Cookie Policy

Which cookies QLAC uses, why they are used, and how you can accept, reject, or change preferences.

Published legal information for QLAC Audit.

Last updated: 2026-05-11

1. What cookies are

Cookies and similar technologies store information in the browser to remember preferences, maintain sessions, protect forms, measure usage, or enable integrations. Some are necessary for the website and app to work; others require prior consent.

2. Categories

  • Necessary: session, authentication, security, CSRF, language, currency, and consent. These are essential for the requested service.
  • Analytics: aggregated usage measurement, page performance, and conversions. Loaded only if you accept this category.
  • Functional: additional non-essential preferences or integrations that improve the experience. Loaded only if accepted.
  • Marketing: campaigns, pixels, remarketing, or advertising. QLAC does not load these by default and requires specific consent if enabled in the future.

3. Expected first-party cookies

  • qlac_locale: remembers selected language.
  • qlac_currency: remembers selected pricing currency.
  • qlac_cookie_consent: stores your consent preferences and policy version.
  • qlac_session and XSRF-TOKEN: session, authentication, CSRF protection, and application security.

4. Third-party tools

Paddle may use cookies or equivalent technologies where checkout is necessary to complete payments. Vercel Analytics or PostHog should load only if analytics is enabled and you have accepted analytics cookies. Google Analytics, advertising pixels, heatmaps, and session replay are not loaded by default.

5. Consent management

The banner lets you accept all, reject non-essential cookies, or configure categories. You can change your choice from the cookie management link in the footer. If you withdraw consent, QLAC will stop loading new non-essential tools from that point forward.

6. Duration and updates

Your preference is retained to avoid asking on every visit. QLAC should request consent again if the policy, tools, or purposes materially change.

7. Global Privacy Control and opt-out

QLAC detects Global Privacy Control when the browser exposes the signal and publishes support at /.well-known/gpc.json. If GPC is active, QLAC forces opt-out from marketing, sale, and behavioral advertising sharing where applicable.

GPC does not enable analytics. Analytics loads only with affirmative consent, and rejecting non-essential cookies keeps analytics, non-essential functional tools, and marketing disabled.