Cookies policy.

SECTION 1

Essential cookies — required for the client portal to work. They keep you signed in for the length of your session and protect against cross-site request forgery (CSRF). They do not track you between visits and are deleted when you log out or close the browser. Without them, the portal cannot operate. Analytics cookies — Google Analytics 4 (GA4). Typical cookie names: `_ga` (persistent, up to two years, distinguishes unique visitors) and `_ga_<container>` (persistent, up to two years, persists session state for the property). We have IP anonymisation enabled so the IP address recorded by GA4 is truncated before it reaches Google. GA4 produces aggregate traffic data — page views, referrer source, device category, country-level location, time on page — without surfacing individual visitor identity to us. GA4 does not follow you across unrelated websites unless you are signed into Google services that have cross-site signals enabled at your end.

SECTION 2

We do not use: · Facebook Pixel, Meta Conversions API, or any Meta-owned tracker · Google Ads remarketing or DoubleClick cookies · LinkedIn Insight Tag · Hotjar, FullStory, or any session-replay product · Cross-site advertising trackers of any kind Nothing on this site builds an advertising profile of you. Nothing on this site is shared with an ad network.

SECTION 3

In addition to cookies, the client portal uses your browser's local storage to remember small things like which tab you had open or whether you've dismissed an in-app notice. Local storage stays on your device and is never transmitted to our servers unless you actively use a feature that requires it. You can clear it from your browser's site-data settings.

SECTION 4

You can disable or delete cookies in your browser's settings: · Chrome: Settings → Privacy and security → Cookies and other site data · Firefox: Preferences → Privacy & Security → Cookies and Site Data · Safari: Preferences → Privacy → Manage Website Data · Edge: Settings → Cookies and site permissions → Manage and delete cookies Disabling analytics cookies has no impact on site functionality. Disabling essential cookies will prevent the client portal from operating — you'll be signed out and unable to sign back in. The marketing pages (everything outside /app) will still work.

SECTION 5

Our analytics provider operates under its own privacy and security commitments: · Google Analytics 4 — operated by Google LLC under the Google Privacy Policy (policies.google.com/privacy) and the GA4 product-specific terms at support.google.com/analytics/answer/6004245. Google participates in the EU-US Data Privacy Framework and equivalent cross-border frameworks. We have IP anonymisation on (anonymize_ip), have not enabled Google Signals, and have not enabled the cross-site advertising features that would tie GA4 data to ad campaigns. Website hosting and edge-cache (Vercel) may set short-lived first-party cookies for security, content negotiation and bot mitigation. These are operational, not analytics, and are governed by Vercel's privacy policy at vercel.com/legal/privacy-policy. Any payment processor used in the future for invoice payment may set its own cookies on its own domain — those cookies are governed by that provider's policy.

SECTION 6

We update this page whenever we change the cookies on the site. The 'last updated' date at the top reflects the most recent change. Material changes will be flagged in a banner at the top of the homepage for at least 30 days.

SECTION 7

Cookie or analytics queries: privacy@taxtracker.com.au