Cookie management
Pursuant to Article 82 of the French Data Protection Act (loi Informatique et Libertés) and to the CNIL recommendations of 17 September 2020.
Last updated: 24 August 2026 · Version française
1. What is a cookie?
A cookie is a small text file placed on your device (computer, smartphone, tablet) when you visit a website. It allows the site to recognise your browser on subsequent visits, to remember your preferences, or to temporarily store technical information. Article 82 of the French Data Protection Act more broadly covers any technology that accesses or writes information on your device: browser local storage (localStorage, sessionStorage) therefore follows the same rules and is covered below alongside cookies.
2. Cookies used on scanrgpd.fr
The table below lists every cookie placed on this site. This list is exhaustive and kept up to date.
| Cookie name | Issuer | Purpose | Duration | Consent |
|---|---|---|---|---|
sb-<project-ref>-auth-token(exact name depends on our Supabase project, possibly split across several cookies) | scanrgpd.fr (Supabase, database hosting processor) | Keeps you signed in to the client area (dashboard, account, admin). Only set while you are logged in — never on public pages or the free preview. | Session-token lifetime, renewed while you remain active | Not required (strictly necessary authentication cookie) |
scanrgpd_dash_locale | scanrgpd.fr | Remembers the language you chose (FR/EN) in the client area | 1 year | Not required (display preference) |
admin_tier_override | scanrgpd.fr | Internal testing tool reserved for admin accounts (simulates a subscription tier on screen). Never set for a regular visitor or client. | 30 days | Not required (internal technical feature) |
disable-analytics | Set manually by you, never by us | Excludes you from anonymous audience statistics (Vercel Analytics, Umami) if you wish — see section 4 | Whatever you set yourself | Not required (opt-out mechanism, not a tracker) |
Under technical verification: our hosting infrastructure (Vercel) may set, at the platform level and independently of our application code, a generic anti-abuse cookie. If it exists, it would fall under the CNIL exemption for security cookies — its exact name and duration will be added here once confirmed by inspecting real production headers.
3. Browser local storage (localStorage / sessionStorage)
Under Article 82 of the French Data Protection Act, this storage follows the same rules as cookies. Here is everything scanrgpd.fr writes to it:
| Key | Type | Where | Purpose | Consent |
|---|---|---|---|---|
scanrgpd:declared_toolsscanrgpd:business_context | sessionStorage | Order form (public site) | Keeps your answers (declared tools, sector) while you go through the Stripe payment page and come back — without it, your answers would be lost on return from payment. | Not required (necessary to deliver the service you requested) |
utm_tracked, utm_session | sessionStorage | Public site (Umami) | Avoids counting the same visit twice in anonymous audience statistics | Not required (operation of an audience-measurement tool itself exempt, see section 4) |
scanrgpd_dash_theme | localStorage | Client area | Remembers the light/dark theme you chose | Not required (display preference) |
scanrgpd_partner_upsell_dismissed_v1 | localStorage | Client area (non-partner accounts) | Remembers that you dismissed an information banner about the Agency Pack | Not required (interface preference) |
scanrgpd_iteration_history_v1 | localStorage | Client area (Agency Pack accounts) | Keeps your iteration-scan history (last 30) so you do not have to rerun them | Not required (feature of the service you are using) |
None of these values are sent to any third party: they stay in your browser and are only read by scanrgpd.fr.
4. Cookies we do NOT use
To be completely transparent, here is what is deliberately excluded:
| Cookie type | Status |
|---|---|
| Google Analytics | ❌ Not used |
| Google Tag Manager | ❌ Not used |
| Meta Pixel (Facebook / Instagram) | ❌ Not used |
| TikTok Pixel | ❌ Not used |
| LinkedIn Insight Tag | ❌ Not used |
| Hotjar / Microsoft Clarity / Smartlook (session recording) | ❌ Not used |
| Advertising cookies (DoubleClick, Criteo, etc.) | ❌ Not used |
To measure audience and performance ethically and compliantly, the site uses Vercel Web Analytics, Vercel Speed Insights (measures page load speed), and Umami Analytics (self-hosted on our own Vercel servers plus a Neon Postgres database in Frankfurt). All three tools are cookieless, aggregated, anonymised, with no cookie placed in the browser. This method is exempt from consent under the CNIL recommendation of 17 September 2020, point 17 on anonymised audience measurement; Vercel Web Analytics and Speed Insights do involve processing of your IP address by Vercel Inc. (United States) for aggregation, covered as an international transfer by our privacy policy — a separate question from the cookie-consent one addressed here.
Simple opt-out: if you do not wish to be included in our audience statistics, manually add the disable-analytics=1 cookie on scanrgpd.fr (via your browser's developer console). Umami and Vercel Web Analytics respect this directive and will then send no event (Speed Insights, which only measures aggregated technical performance with no link back to you, has no dedicated opt-out mechanism).
5. Why no tracking cookies?
It is a philosophical and commercial choice consistent with the activity:
- ScanRGPD.fr sells a GDPR audit service. It would be incoherent to use the very tracking tools we criticise in our audits.
- No behavioural data is necessary for the business; anonymised audience statistics are amply sufficient.
- No advertising is served.
- No data is resold.
6. How to manage cookies in your browser
Although no tracking cookie is placed on this site, you may at any time configure your browser to block or delete all cookies, including technical ones. Note that this may impair certain features (notably signing in to the client area).
Official help links by browser:
7. Processors concerned
Payment is handled by a full redirect to the payment page hosted by Stripe (checkout.stripe.com): your browser leaves scanrgpd.fr before you enter any card details. No Stripe script runs, and therefore no Stripe cookie is set, on the scanrgpd.fr pages themselves — any Stripe cookies belong to the checkout.stripe.com domain and are governed by Stripe's own privacy notice, outside the scope of this document.
Our host (Vercel) may apply its own technical anti-abuse measures at the platform level, independently of our code. If this results in a cookie, it would fall under the CNIL exemption for cookies strictly necessary for security (see the note in section 2) — Vercel is certified under the EU-US Data Privacy Framework.
More information about our processors (hosting, email, AI report generation, payment) in the Privacy Policy.
8. Contact
For any question concerning the cookies used on this site:
- Email: contact@scanrgpd.fr
9. Amendments
This policy may be amended to reflect changes in technical practices. Any change will be reflected in the update date at the top of this document.
10. Language
This page is published in French and in English. Where a difference of interpretation arises, the French version prevails.