Cookie and Similar Technologies Policy

This Cookie and Similar Technologies Policy explains how Eredox Pty Ltd uses cookies and similar browser technologies on the NOVA public marketing website at www.nova.eredox.com and in the separate authenticated NOVA application at nova.eredox.com.

The surfaces are described separately because the public website does not provide authenticated application access. This policy records current verified behaviour; it is not a promise that a future provider or feature will be introduced.

A cookie is a small value stored by a website in a browser and sent back with later requests. Similar technologies include browser local storage, session storage, pixels, scripts and other client-side mechanisms that remember a choice or recognise a browser.

The public website currently uses browser local storage for its consent record. Repository inspection found no public-site session storage, tracking pixel, analytics tag, marketing tag or embedded third-party application.

Technology: localStorage key nova-cookie-consent-v1. Domain/surface: the NOVA public website. Type: first-party browser local storage. Purpose: stores the necessary flag, analytics and marketing choices, and the decision timestamp so the consent banner does not reappear on every page. Provider: Eredox/NOVA website code. Duration: no fixed expiry is configured; it remains until the browser, user or browser privacy controls remove it. Consent required: the storage is used to record the consent choice; it does not load any non-essential provider. Current status: implemented.

No first-party cookie is set by the public website consent component. No public-site sessionStorage key was found. The public site has no authenticated session and does not store an access or refresh token in browser storage.

On the public website, the consent record is the only verified browser storage used by the cookie-consent experience. The site does not require an authentication cookie to display its public pages.

In the authenticated NOVA application, the repository verifies two first-party cookies: nova_session, an HttpOnly server-side session reference, and nova_csrf, a readable CSRF value for protecting state-changing cookie-authenticated requests. Both have an eight-hour default maximum age in the application configuration and are deleted on logout. They are application technologies, not public marketing-site technologies.

The application also uses localStorage for tenant-scoped onboarding handoff notes and user-scoped getting-started progress, and sessionStorage for the sidebar-collapse preference and trial-banner dismissal. These are interface/workflow preferences, not authentication tokens, and the repository does not configure a fixed expiry for the localStorage values; sessionStorage is cleared by the browser at the end of its session.

The application has separate portal session and CSRF cookies for the dedicated portal boundary, each configured with an eight-hour default maximum age. Its external policy-review workflow uses the first-party nova_policy_ext cookie with an eight-hour maximum and an expiry no later than the invitation expiry. These are not set by the public website.

No separate functional cookie or preference storage for theme, language or similar site settings was found on the public website. The consent record is used only for consent state.

No analytics provider is configured or loaded on the public website. Repository inspection found no Google Analytics, PostHog, Mixpanel, Amplitude or equivalent integration. Selecting Analytics in the preference panel therefore does not currently load an analytics technology.

No marketing provider, advertising pixel, retargeting tag or consent-management platform is configured or loaded on the public website. Selecting Marketing therefore does not currently load a marketing technology.

The public website presents a consent banner when no consent record is present. Necessary is always active. A visitor can reject non-essential categories, accept all categories, or open Manage preferences and save separate Analytics and Marketing choices.

The current implementation stores the choices in localStorage under nova-cookie-consent-v1 together with a decidedAt timestamp. Because no non-essential providers are configured, no analytics or marketing technology is loaded before or after a choice. Consent to the banner is separate from acceptance of the NOVA Terms and acknowledgement of the Privacy Policy.

Preferences can be changed or withdrawn at any time using the Cookie preferences control in the public-site footer. If storage is unavailable, the site continues without saving the preference record and the banner may appear again.

Visitors can block, delete or restrict cookies and local storage through their browser privacy settings. Clearing site data will remove the public-site consent record and may cause the consent banner to appear again. Browser controls may also affect site functionality.

The public website loads the Roboto font stylesheet from Google Fonts domains through a stylesheet and preconnect links. This is an external resource request, not an analytics or marketing provider configured by NOVA; this policy does not assert what cookies, if any, a visitor's browser or that provider may apply outside the NOVA website.

No third-party embedded forms, video players, social widgets, analytics provider or marketing provider is configured. Public forms submit to a same-origin server endpoint, which can forward enquiries to configured Eredox CRM/mail systems. The Sign in link opens the separate NOVA application; it is not an embedded application session on the public site.

The public-site consent localStorage record has no configured expiry and remains until removed by the visitor, browser settings or storage failure. No analytics or marketing retention period exists because those providers are not configured.

The authenticated application session cookies have an eight-hour default maximum age in the application configuration. The application stores the opaque session record server-side in Redis and removes the cookies on logout. Other application or workflow retention is governed by the application and its Privacy Policy; it is not a public-site cookie duration.

If Eredox introduces an analytics, marketing, functional or other non-essential provider, the provider and purpose will be reviewed before enablement, the consent experience and this policy will be updated where required, and the provider will not be described here as current before it is actually configured.

This policy describes browser technologies. The Privacy Policy explains the broader processing of personal information by Eredox in connection with the public website and authenticated NOVA application. If the documents address the same subject, they should be read together.

Questions or concerns about this policy can be raised through the public website Contact page. Version 1.0 is effective from 24 September 2026 and was last reviewed on 24 September 2026.