18:30Legal
Cookie Policy
Effective: 1 September 2026
Last updated: 1 September 2026
This page lists every cookie StaffVertex uses, what each one is for, and how to change your mind. It sits alongside our Privacy Policy, which covers personal information more broadly.
The summary: we use a small number of cookies to keep you signed in and to stop abuse, one optional set that counts visits to our marketing pages, and a few from Google and Meta that measure whether our ads lead to sign-ups and downloads.
2. Essential Cookies
These make the service work. They are always on, because without them you could not sign in, pay, or reach us. There is nothing to consent to and nothing to switch off short of leaving.
| Cookie | Set by | What it does | How long |
|---|---|---|---|
next-auth.session-token | StaffVertex | Keeps you signed in. Without it you would have to enter your password on every page. | Until you sign out or it expires |
next-auth.csrf-token | StaffVertex | Protects sign-in and form submissions against a forged request from another site. | Session |
next-auth.callback-url | StaffVertex | Remembers which page to return you to after you sign in. | Session |
Stripe cookies | Stripe | Set only while you are on a checkout or billing page, to process the payment and detect fraud. | Set by Stripe |
reCAPTCHA cookies | Set on our sign-up, sign-in and contact forms to tell a person from an automated script. | Set by Google | |
tawk.to cookies | tawk.to | Set by the chat window on our public site and help centre, so a conversation survives a page change. | Set by tawk.to |
On our live site the three StaffVertex cookies carry a __Secure- prefix, which tells your browser never to send them over an unencrypted connection.
3. Optional Cookies
We use one analytics tool, and only on our public marketing pages. It is switched off until you press Accept on the cookie banner. If you press Decline, or simply ignore the banner, nothing is set and nothing is measured.
| Cookie | Set by | What it does | How long |
|---|---|---|---|
PostHog cookies | PostHog | Counts visits and page views on our public marketing pages so we can see which pages are useful. Not used inside the signed-in application. | Up to 1 year |
What we get from it is aggregate: how many people visited a page, roughly where in the world they were, what brought them here, and what kind of device they used. We do not use it to build a profile of you, and it never runs inside the signed-in application.
Ad measurement
On our public pages and our sign-up and sign-in pages, Google and Meta set the cookies below so we can see which ads lead to new accounts and desktop app downloads. These are not controlled by the cookie banner. They never run inside the signed-in application.
| Cookie | Set by | What it does | How long |
|---|---|---|---|
_ga, _ga_* | Google Analytics | Counts visits, page views, sign-ups and desktop app downloads on our public pages and sign-up and sign-in pages, so we can see which pages and campaigns work. | Up to 2 years |
_gcl_au | Google Ads | Tells us when someone who clicked one of our Google ads went on to create an account or download the desktop app. | 90 days |
_fbp | Meta | Tells us when someone who saw one of our Meta ads visited the site or created an account. | 90 days |
You can opt out of Google's measurement with the Google Analytics opt-out add-on and manage ad personalisation in Google's ad settings, or block these cookies in your browser.
4. Things Stored on Your Device
The app keeps a few small preferences in your browser's local storage rather than in cookies. These never travel to our servers. They exist so the interface behaves the way you left it.
sv_analytics_consent: whether you accepted or declined the cookie banner. We store your choice locally so we do not have to set a cookie just to remember that you refused one.themestores whether you chose the light or dark appearance.sidebarCollapsed: whether you keep the sidebar open or closed.
Our desktop app stores your work locally too, in an encrypted database on your own computer, so that tracking keeps working when you are offline. Your sign-in token is held in your operating system's keychain. That is described in the Privacy Policy.
5. What We Do Not Do
- No selling of your browsing behaviour.
- No analytics inside the signed-in application.
- No tracking of whether you opened one of our emails or clicked inside it.
6. Your Choices
The banner. The first time you visit our public site you are asked to accept or decline optional analytics cookies. None of them is set before you answer. The ad measurement cookies in section 3 are not covered by the banner.
Changing your mind. Clear this site's cookies and site data in your browser settings. The banner will appear again on your next visit and you can answer differently. Note that this also signs you out of StaffVertex, because it removes the sign-in cookie along with everything else.
Blocking cookies entirely. Every browser lets you block or delete cookies, usually under Privacy or Site settings. Blocking the essential ones will stop you signing in.
Do Not Track. Browsers send this signal inconsistently and there is no agreed standard for honouring it, so we do not rely on it. Our banner is the reliable control for analytics, and your browser settings for everything else.
If you would rather ask us directly, write to privacy@staffvertex.com.
7. Changes to This Policy
If we add or remove a cookie, we update this page. The date at the top shows the current version.
8. Contact Us
Questions about cookies or anything else on this page: