CloviCFOCookie Policy
Effective date: July 14, 2025 Entity: Vital Webmaster LLC (operating the CloviTek platform, including CloviCFO, CloviShell, CloviLegal, CloviTrade, CloviCrypto, and related services)
1. Introduction and Scope
Vital Webmaster LLC ("Company," "we," "us," or "our") operates the CloviTek suite of products and services, including the websites and web applications available at [www.clovitek.com] and associated subdomains (collectively, the "Sites").
This Cookie Policy explains what cookies and similar tracking technologies we use on the Sites, why we use them, and how you can control them. It supplements our Privacy Policy and should be read alongside it.
This Policy applies to all visitors and users of the Sites, wherever located. For visitors accessing the Sites from the European Economic Area ("EEA"), the United Kingdom ("UK"), or Switzerland, the EU General Data Protection Regulation ("GDPR") and the ePrivacy Directive (as implemented in applicable member-state law) impose additional requirements, which are addressed specifically throughout this Policy.
2. What Are Cookies and Similar Technologies?
Cookies are small text files placed on your device (computer, tablet, or mobile) by a website when you visit it. They allow the website to recognize your device on return visits and to remember certain information about you or your preferences.
We also use similar technologies that achieve comparable functions:
- Local Storage / Session Storage: Browser-based storage mechanisms (part of the HTML5 Web Storage API) that allow a website to store key-value data directly in your browser, outside of cookies. Unlike cookies, localStorage data is not transmitted to our servers with each request; it persists until cleared. sessionStorage data is cleared when the browser tab is closed.
- Cloudflare Tokens: Security and performance tokens set or processed by Cloudflare, Inc. as part of our infrastructure layer.
For ease of reading, we use the word "cookie" throughout this Policy to refer collectively to all of the above technologies unless we distinguish them specifically.
3. Who Sets the Cookies?
Cookies on the Sites are set by:
- First-party cookies: Set directly by Vital Webmaster LLC on the Sites' domains.
- Infrastructure/security cookies: Set by Cloudflare, Inc. as part of the network-layer security and performance services we use to protect and deliver the Sites.
We do not use any third-party advertising, ad-network, or cross-site behavioral tracking cookies. We do not allow advertising partners, data brokers, or social-media platforms to set tracking cookies on our Sites.
4. Categories of Cookies We Use
We organize cookies into three categories based on their purpose. The legal treatment of each category — particularly under the GDPR and ePrivacy rules — differs, as explained in Section 5.
4.1 Category 1 — Strictly Necessary Cookies
Legal basis (GDPR/ePrivacy): These cookies are exempt from the consent requirement because they are strictly necessary to deliver the service you have explicitly requested or to enable a communication over a network. No consent is required for these cookies.
| Cookie / Technology | Type | Provider | Purpose | Duration |
|---|---|---|---|---|
cl_session |
HTTP Cookie | First-party (Vital Webmaster LLC) | Authenticates your logged-in session; allows you to remain signed in as you navigate between pages. Without this cookie, you could not use authenticated features of CloviCFO, CloviShell, or other CloviTek products. | Session (cleared on browser close) or up to [30] days if "Remember me" is selected |
app_session_id |
HTTP Cookie | First-party (Vital Webmaster LLC) | Maintains your active application session state and security context. | Session |
__cf_bm |
HTTP Cookie | Cloudflare, Inc. | Cloudflare Bot Management — distinguishes human visitors from automated bots to protect the Site from abuse and DDoS attacks. Strictly necessary for site security and availability. | 30 minutes |
cf_clearance |
HTTP Cookie | Cloudflare, Inc. | Records that you have passed a Cloudflare security challenge, preventing repeated challenges during the same browsing session. Strictly necessary for service delivery. | 30 minutes – 24 hours |
| CSRF token (form-specific) | HTTP Cookie | First-party (Vital Webmaster LLC) | Prevents cross-site request forgery attacks by validating form submissions. | Session |
4.2 Category 2 — Preference / Functionality Cookies
Legal basis (GDPR/ePrivacy): These technologies store choices you actively make (such as your display theme). Under ePrivacy rules, storing or accessing information on a user's device requires consent unless strictly necessary. We treat these as requiring consent for EEA/UK/Swiss users (see Section 5). For users in other jurisdictions, these may be set on the basis of our legitimate interest in providing a functional, personalized experience.
| Cookie / Technology | Type | Provider | Purpose | Duration |
|---|---|---|---|---|
theme_preference |
localStorage (first-party) | First-party (Vital Webmaster LLC) | Stores your selected display theme (e.g., light mode or dark mode) so that your preference is remembered between sessions. No data is transmitted to our servers. | Persistent (until you clear browser storage or revoke consent) |
4.3 Category 3 — Analytics Cookies
Legal basis (GDPR/ePrivacy): Analytics cookies are non-essential and require prior consent from EEA/UK/Swiss users before being set. We use Umami, a privacy-focused, open-source analytics platform, as our sole analytics tool.
Key privacy characteristics of Umami:
- Umami does not use cookies by default; it relies on a script that collects aggregate, anonymized metrics.
- Umami does not collect personally identifiable information, does not use cross-site tracking, and does not share data with third parties.
- Visitor data is not fingerprinted in a way that identifies individuals across sessions.
- Umami is self-hosted on our own infrastructure (EU — France, Contabo) or operated under data-processing terms that confine data to our controlled environment. No data is sent to third-party analytics vendors.
- Because Umami's standard implementation does not set persistent cookies, it may qualify as privacy-friendly analytics exempt from strict consent requirements under some national implementations of the ePrivacy Directive (e.g., French CNIL guidance on exempt analytics). However, to ensure the broadest compliance across all EEA jurisdictions, we present it as an analytics category subject to optional consent.
| Technology | Type | Provider | Purpose | Duration |
|---|---|---|---|---|
| Umami analytics script | Script / server-side session identifier (no persistent cookie by default) | Umami (self-hosted by Vital Webmaster LLC) | Collects anonymized, aggregate page-view statistics (e.g., page visited, referrer, country-level location, browser type). Used solely to understand how visitors interact with the Sites and to improve our products. No individual user is identified. | Session-based; no persistent cookie |
5. GDPR and ePrivacy — Consent Requirements for EEA, UK, and Swiss Users
5.1 Consent Requirement
Under the ePrivacy Directive (and its national implementations, such as the UK PECR) and the GDPR, non-essential cookies and similar technologies may only be placed on your device after you have given your free, specific, informed, and unambiguous consent.
This means:
- Strictly necessary cookies (Category 1, Section 4.1) are placed automatically because they are required for the Sites to function. You cannot opt out of these without affecting core site functionality.
- Preference cookies (Category 2, Section 4.2) and analytics technologies (Category 3, Section 4.3) are not placed until you have consented via our consent banner.
5.2 Consent Banner
When you first visit a Site from the EEA, UK, or Switzerland, a cookie consent banner will appear. The banner will:
- Clearly describe the categories of non-essential cookies we wish to use;
- Allow you to accept all, reject all non-essential, or manage your preferences by category;
- Not pre-tick boxes or otherwise nudge you toward accepting; and
- Allow you to proceed without accepting non-essential cookies.
Your consent choice is recorded and respected on subsequent visits.
5.3 Withdrawing Consent
You may withdraw your consent at any time, with effect from that point forward (withdrawal does not affect the lawfulness of processing that occurred prior to withdrawal). To withdraw consent:
- Cookie Preference Centre: Access our cookie preference settings by clicking the "Cookie Preferences" or "Manage Cookies" link in the footer of any page on the Sites.
- Browser controls: See Section 7 below.
- Contact us: Email us at [email protected] and we will assist you.
Withdrawing consent for non-essential cookies will not prevent you from using the Sites' core features, which rely only on strictly necessary cookies.
6. Cookies We Do NOT Use
We want to be explicit about the cookies and tracking practices we do not employ:
| We do NOT use… | Detail |
|---|---|
| Third-party advertising cookies | No ad networks, demand-side platforms, or retargeting pixels are permitted on the Sites. |
| Cross-site behavioral tracking | We do not share cookie identifiers or browsing data with third parties for the purpose of building advertising profiles. |
| Social-media tracking pixels | No Facebook Pixel, LinkedIn Insight Tag, Twitter/X Pixel, or similar tools are used. |
| Third-party analytics | We do not use Google Analytics, Hotjar, Mixpanel, or similar third-party analytics services that transmit your data to external companies. |
| Fingerprinting | We do not use device or browser fingerprinting as a substitute for cookies to track you without your knowledge. |
7. How to Manage and Disable Cookies
7.1 Our Consent Preference Centre
The primary way to control non-essential cookies is through our Cookie Preference Centre, accessible via the "Cookie Preferences" link in the footer of each Site. You can change your selections at any time.
7.2 Browser Settings
All major browsers allow you to control or delete cookies through browser settings. You can typically:
- View what cookies are stored and delete them individually or in bulk;
- Block all cookies or block cookies from specific sites;
- Configure your browser to alert you when a cookie is being set; and
- Enable "Private" or "Incognito" browsing (note: this does not block cookies set during the session, but they are deleted when you close the private window).
Browser-specific instructions:
- Google Chrome: Settings → Privacy and Security → Cookies and other site data
- Mozilla Firefox: Settings → Privacy & Security → Cookies and Site Data
- Apple Safari: Preferences → Privacy → Manage Website Data
- Microsoft Edge: Settings → Cookies and site permissions → Cookies and site data
- Opera: Settings → Advanced → Privacy & security → Site Settings → Cookies
Note: Blocking or deleting strictly necessary cookies (Category 1) will impair or prevent core functionality of the Sites, such as the ability to log in or maintain an active session.
7.3 Local Storage
Browser-stored data (such as theme_preference) is not governed by cookie-blocking controls, but can be cleared through your browser's developer tools or by clearing your browser's "site data" or "cached data." Instructions:
- Chrome/Edge: DevTools (F12) → Application tab → Local Storage → right-click domain → Clear
- Firefox: DevTools (F12) → Storage tab → Local Storage → right-click → Delete All
- Safari: Preferences → Privacy → Manage Website Data → Remove
8. International Data Transfers
Our primary application servers and databases are hosted in the European Union (France, via Contabo GmbH). However, uploaded documents and receipts are stored on Amazon Web Services S3 infrastructure located in the United States.
To the extent that any analytics or operational data associated with cookies or session identifiers is processed on or transferred to US-based infrastructure (including AWS S3), we ensure appropriate safeguards are in place, including:
- Standard Contractual Clauses (SCCs) issued by the European Commission (where applicable under GDPR Article 46(2)(c)); and/or
- Binding contractual commitments with sub-processors to process data only as instructed and subject to equivalent protections.
For further information about our international transfers, please refer to our [Privacy Policy].
9. Retention
Cookies are retained for the durations set out in the tables in Section 4. Specifically:
| Category | Retention |
|---|---|
| Strictly necessary session cookies | Deleted when you close your browser (session cookies) or at the end of the defined session window |
| Cloudflare security cookies | 30 minutes to 24 hours, as specified in Section 4.1 |
| Preference localStorage data | Persists until you clear browser storage or withdraw consent |
| Umami analytics | Session-based; no persistent cookie |
We periodically review our cookie inventory and update this Policy when cookies are added, modified, or removed.
10. Changes to This Cookie Policy
We may update this Cookie Policy from time to time to reflect changes in the cookies we use, changes in applicable law, or updates to our services. When we make material changes, we will:
- Update the Effective Date at the top of this Policy;
- Post a notice on the Sites or, where appropriate, notify you by email; and
- Where required by applicable law, obtain fresh consent for any new non-essential cookies.
We encourage you to review this Policy periodically to stay informed about how we use cookies.
11. Contact Us
If you have any questions about this Cookie Policy, wish to exercise your rights under the GDPR, or wish to withdraw your consent, please contact us:
Privacy enquiries: Email: [email protected]
Legal enquiries: Email: [email protected]
Controller identity: Vital Webmaster LLC [Registered address] [State of formation]
If you are located in the EEA and have unresolved concerns about our use of cookies or personal data, you have the right to lodge a complaint with your local supervisory authority. A list of EU data protection authorities is available at https://edpb.europa.eu/about-edpb/about-edpb/members_en.
This Cookie Policy was prepared using the CloviLegal AI-assisted drafting tool. It does not constitute legal advice. Vital Webmaster LLC recommends that qualified legal counsel review this Policy prior to publication to confirm it satisfies all applicable legal requirements in the jurisdictions where the Sites are operated.
DRAFT — NOT YET PUBLISHED. This document was generated by the CloviLegal DraftAgent engine (model claude-sonnet-4-6) on 2026-06-24 from the controlling facts supplied. AI drafting/review assistant — not legal advice. Consult a licensed attorney. It is an AI-generated starting draft and is not legal advice; have a licensed attorney review before publishing — especially the GDPR, Plaid, and international-transfer clauses.