Cookie Policy
Last updated: October 2026
This page explains what cookies VATBuild uses and why. We are committed to transparency about essential cookies and optional public-website analytics.
What is a cookie?
A cookie is a small piece of data stored in your browser when you visit a website. Cookies allow websites to remember information about your visit, such as whether you are logged in.
Cookies we use
Essential login and security cookies work whether you accept or reject optional analytics. When configured, Google Analytics 4 (GA4) is loaded only after you choose “Accept analytics”. No Google tag, analytics cookies, or cookieless analytics requests are used before opt-in. We do not use advertising or remarketing.
| Name | Type | Purpose | Expires |
|---|---|---|---|
| connect.sid | Session (HTTP cookie) | Keeps you logged in after authentication. Strictly necessary for the service to function. | 30 days, or on sign-out |
| csrfToken | Essential security cookie | Protects account actions against forged requests. | 30 days |
| vatbuild.analyticsConsent.v1 | localStorage (not a cookie) | Remembers your accepted or rejected analytics choice. The old cookieConsent acknowledgement does not grant analytics consent. | Persistent (until browser data is cleared) |
| _ga, _ga_* | Optional GA4 first-party cookies | Distinguish public-website visits and sessions after opt-in. | Up to 2 years; removed on withdrawal |
Third-party cookies
Optional GA4 from Google measures public page visits and fixed-label pricing and signup clicks. A signup click is not a completed registration or payment. Private application, admin, login, OAuth, password-reset and shared-report screens are excluded, as are signed-in visits. We never send form input, email addresses, account or organisation IDs, project or invoice data, uploaded content, financial amounts, tokens, query strings or URL fragments. Only approved public paths are sent; referrers are omitted.
Managing cookies
Use “Cookie preferences” at any time to accept or reject analytics. Rejection or withdrawal stops collection, discards pending events, and removes applicable first-party GA cookies without deleting your login or security cookies. Withdrawing consent does not delete information already sent to Google. If browser storage is unavailable, analytics stays off. Your choice is stored until you change it or clear browser storage.
You can delete cookies at any time via your browser settings. Deleting the session cookie will sign you out of VATBuild.
For general information about managing cookies, visit allaboutcookies.org.
More information
For more information about how we handle your personal data, see our Privacy Policy. For questions, email privacy@vatbuild.com.