Cookies and tracking technologies

1. How the preference manager works

Equarith uses two categories of optional tools: audience measurement with Google Analytics and session replay with BRDReplay. The preference manager activates a tool only when it is allowed by the website’s technical configuration and the user has consented to the corresponding purpose. When a tool is not allowed by the configuration, its script is not loaded and it receives no data, regardless of any stored choice.

The two purposes are offered separately. Refusing either or both does not prevent access to essential features. Equarith does not use these tools for personalised advertising or to track a person across other publishers’ websites.

2. Cookies and browser storage

JSESSIONID

• Publisher: Equarith, equarith.com domain
• Purposes: maintain a session, protect forms against forged requests, authenticate a customer or administrator and retain technical state needed for the service
• Data: a random session identifier containing no direct name or email address
• Lifetime: session cookie, with server expiry after 30 minutes of inactivity
• Status: strictly necessary cookie; no consent is requested

In production it is sent only over HTTPS with Secure, HttpOnly and SameSite=Lax attributes. The form anti-forgery token is associated with the session and is not an advertising tracker.

equarith_cookie_consent_v2

• Publisher: Equarith, equarith.com domain
• Purpose: remember the separate “Audience measurement” and “Session replay” choices and avoid asking on every page
• Data: granted or refused choice for each purpose, schema version, scope of configured tools and recording date
• Lifetime: 180 days following either acceptance or refusal
• Status: storage strictly necessary to honour the choice; no consent is requested for this cookie

A change to the scope of configured tools invalidates the stored preference and causes consent to be requested again.

BRDReplay session identifier

After session-replay consent, BRDReplay stores a random identifier and technical counters in sessionStorage under a brdReplay.v1.* key. This storage is limited to the browser tab. A new session is created after 30 minutes of inactivity and no later than four hours of continuous activity. The key is removed from the browser when consent is withdrawn. BRDReplay does not use an authentication cookie to transmit recordings.

3. External payment

After choosing to pay, the user is redirected to a secure page operated by a payment provider such as Stripe. That domain may use its own cookies needed for payment, authentication and fraud prevention under the information it provides. Equarith places no Stripe cookie before the redirect.

4. Audience measurement — Google Analytics

When Google Analytics is allowed by the website configuration and the user accepts “Audience measurement”, Equarith uses it to measure visits, viewed pages, technical events, referrers and visit duration in order to improve the website. Google may also process a random identifier, the IP address to route the request and infer an approximate area, and browser and device information.

The website uses basic consent mode: without agreement to this purpose, the Google script is not loaded and no measurement signal is sent. The configuration disables personalised advertising, Google Signals, advertising-personalisation signals and the sending of an Equarith account identifier.

Google Analytics is blocked on routes containing /account, /checkout, /contact or /admin. On other allowed pages, the page_location value sent is limited to the origin and path, without a query string or fragment.

When set, the _ga and _ga_<identifier> cookies distinguish browsers and retain session state. Their expiry is limited to 390 days and is not renewed on every visit. Event data in the property is retained for no longer than 14 months. Names may evolve with the service; the Google Analytics documentation describes the cookies currently used.

Google Ireland Limited acts as a processor for this service. Google states that data may be processed on servers in several countries; the applicable safeguards are described in the Google Privacy Policy and the “Transfers” section of the Equarith privacy policy.

5. Session replay — BRDReplay

When BRDReplay is allowed by the website configuration and the user accepts “Session replay”, Equarith uses its BRDReplay/BRDlytics service, served from analytics.brdtools.com, to detect interface errors and navigation friction and improve the usability of public pages.

Replay may process the full page URL, page title, viewport dimensions, a random session identifier, DOM mutations, clicks, pointer movements, scrolling, selections, errors and console messages, as well as technical events explicitly sent by the website. The IP address, User-Agent and referrer are also technically received with the HTTP request.

Before the recorder loads, the website marks the whole public page for text masking. The recorder also masks every input field; it does not capture canvas content, cross-origin iframe content or network-request bodies. Routes containing /account, /checkout, /contact or /admin are technically excluded. Any page whose URL has a non-empty query string is also excluded so that the recorder does not receive those parameters. It is not loaded on any of these pages, even if consent has been granted.

The service is operated for Equarith and hosted by OVH SAS in France. Recordings are currently kept until manual deletion or, when the service storage quota is exceeded, until automatic eviction of the oldest sessions. The service applies no automatic maximum based on age. An erasure request may be sent to legal@equarith.com with information enabling the relevant session to be found.

6. Consent and withdrawal

The banner presents the purposes and configured tools before a choice is made. “Accept all” and “Reject all” are offered with the same visibility and ease. Customisation checkboxes are independent and unticked by default. Silence, continued browsing or closing the interface does not constitute consent.

The choice is kept for no longer than 180 days before it is requested again, unless the scope changes sooner. The permanent “Cookies” link in the footer reopens the preference manager at any time.

Withdrawal blocks subsequent loading, stops BRDReplay on the current page, removes its sessionStorage identifier and attempts to remove Google Analytics cookies accessible to the website. Closing the recorder may transmit the last batch of interactions collected before withdrawal. Withdrawal does not affect the lawfulness of prior processing or server-side retention periods already applicable.

7. Browser controls

Browsers can also inspect, block and delete cookies and local storage. Blocking every cookie may prevent login, payment or secure form submission. These controls supplement, but do not replace, the website preference manager.

8. Contact

For cookie or tracking questions, email legal@equarith.com. Other information about data, recipients, transfers and rights appears in the privacy policy.