Cookies policy.

Essential cookies — required for the client portal to work. They keep you signed in for the length of your session and protect against cross-site request forgery (CSRF). They do not track you between visits and are deleted when you log out or close the browser. Without them, the portal cannot operate. Analytics cookies — Google Analytics 4 (GA4). Typical cookie names: `_ga` (persistent, up to two years, distinguishes unique visitors) and `_ga_<container>` (persistent, up to two years, persists session state for the property). We have IP anonymisation enabled so the IP address recorded by GA4 is truncated before it reaches Google. GA4 produces aggregate traffic data — page views, referrer source, device category, country-level location, time on page — without surfacing individual visitor identity to us. GA4 does not follow you across unrelated websites unless you are signed into Google services that have cross-site signals enabled at your end. Google Ads conversion measurement — our GA4 property is linked to a Google Ads account so that when we run a search advertisement we can tell whether it led to an enquiry or booking. This sets a Google Ads cookie (typically `IDE` or `test_cookie` on doubleclick.net, and `_gcl_au` first-party). We have set ad personalisation signals to off, so the data is used to count conversions, not to build an advertising profile or show you our ads elsewhere.

We do not use: · Facebook Pixel, Meta Conversions API, or any Meta-owned tracker · Google Ads remarketing or audience lists (the Google Ads cookie above is conversion counting only) · LinkedIn Insight Tag · Hotjar, FullStory, or any session-replay product · Cross-site advertising trackers of any kind Nothing on this site builds an advertising profile of you. The only data shared with an advertising platform is a count of conversions from our own Google Ads campaigns, as described above.

In addition to cookies, the client portal uses your browser's local storage to remember small things like which tab you had open or whether you've dismissed an in-app notice. Local storage stays on your device and is never transmitted to our servers unless you actively use a feature that requires it. You can clear it from your browser's site-data settings.

You can disable or delete cookies in your browser's settings: · Chrome: Settings → Privacy and security → Cookies and other site data · Firefox: Preferences → Privacy & Security → Cookies and Site Data · Safari: Preferences → Privacy → Manage Website Data · Edge: Settings → Cookies and site permissions → Manage and delete cookies Disabling analytics cookies has no impact on site functionality. Disabling essential cookies will prevent the client portal from operating — you'll be signed out and unable to sign back in. The marketing pages (everything outside /app) will still work.

Our analytics provider operates under its own privacy and security commitments: · Google Analytics 4 — operated by Google LLC under the Google Privacy Policy (policies.google.com/privacy) and the GA4 product-specific terms at support.google.com/analytics/answer/6004245. Google participates in the EU-US Data Privacy Framework and equivalent cross-border frameworks. We have IP anonymisation on (anonymize_ip) and ad personalisation signals off. The GA4 property is linked to our Google Ads account for conversion measurement only — see 'Cookies we use' above. The contact page (/contact) embeds a Google Maps frame showing our office location. When that frame loads, Google may set cookies on its own google.com domain (for example NID or CONSENT) under the Google Privacy Policy (policies.google.com/privacy). We do not pass any information about you to that frame; it loads a fixed map of our address. The map only loads on /contact and is lazy-loaded, so it does not load until you scroll to it. Blocking third-party cookies in your browser stops these cookies without breaking the map. Website hosting and edge-cache (Vercel) may set short-lived first-party cookies for security, content negotiation and bot mitigation. These are operational, not analytics, and are governed by Vercel's privacy policy at vercel.com/legal/privacy-policy. Any payment processor used in the future for invoice payment may set its own cookies on its own domain — those cookies are governed by that provider's policy.

We update this page whenever we change the cookies on the site. The 'last updated' date at the top reflects the most recent change. Material changes will be flagged in a banner at the top of the homepage for at least 30 days.

Cookie or analytics queries: privacy@taxtracker.com.au