Scope of this policy
This Cookie Policy explains how [[ENTITY]] (“VavaStone”, “we”, “us”) uses cookies and similar technologies on our website at vavastone.com and in our application at portal.vavastone.com. It forms part of, and should be read with, our Privacy Policy, which explains how we handle the personal information these technologies generate, and our Terms of Use.
What cookies and similar technologies are
A cookie is a small text file that a website asks your browser to store and to send back on later visits. A first-party cookie is set by the site you are visiting; a third-party cookie is set by another domain whose content is embedded in the page. A session cookie is deleted when you close your browser; a persistent cookie stays until it expires or you delete it.
“Similar technologies” means anything else that stores or reads data on your device or fingerprints your session, including:
- local storage and session storage — larger browser stores used to hold preferences, drafts and session state;
- IndexedDB — a structured browser database, used by the application for offline-tolerant behaviour;
- pixels and web beacons — tiny images or scripts that record that a page or email was opened;
- software development kits (SDKs) in mobile or scanning applications; and
- server-side logs, which record your IP address, request and user agent without storing anything on your device.
Where this policy says “cookies”, it means all of the above unless we say otherwise.
Why we use them
- to keep you signed in and to move you securely between pages of the application;
- to remember choices such as language, layout, dismissed notices and your cookie preferences;
- to protect the site and the application against fraud, credential abuse, automated attacks and denial-of-service;
- to understand which pages and features are used, where people get stuck, and what is broken; and
- to make live chat and demo scheduling work.
The categories we use
| Category | What it does | Consent |
|---|---|---|
| Strictly necessary | Authentication, session integrity, security, load balancing, form submission, and remembering your cookie choice. The site cannot function without these. | Not required — these are exempt |
| Functional | Remembering preferences and interface state so you do not have to set them again. | Required in the EEA/UK |
| Analytics and performance | Measuring usage, navigation paths, feature adoption, errors and performance, so we can improve the Service. | Required in the EEA/UK |
| Support and communication | Running live chat and meeting scheduling, and keeping a conversation continuous across pages. | Required in the EEA/UK for the non-essential part |
| Advertising / targeting | We do not use this category. | Not applicable |
The cookies we set
The table lists what we and our vendors currently set. Names and durations are the vendors’ documented defaults, and a vendor may change them; we review this list periodically and whenever we add or remove a vendor.
| Name / key | Set by | Category | Purpose | Duration |
|---|---|---|---|---|
| Cookie consent record | VavaStone (first party) | Strictly necessary | Stores whether you accepted or declined non-essential cookies, so the banner is not shown again. | Up to 12 months |
| Session and authentication cookies | VavaStone (first party, portal.vavastone.com) | Strictly necessary | Keeps you signed in, binds your session to your device, and protects against cross-site request forgery. | Session to 30 days, depending on “remember me” |
| Interface preferences | VavaStone (first party, local storage) | Functional | Remembers view mode, column layout, filters, dismissed notices and similar choices. | Until you clear site data |
ph_phc_…_posthog | PostHog | Analytics | Assigns a pseudonymous identifier so that repeat visits can be counted as one session, and records which pages and features were used. | 12 months |
__ph_opt_in_out_… | PostHog | Strictly necessary | Records that you opted out of analytics, so the opt-out persists. | 12 months |
crisp-client/session/… | Crisp | Support | Identifies your chat session so a conversation continues across pages and visits, and so you can read replies. | Session to 6 months |
| Framer site analytics | Framer | Analytics | Counts page views and referrers for the marketing site. | Session to 12 months |
__cf_bm and similar | Content delivery / bot-management providers | Strictly necessary | Distinguishes humans from automated traffic and protects against abuse. | 30 minutes to 24 hours |
Embedded third-party content
Some pages embed content served by other companies. When that content loads, the provider receives your IP address and may set its own cookies under its own policy, over which we have no control.
| Provider | Where it appears | Their policy |
|---|---|---|
| Calendly | Demo and meeting booking | calendly.com/privacy |
| Crisp | Live chat widget | crisp.chat/en/privacy |
| PostHog | Site and product analytics | posthog.com/privacy |
| Framer | Website hosting and delivery | framer.com/legal/privacy-statement |
| Web3Forms | Contact-form delivery | web3forms.com/privacy |
Our web fonts are served from our own domain rather than a font network, so simply loading a page does not disclose your IP address to a font provider.
What we do not do
- We do not use advertising, retargeting or conversion-tracking cookies, and we do not run ad-network tags or social media pixels on our site.
- We do not sell or share the data these technologies generate for cross-context behavioural advertising, as explained in section 9 of the Privacy Policy.
- We do not use device fingerprinting to build advertising profiles.
- We do not use cookies to collect sensitive personal information.
Your choices
8.1 On our site
Where our consent banner is shown, you can accept or decline non-essential cookies when you first arrive, and you can reopen it at any time from the Cookie Policy control in the site footer to change your choice. Declining does not affect strictly necessary cookies, which are required for the site to work.
8.2 In your browser
Every major browser lets you block or delete cookies, block third-party cookies, and clear site data. Look under Settings → Privacy. Vendor instructions:
Browser settings are per browser and per device. Clearing cookies also clears your recorded preference, so the banner will appear again.
8.3 Analytics opt-out
Declining analytics in our banner, sending a Global Privacy Control signal, or using your browser’s tracking protection will stop analytics collection for that browser. You may also email privacy@vavastone.com and we will apply an opt-out to your account.
Global Privacy Control and Do Not Track
We honour the Global Privacy Control (GPC). If your browser or extension sends a GPC signal, we treat it as a valid request to opt out of any sale or sharing of personal information, and as a request to disable non-essential analytics, for that browser.
There is still no common industry standard for the older “Do Not Track” browser header, so we do not respond to it separately. Use GPC, our banner, or your browser controls instead.
Consent, and where consent is required
Where the EU ePrivacy rules, the UK Privacy and Electronic Communications Regulations, or a similar law applies, we ask for consent before setting any cookie that is not strictly necessary, we make declining as easy as accepting, and we record your choice. Consent is not required for strictly necessary cookies.
In the United States, cookies are governed primarily by state privacy laws, which give you a right to opt out rather than requiring prior consent. We provide that opt-out through our banner, through GPC, and through the contact route in section 14.
You can withdraw consent at any time. Withdrawal takes effect from the moment you make it and does not affect data already collected lawfully before then.
If you block cookies
Blocking strictly necessary cookies will break sign-in and other core functions of the application, and we cannot support an account configured that way. Blocking functional cookies means your preferences will not be remembered between visits. Blocking analytics cookies has no effect on how the site works for you — it only means we cannot see how it was used, which makes it harder for us to find and fix problems.
Cookies inside a customer’s account
If you are using VavaStone because a distributor invited you to their catalog, storefront or portal, the cookies described here still apply to the VavaStone platform itself. That distributor is separately responsible for its own website, its own cookie use, and its own privacy notice. See section 18 of the Privacy Policy.
Changes to this policy
We update this policy when we add, remove or reconfigure a vendor, when durations change, or when the law changes. The version and effective date at the top of this page tell you when it last changed. Material changes affecting non-essential cookies will be reflected in the consent banner, and where the law requires it we will ask for consent again.
How to contact us
Questions about cookies or to exercise a choice: privacy@vavastone.com
General: sales@vavastone.com · +1 (858) 255-4146
[[ENTITY]] — Attn: Privacy
[[ADDRESS]]
San Diego, California, United States
See also the Legal overview, Terms of Use and Privacy Policy.