Cookie Notice
Cookie Notice
Univia Tax — UAE Tax Compliance & Business Records
Effective date: 4 August 2026 · Last updated: 19 Jul 2026
This notice describes the cookies and similar browser storage that Univia Tax actually uses. It is written from the implementation, not from a template.
1. The short version
Univia Tax sets the cookies it needs to keep you signed in and to keep the Service secure. It sets no advertising or tracking cookies. Non-essential cookies stay off until you actively accept them, and closing or ignoring the consent banner never counts as acceptance.
2. How consent works here
When you first visit, a banner appears at the bottom of the page with two choices: Essential only and Accept all.
• Your choice is stored in your browser's local storage, under the key univia-tax-cookie-consent, with the value essential-only or all.
• Until you choose, non-essential storage is treated as declined. The banner does not disappear on a scroll, a click elsewhere, or a page change — it stays until you decide. There is no implied consent.
• The consent record itself is stored locally in your browser. It is not sent to our servers and is not a tracking identifier.
Because your choice is stored in the browser, it is per-browser and per-device. Clearing your browser storage clears the choice, and the banner will appear again.
To change your choice, clear site data for app.univiaglobal.ae in your browser settings and choose again when the banner reappears. [PRODUCT FOLLOW-UP — an in-product "cookie preferences" control would be better than asking users to clear site data, and should be built before public launch.]
3. What is actually set
3.1 Strictly necessary — always on
These are required to provide the Service. They cannot be switched off, and the Service will not work without them. They are not used for tracking.
| Purpose | What it is | Set by | Lifetime |
|---|---|---|---|
| Keeping you signed in | Session cookie holding your authentication token. Marked Secure in production, with hardened __Secure- / __Host- cookie prefixes | Univia Tax (via Auth.js) | Up to 14 days, then re-authentication is required |
| Sign-in security | Short-lived cookies used during the sign-in exchange to prevent request forgery and to carry the callback state | Univia Tax (via Auth.js) | The sign-in flow only |
| Your cookie choice | Local storage entry univia-tax-cookie-consent | Univia Tax | Until you clear browser storage |
Where you sign in with Google, Google sets its own cookies on its own domain during the sign-in exchange, governed by Google's policies, not this notice.
3.2 Analytics — off unless you accept
If you choose Accept all, Univia may set analytics cookies or similar identifiers to understand how the product is used and where it is confusing, so it can be improved.
Honest current position: no analytics provider is configured in the Service as at the date of this notice. The consent banner offers the choice so that the Service is ready to honour it, and so that no analytics can ever be introduced without a prior opt-in. If and when an analytics provider is added:
• it will only run for users who have chosen Accept all;
• this notice will be updated with the provider's name, the cookies it sets, their lifetimes, and where it processes data;
• the provider will be added to the subprocessor list in the Privacy Notice and the Data Processing Addendum; and
• the update will be notified in accordance with clause 12 of the Privacy Notice.
[TO BE COMPLETED WHEN AN ANALYTICS PROVIDER IS SELECTED — provider, cookie names, lifetimes, processing location, and whether IP addresses are truncated.]
3.3 What we do not set
Univia Tax sets no advertising cookies, no cross-site tracking cookies, no social media pixels, no retargeting tags, and no third-party marketing identifiers. We do not sell or share browsing data.
3.4 Cookies set by our infrastructure providers
Our hosting and payment providers may set cookies of their own in the course of delivering the Service:
• Vercel (hosting) may set cookies necessary for request routing and protection of the platform.
• Stripe (payments) sets cookies on its own checkout and payment pages, and for fraud prevention, governed by Stripe's own cookie policy.
[CONFIRM — the exact cookie names and lifetimes set by Vercel and Stripe on the production deployment should be captured from a live browser inspection before publication, and listed here.]
4. Other browser storage
Beyond cookies, the Service uses your browser's local storage for the consent record described at clause 3.1. Local storage is not transmitted to our servers with each request; it stays on your device.
5. Managing cookies in your browser
You can block or delete cookies through your browser settings. Blocking strictly necessary cookies will prevent you from signing in, and the Service will not function.
6. Legal basis
Strictly necessary cookies are set on the basis that they are required to deliver the service you have requested. Analytics cookies, if any are introduced, will be set only on the basis of your consent under UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, which you may withdraw at any time.
7. More information
See the Privacy Notice (docs/legal/privacy-notice.md) for how personal data is handled generally, and contact support@univiaglobal.com with any question about this notice.