Cookie Policy
What cookies and similar storage we set, why, and how to control them.
⚠️ DRAFT — Reviewed by counsel: [pending]. Effective date: [YYYY-MM-DD — set on publish]. Do not rely on this as legal advice.
This Cookie Policy explains how the LeadAdvisors Portal at apps.leadadvisors.com and the public careers site at leadadvisors.com/careers use cookies and similar storage technologies. It supplements the Privacy Policy.
1. What are cookies?
Cookies are small text files set on your browser by the sites you visit. We also use related technologies — localStorage, sessionStorage, and pixel-style requests — collectively referred to as "cookies" in this policy.
2. The cookies we set
The list below reflects the current production build as of the Last updated date and is the source of truth alongside the running performance-monitoring worker output. We will revise this list when we add or remove a tool.
2.1 Strictly necessary
These cookies are required for the Portal to function. They cannot be disabled without breaking sign-in or core flows. Consent is not required to set them under EU/UK rules.
| Cookie / storage | Purpose | Set by | Lifetime |
|---|---|---|---|
next-auth.session-token (or __Secure-next-auth.session-token over HTTPS) | Authenticates your portal session after sign-in | NextAuth.js (in-app) | Session, max 30 days; cleared on sign-out |
next-auth.csrf-token (or __Host-next-auth.csrf-token over HTTPS) | CSRF protection for the sign-in form | NextAuth.js (in-app) | Session |
next-auth.callback-url | Remembers where to send you after sign-in | NextAuth.js (in-app) | Session |
la-sidebar:admin, la-sidebar:candidate, la-sidebar:staff | Remembers whether you collapsed the sidebar (localStorage) | App | Persistent until you clear browser storage |
la-apply-draft:<roleId>:<email> | Saves your in-progress application draft so a refresh does not wipe it (localStorage) | App | Persistent until you submit or clear it |
2.2 Functional
| Cookie / storage | Purpose | Set by | Lifetime |
|---|---|---|---|
| In-app preference flags | Remember your choices (e.g., page filters, last-used billing period) | App (localStorage) | Persistent |
2.3 Analytics + performance
These help us understand how the Portal is used and where it slows down or breaks. We treat these as opt-in for users in regions where consent is required (EU, UK, Switzerland, Brazil, and other regions with similar rules).
| Cookie / storage | Purpose | Set by | Lifetime |
|---|---|---|---|
| Vercel Web Analytics | Aggregate, privacy-friendly visit metrics. Vercel's analytics are designed to avoid identifying individuals. | Vercel | Per Vercel documentation |
| Vercel Speed Insights | Real-user performance metrics (Core Web Vitals) | Vercel | Per Vercel documentation |
| Sentry | Error tracking and session metadata when an error occurs (browser, IP, breadcrumbs) | Sentry | Per Sentry documentation |
NEXT_PUBLIC_CLARITY_PROJECT_ID (Microsoft Clarity, candidate funnel) | Session replay on the candidate assessments flow when this env is set in production | Microsoft Clarity | Per Microsoft Clarity defaults |
We do not currently set advertising or cross-site tracking cookies.
3. How to control cookies
You can:
- Adjust your browser settings to block or delete cookies (note: this will sign you out and may break some features).
- For analytics cookies, use the in-portal consent banner (see §4) where it is offered.
- Use Do Not Track or Global Privacy Control signals; we honor recognized privacy signals where required by law.
4. EU/UK consent banner — copy stub
When a visitor's request indicates an EU/UK/Swiss/Brazilian origin (or another region requiring opt-in to analytics cookies), we display the banner below before any non-strictly-necessary cookie is set.
We use cookies. Strictly necessary cookies keep you signed in and the Portal working. Optional cookies help us measure performance and fix errors. You can accept all, accept only what's required, or read the Cookie Policy and Privacy Policy for details.
[Accept all] [Reject optional] [Manage preferences]
Notes for implementation:
- Default behavior before the user chooses must be: load only strictly-necessary cookies. Analytics + Sentry must wait for opt-in.
- Reject optional must record an
la-cookie-consent=required-onlycookie and not load analytics. This choice should be respected for at least 6 months before re-prompting. - Accept all must record an
la-cookie-consent=allcookie. - Manage preferences opens a panel listing each category (strictly necessary / functional / analytics) with on/off toggles. Strictly necessary is locked on.
[Anthony to confirm: whether we want this banner globally (recommended for safer compliance) or only for EU/UK/equivalent regions (cheaper UX cost; requires accurate region detection). The current build does not yet ship a cookie consent banner.]
5. Changes
We may update this policy as we add or remove tools. The "Last updated" date is authoritative.
6. Contact
Questions about cookies or to exercise your rights: legal@leadadvisors.net.
Questions or rights requests: legal@leadadvisors.net.