Cookie Policy
This Cookie Policy ("Policy") explains how Nxera Digital LLC ("Nxera," "we," "us," "our") uses cookies and similar tracking technologies on: getnxera.com and all of its subdomains; the plan pages and member pages Nxera hosts in a client's name at getnxera.com/m/ and on custom domains (each, a "Plan Page"); and the Nxera client portal (collectively, the "Sites"). This Policy is incorporated into the Nxera Privacy Policy and the Nxera Terms of Service.
By accessing or using the Sites, you acknowledge that you have read this Policy. Where consent is required by applicable law, your continued use after notice constitutes acceptance to the extent permitted by law.
1. What Are Cookies and Similar Technologies?
A "cookie" is a small text file placed on your device when you visit a website. Cookies allow the website to recognize your device and remember information about your visit. We also use similar technologies including local storage, session storage, and tag-manager scripts (collectively with cookies, "Tracking Technologies"). For brevity we refer to all of them as "cookies" in this Policy.
Cookies can be:
- First-party (set by the domain you are visiting) or third-party (set by another domain whose content is loaded on the page);
- Session (deleted when you close your browser) or persistent (remain until they expire or you delete them);
- Strictly necessary, functional, analytics, or advertising (we do not use advertising cookies).
2. Categories of Cookies We Use
2.1 Strictly Necessary Cookies
These cookies are essential for the Sites to function. Without them, you cannot sign in, complete a checkout, maintain a session, or use core features. Strictly necessary cookies do not require consent under any applicable law.
| Cookie / Token | Purpose | Provider | Duration |
|---|---|---|---|
nx_portal_session |
Keeps you signed in to the client portal (HttpOnly) | Nxera (first-party) | Up to 30 days from sign-in |
Local storage sb-<project>-auth-token |
Sign-in for the legacy subscriber account page | Supabase Auth (first-party) | Until you sign out or clear it |
| Cloudflare Turnstile | Bot check on our forms; Cloudflare may store its own short-lived data to complete the check | Cloudflare (third-party) | Short-lived, set by Cloudflare |
__stripe_mid, __stripe_sid |
Payment-form security and fraud prevention on Stripe-hosted checkout and billing pages and on the portal billing pages that load Stripe.js | Stripe (third-party) | Up to 1 year / 30 minutes |
| Tokens in links we email you | Setting your password, and a member's link to their page; not stored as cookies | Nxera (first-party) | Until used or expired |
2.2 Functional Cookies
These cookies remember your preferences and improve your experience. They are not strictly necessary but materially improve usability.
| Cookie / Storage | Purpose | Duration |
|---|---|---|
nx_portal_lang (cookie) |
Remembers the language you chose in the client portal | 1 year |
Local storage nx_dns_provider |
Remembers the DNS provider you picked when connecting your web address in the portal | Until cleared |
Session storage nx_reports_cache |
Keeps your report list while you move between portal pages | Until you close the tab |
Session storage activated:<id> |
Remembers that your site was just activated, so a reload shows the result; set only by the site-activation page, which is closed while site building is paused | Until you close the tab |
2.3 Analytics Cookies
We use Google Analytics 4, loaded through Google Tag Manager, on getnxera.com marketing pages and on the account, intake, report, unsubscribe, welcome, status, and newsletter pages, to understand how visitors use the Sites and which pages lead to a scan request or a checkout. Google Tag Manager and Google Analytics do not load on Plan Pages, member pages, or the client portal. GA4 sets first-party cookies and sends page, event, and device data to Google. We do not use GA4 for advertising or remarketing. We read GA4 reports in aggregate through the Google Analytics Data API.
We also use Vercel Web Analytics on pages that use the site's main layout. It counts page views without setting cookies.
PostHog product analytics loads only when Nxera switches it on; it is off today. When it is on, it sets its own cookie and local storage on marketing pages and in the portal, and records sessions there (with every form input masked on marketing pages, and with all text and attributes masked and images, video, and embedded frames blocked in the portal). On Plan Pages and member pages it keeps its data in session storage only and records no sessions. It never loads when your browser sends the Global Privacy Control signal.
| Cookie / Storage | Purpose | Provider | Duration |
|---|---|---|---|
_ga |
Distinguishes visitors | Google Analytics (first-party) | Up to 2 years |
_ga_<container id> |
Keeps session state | Google Analytics (first-party) | Up to 2 years |
nx_lead (cookie) |
Links a visit from a scan-report link to a later checkout (holds a lead record ID, never an email) | Nxera (first-party) | 1 year |
Local storage nxera_utm_v1 |
Remembers the campaign tags, referrer, and landing page of your first visit | Nxera (first-party) | Until cleared |
PostHog cookie and local storage (ph_…), only when switched on |
Product analytics on marketing pages and in the portal | PostHog (first-party, served through getnxera.com) | Up to 1 year |
Session storage nx_m, only when switched on |
Product analytics on Plan Pages and member pages | PostHog (first-party) | Until you close the tab |
Session storage nx_ph_signed_in, nx_ph_msg:…, only when switched on |
Hands your portal account ID to PostHog once after sign-in, and keeps a portal event from counting twice | Nxera (first-party) | Until used or you close the tab |
| Vercel Web Analytics | Page-view counts; no cookies | Vercel (first-party path) | None stored on your device |
We do not use Facebook Pixel, TikTok Pixel, LinkedIn Insight Tag, or any third-party advertising or remarketing tracker on the Sites.
2.4 Advertising/Marketing Cookies
We do not currently use advertising or marketing cookies on the Sites. Our Google Tag Manager container holds two tags, both Google Analytics 4 (the Google tag and its event tag), and no advertising or other third-party tag; we checked its published contents on October 5, 2026. Every page that loads Tag Manager first sets Google Consent Mode defaults: advertising storage, advertising user data, and ad personalization are denied, and analytics storage is denied when your browser sends the Global Privacy Control signal. Our site is also built with advertising tags switched off, and the pages tell Tag Manager so. If we ever introduce advertising cookies, we will update this Policy, deploy a consent banner where required, and provide a clear opt-out before activation.
2.5 Error Reporting
Every page of the Sites, including Plan Pages and the client portal, sends error reports to Sentry so we can fix problems, together with a sample of performance traces (about one page load in ten). The Nxera owner app also sends error reports to Sentry. Sentry does not set cookies on the Sites; an error report can include the page, browser, and IP address at the time of the error.
3. Cookies on Plan Pages
Plan Pages at getnxera.com/m/ and on custom domains are shown in the name of the Client operating them. The cookies set on those pages are:
(a) Strictly necessary cookies set by Nxera infrastructure (Cloudflare Turnstile on forms, the page framework);
(b) Cookies set by Stripe when a member proceeds to Stripe-hosted checkout or the Stripe billing portal;
(c) No analytics cookies: Plan Pages do not load Google Tag Manager or Google Analytics. Sentry error reporting runs on Plan Pages without cookies, and PostHog, only when Nxera switches it on, keeps its data in session storage (nx_m) and records no sessions.
Nxera controls which cookies a Plan Page sets; Clients cannot add third-party widgets or trackers to a Plan Page. Visitors and members should consult the Client's own privacy notice for anything beyond what this Policy describes.
4. Your Choices
4.1 Browser Controls
You can configure your browser to refuse some or all cookies, to delete existing cookies, or to alert you when cookies are being set. Each browser is different; consult your browser's help documentation. Disabling strictly necessary cookies will prevent the Sites from functioning correctly, including preventing sign-in and checkout.
4.2 Google Analytics Opt-Out
You can prevent GA4 from collecting data about your visits by installing the Google Analytics opt-out browser add-on (https://tools.google.com/dlpage/gaoptout) or by blocking the _ga cookies in your browser.
4.3 Do Not Track (DNT)
Some browsers send a "Do Not Track" (DNT) signal. There is no industry consensus on how to interpret DNT signals; we do not currently respond to DNT signals. We do, however, refrain from selling or sharing Personal Data, and we act on the Global Privacy Control signal as described below.
4.4 Global Privacy Control (GPC)
When your browser sends the Global Privacy Control signal, PostHog does not load. We do not log GPC signals. As stated in our Privacy Policy, we do not sell or share Personal Data, so GPC changes nothing else that loads.
4.5 California Residents (CCPA/CPRA)
California residents have additional rights under the CCPA/CPRA, including the right to opt out of the sale or sharing of personal information. Nxera does not sell or share personal information and does not use cookies for cross-context behavioral advertising, so no separate sale/share opt-out mechanism is required for cookie data. To exercise other CCPA rights (access, deletion, correction, portability), see our Privacy Policy.
4.6 Other US States
Residents of states with comprehensive privacy laws (Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Tennessee, Indiana, Florida, Delaware, New Jersey, New Hampshire, Maryland, Minnesota, Rhode Island, and any others as they take effect) have equivalent rights as described in our Privacy Policy.
4.7 Future International Compliance
Nxera currently provides Services to U.S. Clients. If we expand to jurisdictions that require explicit prior consent for non-essential cookies (such as the European Union under GDPR/ePrivacy, the United Kingdom under PECR, Brazil under LGPD, or Canada under PIPEDA), we will deploy a consent banner that meets local requirements before enrolling Clients in those jurisdictions.
5. Third-Party Cookies and Data Recipients
The following third parties may set cookies on the Sites or receive cookie-related data:
| Provider | Purpose | Privacy Policy |
|---|---|---|
| Google LLC | Google Analytics 4 and Google Tag Manager; font delivery | https://policies.google.com/privacy |
| Cloudflare, Inc. | Turnstile bot check on forms | https://www.cloudflare.com/privacypolicy |
| Stripe, Inc. | Checkout, billing portal, fraud prevention | https://stripe.com/privacy |
| Supabase, Inc. | Sign-in for the legacy account page, database | https://supabase.com/privacy |
| Vercel Inc. | Hosting and content delivery; Vercel Web Analytics (cookieless page-view counts) | https://vercel.com/legal/privacy-policy |
| Functional Software, Inc. (Sentry) | Error reports and sampled performance traces from every page of the Sites, and error reports from the Nxera owner app | https://sentry.io/privacy/ |
| jsDelivr (Prospect One s.r.o.) | Script CDN on some pages; receives your IP address when a script loads | https://www.jsdelivr.com/terms/privacy-policy-jsdelivr-net |
| PostHog, Inc. | Product analytics, only when Nxera switches it on; never with Global Privacy Control | https://posthog.com/privacy |
| Meta Platforms, Inc. | Facebook's sign-in script, loaded only when a client clicks to connect a WhatsApp number in the portal settings | https://www.facebook.com/privacy/policy |
We do not control these third parties or their cookie practices. We recommend reviewing their privacy policies. The current Sub-processor list is also published in the Data Processing Addendum and at getnxera.com/sub-processors.
6. How Long We Retain Cookie Data
Cookie data is retained for the duration of the cookie as listed in Section 2 (or for the period stated by the third-party provider). GA4 event data is kept in Google Analytics for the retention period set in Nxera's Google Analytics property. Vercel Web Analytics and PostHog data are kept by those providers under their own terms.
7. Disputes
Any dispute arising out of or relating to this Policy is subject to the dispute-resolution provisions in Section 16 of the Terms, including binding individual arbitration, class-action waiver, and the one-year limitations period.
8. Updates to This Policy
We may update this Policy from time to time to reflect changes in the cookies we use or applicable law. We will post the updated Policy on getnxera.com with a new version and effective date, and we email active clients about material changes before they take effect.
9. Contact
Questions about cookies: info@getnxera.com (subject line: "Cookie Question")
Nxera Digital LLC 390 NE 191st St STE 59620 Miami, FL 33179
This Cookie Policy was last updated on October 5, 2026. Version 4.1.