Cookie Policy

Cookies are small text files a website stores on your device to remember information between page loads or visits. Similar technologies — such as local storage and session storage — achieve comparable results. In this policy “cookie” refers to all of these.

We use a small, fixed set of essential cookies and storage keys:

• Session cookie (authjs.session-token). Set after you sign in. Keeps you signed in between page loads. HttpOnly, Secure, SameSite=Strict, expires after 8 hours of inactivity. Strictly necessary; you cannot use the signed-in product without it.
• CSRF cookie (authjs.csrf-token). Protects sign-in and write requests from cross-site forgery. Strictly necessary.
• Callback cookie (authjs.callback-url). Lets us send you back to the page you were trying to reach after sign-in. Strictly necessary.
• Cookie-banner preference (vectis.cookie-consent.v1, stored in localStorage rather than a cookie so the notice does not itself set a cookie). Remembers that you dismissed the cookie banner so we don’t re-prompt on every page.

We do not use advertising cookies, cross-site tracking pixels, fingerprinting scripts, or third-party analytics that profile individual users. We do not sell browsing data.

When you use the Service, certain flows take you to third-party platforms that set their own cookies on those domains — principally Stripe (payment checkout and billing portal). These cookies are governed by the third party’s own policies. See Stripe’s cookie policy for details.

Because we only set strictly-necessary cookies, there is nothing to opt out of inside the Service without breaking sign-in. You can still:

• block all cookies in your browser — you will not be able to sign in to Vectis while that setting is active;
• clear the vectis.cookie-consent.v1entry from localStorage to see the banner again;
• use private / incognito browsing, which discards all cookies when the window closes.

If we add a cookie category in the future (for example, optional analytics), we will update this policy, re-show the banner via the versioned preference key, and — where required by law — ask for consent before setting the new cookies.

Privacy questions, including about cookies, go to privacy@mspvectis.com.