Cookie Policy

Last updated: 22 July 2026

This Cookie Policy explains what cookies and similar technologies SERAJ stores on your device, why, and how you stay in control. It supplements our Privacy Policy, which describes how we process personal data generally.

What are cookies and similar technologies?

Cookies are small text files a website stores on your device. We also use browser local storage (data kept only inside your browser) and, with your consent, cookieless telemetry (measurement signals that store nothing on your device). European law — Article 5(3) of the ePrivacy Directive together with the GDPR — treats all storage of, or access to, information on your device the same way, so this policy covers all three.

Our approach

We keep device storage to a strict minimum:

• Everything we set is first-party. We use no advertising networks, no cross-site trackers, and we do not sell or share your data for advertising.
• Nothing optional runs without your consent. Analytics and the referral cookie stay off until you opt in through the consent banner. We never use pre-ticked boxes, and declining is one click on the first layer — the site remains fully usable without optional cookies.
• You can change your mind at any time. The persistent "Cookie preferences" control (bottom-left corner of every public page) reopens your settings. Withdrawing consent is as easy as giving it, and withdrawal takes effect immediately — including deletion of the referral cookie on your next request.

The four categories

1. Strictly necessary — signing you in securely, completing two-factor authentication, remembering your consent decision, and fraud prevention during a checkout you start. These are exempt from consent because the service you request cannot work without them (ePrivacy Art. 5(3), second sentence).
2. Interface preferences — your theme, sidebar layout, and pricing-view choices. First-party, containing only the option you picked and no identifier. These fall under the consent exemption for user-interface personalisation.
3. Analytics (consent required) — privacy-friendly, cookieless page-view and performance measurement processed by Vercel. Nothing loads until you opt in.
4. Marketing — referral (consent required) — one signed, first-party cookie remembering which partner referred you, so the referral still counts if you sign up on a later visit. If you decline it, a referral still works when you sign up in the same visit; it simply is not remembered across visits.

The complete, always-current inventory — every entry with its name, purpose, host, duration, reason, and type — is published in the tables below this policy. The tables are generated from the same configuration the consent banner reads, so they always match what the app actually stores.

Legal bases

• Strictly necessary and interface-preference storage: consent-exempt under ePrivacy Art. 5(3); related personal-data processing rests on our legitimate interest in a secure, functioning service (GDPR Art. 6(1)(f)) or on contract performance (Art. 6(1)(b)).
• Analytics and the referral cookie: your consent (GDPR Art. 6(1)(a)), withdrawable at any time with effect for the future (Art. 7(3)).
• Referral attribution processing on our servers (the commission ledger) rests on legitimate interest (Art. 6(1)(f)); your consent governs only the storage on your device.

Consent records and renewal

Your decision is stored for at most 12 months, after which the banner asks again. We also ask again whenever the cookies we use, or this disclosure, change materially. Your consent choice itself is stored in the strictly necessary seraj_prefs cookie and a local browser record — never on our servers and never linked to your identity.

Managing cookies in your browser

Independently of our banner, every browser lets you view, delete, or block cookies in its privacy settings. Blocking strictly necessary cookies will prevent signing in.

Changes to this policy

We will update this page when our use of cookies changes and revise the date above. Material changes trigger a fresh consent prompt.

Contact

Questions about this policy or your rights are welcome through the contact details in our Privacy Policy. You also have the right to lodge a complaint with your supervisory authority (GDPR Art. 77).