Legal documents

Cookie Notice

Cookies, browser storage and related technologies

This Cookie Notice explains cookies, browser storage and related technologies used by the Cadvex website and Cadvex Cloud. Cadvex Desktop stores application data locally on Windows or Mac (Apple Silicon) but does not rely on browser cookies for its core local manufacturing workflow.

1. Technologies used

Technology	Provider	Purpose	Category	Typical duration
Supabase authentication storage	Supabase / Cadvex	Account session and token refresh	Strictly necessary	Session or until sign-out/expiry
Signup/onboarding storage	Cadvex	Complete account onboarding and preserve transient workflow state	Strictly necessary	Browser session
Cadvex preferences	Cadvex	Remember interface/shop preferences where enabled	Functional	Until cleared or replaced
Website analytics preference	Cadvex	Remember acceptance, rejection or opt-out of optional analytics and advertising, the region used for the consent model (browser session) and whether the United States notice was dismissed	Necessary preference	180 days
PostHog browser identifiers and session recordings	PostHog EU Cloud	Website and Cloud application usage analytics, heatmaps, session recordings, error and performance diagnostics and signup conversion, only with consent	Optional analytics	Browser identifiers: up to 180 days; events: up to one year; recordings: up to 30 days
PostHog cookieless page counting (no cookie or browser storage)	PostHog EU Cloud	Count visits to the pages of the public website without consent: page address (without personal parameters), referring page, campaign parameters (utm_*), browser and device type and approximate country. Visits on the same day are recognised only by a one-way hash of the IP address and browser details with a secret that changes every day	Audience measurement without cookies	Nothing stored in the browser; events: up to one year
LinkedIn Insight Tag cookies (li_sugr, bcookie, lidc, li_gc and UserMatchHistory, set by LinkedIn on its own domain; li_fat_id and li_giant, set on cadvex.com when a visitor arrives from a LinkedIn ad)	LinkedIn	Measure the results of Cadvex advertising on LinkedIn (ad measurement) and show Cadvex ads on LinkedIn to people who visited the website (retargeting). Marketing pages of the public website only, only with consent; the data goes to LinkedIn	Optional advertising	lidc: 1 day; li_giant: 7 days; UserMatchHistory and li_fat_id: 30 days; li_sugr: 90 days; li_gc: 6 months; bcookie: 1 year
Google Ads tag cookies (_gcl_au, _gcl_aw, _gcl_gs, set on cadvex.com by the Google tag only after consent; the Google click id of an ad is kept in the browser session only after consent)	Google	Measure whether a visit from a Cadvex ad on Google leads to an account being created (conversion measurement). Website pages including sign-up, not the Cadvex Cloud application, Cadvex Desktop or the /watch video page	Optional advertising	Up to 90 days
Outreach referral/session markers	Cadvex	Attribute individually issued outreach links and limited engagement	Optional analytics	Up to 30 days / browser session
Cloudflare technologies	Cloudflare	Network security, proxy/CDN operation and public media delivery where used	Strictly necessary / functional	Provider controlled
hCaptcha technologies	hCaptcha	Prevent automated abuse of public independent signup when enabled	Strictly necessary for protected signup	Provider controlled
Paddle technologies	Paddle	Checkout, payment, tax, fraud prevention and subscription/license administration when paid purchase is used	Strictly necessary when payment is used	Provider controlled

2. Strictly necessary technologies

Necessary technologies enable login, authentication, security, protected signup, payment and requested functionality. Blocking them may prevent the Service or a requested transaction from working.

3. Optional analytics and outreach tracking

Where enabled, Cadvex may use first-party referral/session markers for individually issued outreach links or public demonstration content. These first-party markers are not shared with advertising networks. Where applicable law requires consent before optional analytics, Cadvex will request consent before setting or using them. Rejecting optional analytics does not disable core account functionality.

4. CAPTCHA

Cadvex may use hCaptcha to protect public independent signup against automated abuse. hCaptcha may receive network/device/browser information needed to present and verify a challenge. CAPTCHA is not intended to be applied to Desktop OTP, normal login, recovery or invitation acceptance unless Cadvex changes its security design and provides appropriate notice.

6. Advertising and third-party analytics

With optional analytics consent, Cadvex uses PostHog EU Cloud, reached through Cadvex’s analytics domain p.cadvex.com, to measure and record use of the website and the Cadvex Cloud application: page and screen views, clicks, scroll depth, heatmaps, product choices, signup and onboarding steps, errors, performance and session recordings. Recordings show screens as the user saw them, including text typed into forms and Customer Content displayed in the Cloud application, such as part names and RFQ or quote details. Passwords, payment-card fields, one-time codes, CAPTCHA responses, embedded third-party frames and the 3D model viewer are excluded from recordings; uploaded files are not sent to PostHog. After sign-in, events and recordings are linked to the user’s account email, name, role and organization so that Cadvex can support Customers and improve the Service. Cadvex Desktop activity is not recorded. Network requests are processed by the provider; approximate country may be used for audience statistics.

Without consent, or before a choice is made, Cadvex still counts visits to the pages of the public website (not the Cadvex Cloud application, Cadvex Desktop or the /watch video page) using PostHog’s cookieless mode: no cookie or other browser storage is used and no identifier is stored on the device. Only page views and page exits are sent, with the page address (cleaned of personal parameters), the referring page, the campaign parameters (utm_source, utm_medium, utm_campaign and similar), browser and device type and approximate country. To count a visit, PostHog computes a one-way hash of the IP address and browser details with a secret that changes every day; the hash cannot be used to recognise the visitor on a later day. Clicks, scrolling, form entries and session recordings are never captured without consent. Accepting switches to the analytics described above.

With the same consent, the marketing pages of the public website (not the signup, sign-in and email-verification pages, the Cadvex Cloud application, Cadvex Desktop or the /watch video page) also load the LinkedIn Insight Tag. It sends LinkedIn the address of the page visited, the referring page, browser and device information, the IP address, the time of the visit and interactions such as button clicks (the button text and its place on the page, never what is typed into forms), and sets or reads LinkedIn cookies such as li_sugr, bcookie, lidc and UserMatchHistory, plus li_fat_id and li_giant on cadvex.com when the visitor arrived from a LinkedIn ad. LinkedIn uses this information to report to Cadvex how its LinkedIn advertising performs (ad measurement) and to let Cadvex show its ads on LinkedIn to people who visited the website (retargeting). Cadvex receives only aggregated statistics, not the identity of individual visitors. This data goes to LinkedIn (LinkedIn Ireland Unlimited Company and its affiliates), which uses it under its own Privacy Policy and Cookie Policy and may process it outside the European Union.

With the same consent, the pages of the public website including the sign-up pages (not the Cadvex Cloud application, Cadvex Desktop or the /watch video page) load the Google tag for Google Ads conversion measurement, in consent mode: before consent no Google cookie is set and nothing is sent to Google except a cookieless consent-mode ping for the single account-created event; no name, email address or other account data is ever sent.

Consent by region. The country of the connection (Cloudflare) decides which consent model applies; it is kept for the browser session without any identifier. In the EEA, the United Kingdom, Switzerland and, for now, every other country outside the United States, optional analytics and advertising measurement run only after you accept. In the United States, Cadvex applies an opt-out model: the cookies listed above for PostHog analytics, LinkedIn and Google ads measurement are set unless you opt out, ad personalisation is never enabled there, a short notice tells you so, and you can opt out at any time with “Do Not Sell or Share My Personal Information” in the website footer, “Opt out” in the notice or Privacy choices on this page. Everywhere, a browser that sends the Global Privacy Control signal (Sec-GPC) is treated as having opted out: no optional cookie is set and no advertising measurement runs, whatever was accepted before. An opt-out or refusal is never overridden by the region model.

Use Privacy choices on the Cookie Notice page to accept, reject or withdraw optional analytics and advertising. Refusing does not prevent signup or downloads; after a refusal or withdrawal, visits are still counted without cookies as described above. Withdrawal stops future optional capture, stops the LinkedIn Insight Tag from loading and clears optional browser identifiers stored on cadvex.com, including LinkedIn’s li_fat_id and li_giant cookies; cookies LinkedIn has already set on its own domain can be deleted in the browser or managed in LinkedIn’s ad settings; previously collected data is subject to provider retention and applicable deletion rights. For privacy requests, contact privacy@cadvex.com.

7. Browser controls

Users can control cookies through browser settings and, where provided, Cadvex consent controls. Clearing necessary browser storage may sign the user out or remove preferences.