communicates and why it is sent. A message limited to administering an existing enquiry, booking, contract, invoice or genuine safety matter may be non-marketing. A Next Service Due email inviting a recipient to enquire about or buy future servicing is treated as marketing. Neither the word “reminder”, a previous customer relationship nor manual sending determines the classification on its own. The Next Service Due feature does not enable open tracking, click tracking, advertising pixels or tracking redirects. Its customer-facing enquiry and unsubscribe pages do not run advertising or non-essential analytics. Necessary technical processing used to deliver a requested page, protect access, record an enquiry or honour a refusal is handled separately. Before introducing email tracking or non-essential technologies for this workflow, Joqiva will assess the applicable electronic communications and data protection rules and implement any required information and consent controls. Permission to receive a reminder is not automatically permission for tracking.

6.1 Marketing site On Joqiva marketing websites and public pages, we may use cookies and similar technologies for site operation, security, cookie consent, preferences and analytics where consent has been given or where a lawful PECR exception applies. Referral tracking, affiliate attribution storage, advertising, remarketing and social-media tracking technologies are not currently active. The Affiliate attribution category in Cookie Settings is unavailable and cannot be accepted. Non-essential analytics technologies do not run before consent unless a lawful PECR exception applies and the required information and objection controls are provided. 6.2 Web application In the Joqiva web application, we may use cookies and similar technologies for login, authentication, workspace access, security, session management, preferences, product operation, support of paid subscription features, and analytics where consent has been given or where a lawful PECR exception applies. Strictly necessary authentication and security technologies are always active. 6.3 Documented interfaces Documented interfaces may use security and account-access controls. Where any technology stores information on, or accesses information from, a user's device, this Cookie Policy applies. 6.4 Customer-facing quote and invoice pages Customer-facing quote and invoice pages may use strictly necessary technologies to display the page, protect access, maintain security, record quote acceptance, record quote decline, record quote questions, record document download requests, record "I've paid" interactions, process uploaded files where enabled, and support audit history. Joqiva does not use marketing or advertising cookies on customer-facing quote and invoice pages by default. Joqiva should avoid non-essential analytics cookies or similar tracking technologies on customer-facing quote and invoice pages unless a clear consent mechanism or applicable PECR exception is implemented for End Customers. If Joqiva later adds non-essential analytics, marketing or tracking technologies to customer-facing pages, Joqiva will provide the relevant information and controls before those technologies run, unless a specific PECR exception applies and the required information and objection controls are provided.

Joqiva's AI-assisted features do not set approved AI provider cookies directly on your device for AI-assisted processing. AI-assisted processing is handled through Joqiva systems and approved service providers where the feature is enabled. AI-assisted processing is explained in our AI Processing Notice.

Joqiva uses Paddle as merchant of record for Joqiva subscription fees. Subscription billing is for Joqiva subscription fees only. It is separate from End Customer invoice payments. Billing providers are not used for customer invoice bank-transfer payment tracking. Joqiva does not process, collect, hold, transfer, settle or control payments owed by End Customers to Joqiva customers. Paddle may use cookies or similar technologies during checkout, payment method collection, billing authentication, fraud prevention, payment confirmation or subscription management. Where those technologies are necessary to complete subscription checkout or protect billing security, they may be treated as strictly necessary. Where Paddle uses its own cookies or similar technologies on its hosted checkout, overlay or customer portal, Paddle's Cookie Notice and Privacy Policy also apply. The exact Paddle browser-storage status, provider links and activation point are listed in section 10.7 below.

Some cookies and similar technologies may be set by third-party providers that support Joqiva service categories. These may include providers for: (a) subscription checkout and billing; (b) analytics where consent has been given or a lawful PECR exception applies; (c) security where necessary; (d) customer support where configured; and (e) embedded third-party features where configured. We configure third-party technologies so that non-essential cookies and tracking do not run before consent unless a lawful PECR exception applies. Third-party providers may process information under their own terms and privacy policies where they act independently. The current browser providers are Supabase for authentication, Apple, Google and Microsoft for authentication only where the corresponding sign-in option is enabled and the user chooses it, PostHog Cloud EU for consent-based analytics, Cloudflare Turnstile for protected-form security, and Paddle for requested subscription checkout or billing management. Joqiva does not use an external affiliate network and no external affiliate network receives browser data. Approved subprocessors and relevant provider information are listed at Subprocessors page where applicable.

This inventory reflects the production web implementation reviewed on 14 October 2026. A name containing angle brackets describes the exact generated-name rule; the value inside the brackets changes by deployment, workspace or record. Joqiva will update this inventory when a browser technology, provider, purpose or duration materially changes. 10.1 Consent records — strictly necessary Name / key: joqiva_cookie_consent_v1. Provider: Joqiva. Type and surface: first-party cookie on Joqiva websites and the web app; Domain=joqiva.co.uk on joqiva.co.uk, www.joqiva.co.uk and app.joqiva.co.uk, and host-only on staging, preview and local hosts; Path=/; SameSite=Lax; Secure on HTTPS. Purpose and category: stores accepted, rejected or customised categories and policy/mechanism/model versions; strictly necessary. Duration: 730 days from the latest saved choice. Runs before consent: yes. Withdrawal / deletion: withdrawal overwrites it with all optional categories set to false because the refusal itself must be remembered. It is deleted when the 730-day record expires or the consent model becomes stale, and can also be deleted through browser site-data controls. Name / key: joqiva.cookieConsent.v1. Provider: Joqiva. Type and surface: localStorage on each Joqiva origin that displays Cookie Settings. Purpose and category: origin-local copy of the same consent preference; strictly necessary. Duration: a maximum logical lifetime of 730 days, enforced from updatedAt even though localStorage has no native expiry. Runs before consent: yes. Withdrawal / deletion: overwritten with rejected optional categories on withdrawal; removed automatically when stale and removable through browser site-data controls. Name / key: joqiva.cookieConsentId.v1. Provider: Joqiva. Type and surface: localStorage on the Joqiva origin where a consent event is recorded. Purpose and category: random pseudonymous identifier used to associate consent, rejection and withdrawal events without using an account identifier; strictly necessary consent evidence. Duration: no longer than the current 730-day browser consent cycle. Runs before consent: created only when the visitor makes a consent choice, including rejection. Withdrawal / deletion: retained with the rejected choice so Joqiva can evidence the withdrawal; removed when the consent record expires or becomes stale, or when browser site data is cleared. 10.2 Authentication, app state and service operation — strictly necessary Name / key: sb-<Supabase-project-reference>-auth-token and, when the value is chunked, sb-<Supabase-project-reference>-auth-token.0, .1 and subsequent numbered chunks; temporary PKCE material uses sb-<Supabase-project-reference>-auth-token-code-verifier with the same chunking rule where needed. Provider: Supabase, Inc. through Supabase Auth and the @supabase/ssr client used by Joqiva. Type and surface: first-party cookies on the current Joqiva authentication/web-app host; Path=/; SameSite=Lax; not HttpOnly because the browser auth client must refresh the session. Purpose and category: login session, refresh-token rotation and PKCE authentication; strictly necessary. Duration: the installed @supabase/ssr cookie configuration sets a browser Max-Age of 400 days. Temporary code-verifier storage is normally removed as soon as the PKCE exchange or cleanup completes. The browser limit does not extend the server-side session: access-token expiry, refresh-token rotation, revocation and session validity remain controlled by Supabase Auth. See https://supabase.com/docs/guides/auth/server-side. Runs before consent: yes, when a user starts or continues an authentication flow. Withdrawal / deletion: unaffected by optional-cookie withdrawal. Cleared by sign-out, recovery-session cleanup, session revocation or browser site-data controls. Name / key: joqiva.activeWorkspaceId. Provider: Joqiva. Type and surface: localStorage in the Joqiva web app. Purpose and category: remembers the authenticated user's active workspace; strictly necessary app state. Duration: until another workspace is selected, logout/session cleanup occurs, or site data is cleared; no separate time-based expiry. Runs before consent: yes, for authenticated app operation. Withdrawal / deletion: unaffected by optional-cookie withdrawal; cleared by Joqiva on logout or invalid session and removable through browser controls. Name / key: joqiva.sessionBootstrap.v1. Provider: Joqiva. Type and surface: localStorage in the Joqiva web app. Purpose and category: short-lived cache of the authenticated session summary and current workspace to avoid incorrect app state while the authoritative server check completes; strictly necessary app operation. Duration: 24 hours, then Joqiva rejects and removes it; also cleared on logout or invalid session. Runs before consent: yes, in the authenticated app. Withdrawal / deletion: unaffected by optional-cookie withdrawal; cleared by expiry, session cleanup or browser controls. Name / key: joqiva.demoConversation.autoplayed.v1. Provider: Joqiva. Type and surface: localStorage on each Joqiva web origin with the public example call player. Purpose and category: records only whether the example call has already started in this browser, so it does not start automatically again after navigation or reopening the browser; strictly necessary for the one-time audio behaviour. It does not contain an account or customer identifier. Duration: until browser site data is cleared; no separate time-based expiry. Runs before consent: yes, when the example first starts automatically for a visitor or is started manually. Signed-in users can start the example manually, but it does not start automatically for them. Withdrawal / deletion: unaffected by optional-cookie withdrawal; removable through browser site-data controls. If browser storage is unavailable, automatic playback is disabled. Name / key: joqiva.appleAuth.v1; joqiva.googleAuth.v1; joqiva.microsoftAuth.v1; joqiva.pendingSignup.v1; joqiva.pendingQuoteFollowupDecision.v1; job-local-draft:<workspace-id>:<job-id>. Provider: Joqiva. Type and surface: sessionStorage in the signup and authenticated app surfaces. Purpose and category: respectively restores the selected Apple, Google or Microsoft login or signup flow after the provider redirect, carries the user-requested signup state through authentication, remembers an unresolved quote follow-up decision, and preserves an unsent job-message draft in the tab if message access is lost; strictly necessary transient workflow state. Duration: Apple, Google and Microsoft authentication states expire after 20 minutes and are removed when their callback completes or fails. The other entries last for the current browser tab session, with earlier removal when signup completes, a follow-up decision is made, or the relevant workflow clears the value. Runs before consent: yes, but only after the user starts the relevant workflow. Withdrawal / deletion: unaffected by optional-cookie withdrawal; cleared by the relevant workflow, closing the tab or browser site-data controls. Name / key: joqiva-pwa-v3. Provider: Joqiva through the browser Service Worker and Cache Storage APIs. Type and surface: Cache Storage on production Joqiva web origins. Purpose and category: caches the offline page, Joqiva logo and public static assets; authenticated workspace, quote, invoice, customer and admin routes are expressly excluded; strictly necessary service delivery/offline resilience. Duration: until replaced by a later joqiva-pwa-* cache version, the service worker is unregistered, or site data is cleared; no fixed time expiry. Runs before consent: yes, on production web pages. Withdrawal / deletion: unaffected by optional-cookie withdrawal; old Joqiva PWA cache versions are deleted on service-worker activation, and all versions can be removed through browser site-data controls. 10.3 Security technologies — strictly necessary Name / key: joqiva_password_recovery_pending. Provider: Joqiva. Type and surface: first-party cookie on password-recovery routes; Path=/; SameSite=Lax; Secure on HTTPS. Purpose and category: marks a password-recovery session so stale recovery credentials can be cleaned before another reset request; strictly necessary security. Duration: 1 hour. Runs before consent: yes, only during password recovery. Withdrawal / deletion: unaffected by optional-cookie withdrawal; explicitly expired after recovery cleanup and removable through browser controls. Name / key: joqiva_password_reset_next_request_at. Provider: Joqiva. Type and surface: localStorage on the forgot-password page. Purpose and category: enforces a browser-side reset-request cooldown in addition to server controls; strictly necessary abuse prevention. Duration: 60 seconds, then removed. Runs before consent: yes, after a reset request. Withdrawal / deletion: unaffected by optional-cookie withdrawal; removed when the cooldown ends or site data is cleared. Name / key: joqiva_prod_access by default; APP_ACCESS_GATE_COOKIE_NAME may replace the name only if Joqiva operates the configured closed production access gate. Provider: Joqiva. Type and surface: first-party HttpOnly cookie on the configured production domain; Path=/; SameSite=Lax; Secure. Purpose and category: proves successful access-gate verification when that gate is enabled; strictly necessary security. Duration: 30 days. Runs before consent: yes, only when the closed access gate is configured and the correct access token is submitted. Withdrawal / deletion: unaffected by optional-cookie withdrawal; expires after 30 days and can be removed through browser site-data controls. Name / key: no Joqiva-defined cookie or storage key for the default Turnstile widget; the widget returns a one-time in-memory token. If Cloudflare pre-clearance is separately enabled, Cloudflare may issue cf_clearance. Provider: Cloudflare, Inc. through Cloudflare Turnstile. Type and surface: security script and iframe loaded from challenges.cloudflare.com only when a protected form is submitted; a conditional cf_clearance first-party security cookie is possible only under Cloudflare pre-clearance/zone configuration. Purpose and category: bot and abuse prevention for protected forms; strictly necessary security. Duration: the one-time Turnstile token is not persisted by Joqiva and is consumed or expires with the challenge. A conditional cf_clearance duration is the Cloudflare zone's configured Challenge Passage period. See https://developers.cloudflare.com/turnstile/ and https://developers.cloudflare.com/cloudflare-challenges/concepts/clearance/. Runs before consent: yes, when the user submits a protected form. Withdrawal / deletion: unaffected by optional-cookie withdrawal; the widget is removed when its component unmounts or resets. A conditional Cloudflare clearance cookie can be removed through browser site-data controls. 10.4 Functional / preference storage — optional Name / key: joqiva.customers.view. Provider: Joqiva. Type and surface: localStorage in the Customers area of the web app. Purpose and category: remembers list or card view; functional / preferences. Duration: until changed, functional consent is withdrawn, or site data is cleared; no separate time-based expiry. Runs before consent: no. Withdrawal / deletion: Joqiva removes it immediately when Functional / preferences is rejected or withdrawn. Name / key: joqiva.enquiries.pasteExampleGuideDismissed. Provider: Joqiva. Type and surface: localStorage in the manual enquiry-paste form. Purpose and category: remembers that the example guide was dismissed; functional / preferences. Duration: until functional consent is withdrawn or site data is cleared; no separate time-based expiry. Runs before consent: no. Withdrawal / deletion: Joqiva removes it immediately when Functional / preferences is rejected or withdrawn. Name / key: joqiva-us-waitlist-emails. Provider: Joqiva. Type and surface: localStorage on the US waitlist page. Purpose and category: remembers normalised email addresses entered through that browser so the page can show a duplicate-submission state; functional / preferences. In the reviewed client implementation this key is local-only and is not itself evidence that a server-side waitlist record was created. Duration: until functional consent is withdrawn or site data is cleared; no separate time-based expiry. Runs before consent: no; without functional consent, waitlist submission still works but the browser does not remember the address. Withdrawal / deletion: Joqiva removes it immediately when Functional / preferences is rejected or withdrawn. 10.5 Analytics storage Name / key: ph_<PostHog-public-project-token>_posthog in localStorage and a cookie with the same generated name; PostHog may also create SDK-version-related ph_*, phc_* or posthog* keys within the same configured persistence. Provider: PostHog, Inc., using PostHog Cloud EU through Joqiva's first-party ingestion endpoint at e.joqiva.co.uk; the PostHog EU interface is at eu.posthog.com. Type and surface: localStorage plus first-party cookie on Joqiva marketing, legal, auth, customer and web-app surfaces where the Joqiva route tracker is enabled. PostHog's cross-subdomain cookie setting may place the cookie on the top-level joqiva.co.uk domain. Purpose and category: personless, sanitised page and product events; analytics. Personless means that no PostHog personal profile is created; persistent events are pseudonymous rather than anonymous because they may contain PostHog distinct, browser-device, session and window identifiers. Autocapture, session replay, heatmaps, surveys, automatic page views, performance capture and automatic exception capture are disabled. Customer-document content is excluded by the event and property allowlist. Duration: PostHog's configured/default cookie duration is 365 days; localStorage entries have no browser-native expiry but are removed on rejection/withdrawal. See https://posthog.com/docs/libraries/js/config. Runs before analytics consent: no persistent analytics storage runs before consent. When analytics is rejected, Joqiva may send only configured personless cookieless events. Those events use no cookies, localStorage or sessionStorage and create no persistent browser identifier, but PostHog may derive a privacy-preserving server-side hash and process limited request metadata; they are not described as fully anonymous. Withdrawal / deletion: PostHog is opted out and Joqiva immediately removes matching analytics cookies from both the host and joqiva.co.uk parent domain and removes matching analytics keys from localStorage and sessionStorage. Name / key: __ph_opt_in_out_<PostHog-public-project-token>. Provider: PostHog, Inc. under Joqiva's consent configuration. Type and surface: localStorage on the current Joqiva origin. Purpose and category: stores PostHog's granted/denied persistence status so the SDK respects the Joqiva choice; strictly necessary consent state, not analytics content. Duration: until the analytics choice is changed or browser site data is cleared; PostHog's localStorage consent marker has no automatic time-based expiry, while Joqiva asks for a fresh choice when its own 730-day consent record expires. Runs before consent: created when Joqiva applies the visitor's accepted or rejected analytics choice. Withdrawal / deletion: updated to the denied state on withdrawal and retained to enforce that choice; browser site-data controls remove it. 10.6 Affiliate attribution storage — not currently used Name / key: no active affiliate-attribution cookie, localStorage key or sessionStorage key. Provider: none. Joqiva does not use an external affiliate network and no external affiliate network receives data. Type and surface: none on marketing, authentication, signup or checkout surfaces. Purpose and category: referral tracking and affiliate attribution are not currently active; the category is unavailable in Cookie Settings. Duration: not applicable. Runs before consent: no. Runs after consent: no; there is no available affiliate-attribution consent category to enable. Withdrawal / deletion: Joqiva removes any legacy dormant affiliate-attribution sessionStorage entry when consent state is applied or optional consent is rejected. The entry is not recreated or consumed by signup, checkout or billing. Joqiva does not currently use advertising, remarketing, social-media tracking or an external affiliate-network browser cookie. 10.7 Paddle subscription checkout Name / key: no stable Joqiva-defined Paddle cookie, localStorage or sessionStorage key. Paddle.js and Paddle's hosted checkout frames control their own necessary checkout/security storage and may change the individual provider-controlled names. Provider: Paddle.com Market Limited and the applicable Paddle entities acting as merchant of record for Joqiva subscription payments. Type and surface: Paddle.js loaded from cdn.paddle.com and Paddle-hosted overlay/checkout or customer-portal surfaces, only after an authorised user explicitly starts subscription checkout or opens billing management. Purpose and category: subscription checkout, payment-method collection, transaction security, fraud prevention, confirmation and subscription management; strictly necessary for the requested billing action. This is separate from End Customer invoice payments. Duration: set by the exact Paddle checkout technology in use. Paddle's current provider-controlled names, purposes and durations are maintained in Paddle's Cookie Notice at https://www.iubenda.com/privacy-policy/83216669/cookie-policy, linked from https://www.paddle.com/legal/privacy. Runs before Joqiva optional consent: yes, but only after the user explicitly requests checkout or billing management; Paddle is not loaded on ordinary page view. Withdrawal / deletion: Joqiva optional-cookie withdrawal does not delete storage that Paddle independently requires for an active or completed transaction. Close the checkout and use browser controls or Paddle's Cookie Preferences/privacy request route to remove provider-controlled optional storage where available. 10.8 Disabled technologies Email open pixels and click tracking are disabled by default. Joqiva does not currently run advertising, remarketing or social-media tracking browser technologies. Limited cookieless PostHog analytics, server security logs, consent evidence, audit records and operational records that do not store information on or access information from the device are not browser storage; their processing and retention are described in the Privacy Policy.

We may keep records of cookie consent, refusal, objection and preference choices so that we can demonstrate and respect your preferences. These records may include: (a) consent status; (b) objection status where applicable; (c) selected categories; (d) timestamp; (e) policy version; (f) consent mechanism version; (g) device or browser identifier; (h) approximate technical metadata; and (i) whether the choice was accepted, rejected, customised, objected to or withdrawn. We may retain cookie consent and objection records for up to 24 months, unless a longer period is required for legal, compliance, dispute or security reasons. We will not repeatedly ask you to consent after you have rejected optional cookies or analytics storage simply because we prefer a different answer. We may ask you to make a new choice where the law, the technology, the purposes, the provider list, or the consent record retention period reasonably requires it.

You can change, withdraw or object to your cookie choices at any time through Cookie Settings where available. Cookie Settings may be available: (a) in the website footer; (b) in app settings; (c) in account settings; or (d) through another clearly labelled Cookie Settings link. When you withdraw consent, Joqiva will stop using consent-based non-essential cookies and similar technologies for the relevant categories and will immediately perform the following browser cleanup where the browser permits it: (a) Functional / preferences withdrawal removes joqiva.customers.view, joqiva.enquiries.pasteExampleGuideDismissed and joqiva-us-waitlist-emails from localStorage; (b) Analytics withdrawal opts PostHog out, removes ph_*, phc_* and posthog* analytics keys from localStorage and sessionStorage, and expires matching PostHog cookies on both the current host and the joqiva.co.uk parent domain; and (c) Applying or rejecting optional consent removes any legacy dormant affiliate-attribution entry from sessionStorage; active referral tracking does not recreate it. The Joqiva consent cookie and localStorage preference are updated to record the rejected categories. The pseudonymous consent ID and PostHog denial marker remain only to evidence and enforce the rejection; they are not used for analytics or attribution. Withdrawing or rejecting analytics cookies or similar storage stops Joqiva from using consent-based analytics cookies or storage for analytics measurement. It does not necessarily stop strictly necessary processing, security processing, or limited analytics or operational measurement that does not require consent under applicable law. Some strictly necessary technologies may continue because they are needed to provide, secure or operate the Service. Where Joqiva relies on the statistical purposes exception or appearance exception instead of consent, objecting will stop the relevant storage or access unless another lawful basis or strictly necessary purpose applies. Withdrawing consent or objecting does not affect the lawfulness of any use before withdrawal or objection.

You may also control cookies through your browser or device settings. Most browsers allow you to: (a) block cookies; (b) delete cookies; (c) receive warnings before cookies are stored; or (d) limit certain tracking technologies. Mobile devices may also provide settings for app permissions, advertising identifiers, notifications, location, diagnostics and similar features. If you block strictly necessary cookies or similar technologies, Joqiva may not work correctly. Joqiva does not rely only on browser or device settings as consent for non-essential cookies unless Joqiva can demonstrate that the setting clearly satisfies the legal requirements for consent in the relevant context.

Customer-facing quote and invoice pages may be used by End Customers who do not have a Joqiva account. These pages may use strictly necessary technologies to: (a) display the quote or invoice page; (b) protect access to the page; (c) prevent abuse; (d) support document download; (e) record quote view, acceptance, decline or question events; (f) record invoice view or payment report events; (g) support payment proof upload where enabled; and (h) support audit and security history. Joqiva does not use marketing or advertising cookies on customer-facing quote and invoice pages by default. Joqiva should avoid non-essential analytics cookies or similar tracking technologies on customer-facing quote and invoice pages unless a clear consent mechanism or applicable PECR exception is implemented for End Customers. If Joqiva later adds non-essential analytics, marketing or tracking technologies to customer-facing pages, Joqiva will provide the relevant information and controls before those technologies run, unless a specific PECR exception applies and the required information and objection controls are provided.

Joqiva websites or communications may link to third-party websites, social media pages or provider-hosted pages. This Cookie Policy does not control cookies or similar technologies used by third-party websites or services after you leave Joqiva-controlled pages. If Joqiva embeds a third-party feature, plugin, pixel, tag, SDK or similar technology on a Joqiva-controlled page, Joqiva will assess whether consent, an objection mechanism, or another legal requirement applies before enabling it. Joqiva will not enable non-essential third-party storage or access technologies before consent unless a lawful PECR exception applies. If you visit a social media platform, payment provider page or another third-party website, that third party's own cookie policy and privacy policy may apply.

We may update this Cookie Policy from time to time. We may update it when: (a) we add or remove cookies or similar technologies; (b) we change providers; (c) we change cookie categories; (d) we change consent or objection settings; (e) we change retention periods; (f) legal requirements change; or (g) we improve the Service. If we make material changes to our use of non-essential cookies or similar technologies, we will ask you to make a new consent choice where required by law. If we introduce a new storage or access technology for a different purpose from the purpose you originally accepted, we will request fresh consent where required or provide the required objection control where an exception applies.

For questions about this Cookie Policy or Joqiva's use of cookies and similar technologies, use the contact details maintained in the Legal Notice. The current privacy contact and legal contact are listed in the Legal Notice.