Cookie Policy

Your Choices

Analytics and performance cookies are only set after you grant consent through the banner that appears on your first visit. You can review or change your choice at any time:

What Are Cookies

Cookies are small text files stored on your device by your web browser when you visit a website. They help websites function correctly, remember your preferences, and provide information to site owners about how the site is being used.

Types of Cookies We Use

Do GRC uses the following categories of cookies:

• Essential Cookies — required for the platform to function, including authentication, session management, and security features. These cannot be disabled.
• Analytics Cookies — help us understand how users interact with the platform so we can improve content and user experience. This is looked at in aggregate (see our Privacy Policy).
• Performance Cookies — monitor platform performance, load times, and error rates to ensure a smooth experience.
• Marketing Cookies — used by Google Ads to measure sign-ups and purchases that came from our advertising, and to let Google personalise ads, such as showing you our ads on other sites. Only set after you grant the Marketing category.

Third-Party Cookies

We use Cookiebot (operated by Cybot A/S, Denmark) to present the consent banner, record your choice, and keep a log that demonstrates compliance with GDPR and ePrivacy requirements. The Cookiebot cookie itself is strictly necessary and is set regardless of your other choices.

Once you grant the Analytics category, we also load Vercel Analytics for aggregate usage insights, Google Analytics, which measures page views, and Cloudflare Web Analytics, which measures page views and how quickly pages load. Cloudflare Web Analytics sets no cookies and stores nothing on your device. Sentry's error and performance monitoring also starts in your browser only then; it sets no cookies and stores nothing on your device either. If you later withdraw consent, Vercel Analytics, Google Analytics and Cloudflare Web Analytics stop, and Sentry stops sending reports. If you have an account, you can also switch off Vercel Analytics, Vercel Speed Insights, Google Analytics and Cloudflare Web Analytics for it from your privacy controls, whatever you choose here. If your browser sends Global Privacy Control, none of them runs, and Google Ads is not loaded, whatever you choose here.

Google's tag (gtag.js) is not loaded until you grant the Analytics category (for Google Analytics) or the Marketing category (for Google Ads). Until then our pages send nothing to Google, not even a cookieless ping. Granting Marketing loads Google Ads, which measures sign-ups and purchases from our ads and lets Google personalise ads, such as showing you our ads on other sites. If you withdraw Analytics, Google Analytics stops at once; if you withdraw Marketing, the page reloads without Google Ads.

Each of these third parties has its own privacy policy governing how it uses the data it collects.

Functional Storage Kept for Your Browser Session

Two small entries in your browser's session storage support the notice that tells you when our AI features don't work where you are. They are functional and kept only for the browser session: your browser discards them when you close the tab. They hold no identifier, are not sent to us or anyone else, and are set whatever you choose in the cookie banner.

• Whether AI features work where you are — the first page you open in a tab asks our server whether our AI features work in the country your IP address points to, and your browser keeps the yes-or-no answer (dogrc:ai-available) so that later pages need not ask again. Where they don't work, a notice at the top of the page says so. Functional, and kept only for the browser session.
• Closing the AI notice — if you close that notice, your browser keeps a flag (dogrc:ai-notice-dismissed) so it stays closed. Functional, and kept only for the browser session.

Functional Storage Kept on Your Device

Each of these remembers a choice you make on the site. It is set only when you make that choice, whatever you choose in the cookie banner. It holds no identifier, is not sent to us, and stays in your browser's local storage until you clear this site's data.

• Closing the language notice — if your browser's language isn't English, a notice says Do GRC is in English. If you close it, a flag (dogrc:lang-notice-dismissed) keeps it closed. Functional.
• Light or dark mode — if you switch between light and dark mode, your choice (theme) is kept so the site opens the same way next time. Functional.
• Certificate design — if you switch a certificate between its light and dark design, your choice (cert-theme) is kept for the next certificate you download. Functional.
• Free paths on top — if you switch the dashboard's "Free paths on top" button on or off, your choice (trygrclabs.dashboard.free-paths-first) is kept for your next visit. Functional.
• Dismissing the tour button — if you close the tour button in the corner of the page, a flag (trygrclabs.tour.dismissed) keeps it hidden. Functional.
• Trivia time limit — if you change the time limit in the trivia game, your choice (dogrc:trivia-time-limit) is kept for your next game. Functional.

Storage Set When You Sign In, Subscribe or Change a Setting

Some storage only appears once you take an action, rather than on first arrival. All of it is strictly necessary — it is what makes signing in, paying and your privacy choices work — so it is set regardless of your analytics and marketing choices, and cannot be switched off while you use those features.

• Signing in — we use Supabase for accounts and authentication. Once you sign in, your session is kept in your browser's local storage so you stay signed in between visits. Signing out clears it. While you sign in with Google or reset your password, Supabase also keeps a one-time code there until that step is finished. If you sign in with Google, the page you were on (dogrc:post-login-next) is kept in your tab's session storage so we can take you back to it afterwards; it is removed once used, ignored after 15 minutes, and discarded when you close the tab.
• Sign-up, sign-in and password reset forms — these carry Cloudflare Turnstile, which checks that the form is being submitted by a person rather than a bot. It loads only on those pages.
• Starting a subscription — the payment provider's script is loaded at the moment you choose a plan, not before. We use Paddle as Merchant of Record, and Stripe as a backup checkout for individual memberships and for team plans. The purchase itself completes on the provider's own checkout, where their cookie and privacy policies apply rather than ours.
• Switching off analytics for your account — while the switch in your privacy controls is on, your browser keeps a flag in local storage (dogrc.analytics-opt-out) so that analytics stay off from the start of each page, before your settings have loaded. Turning the switch off removes the flag.
• Opening a team invite — the code in the invite link is kept in your browser's session storage for that tab (dogrc.team-invite), so the invite still works after you sign in. It is removed when you join, and your browser discards it when you close the tab.

We list these here because an automated scan of our public pages cannot reach them. A scanner does not sign in and does not click "subscribe", so it never sees the storage those journeys create. This section, and the corresponding entries in our cookie declaration, are therefore maintained by hand and reviewed whenever we change an authentication or payment provider.

Managing Cookies

The easiest way to change your choice is the "Manage cookie preferences" button above, which re-opens the consent banner. You can also control cookies through your browser settings — most browsers allow you to block or delete cookies — but note that disabling strictly necessary cookies may prevent essential features such as staying signed in.

For more information about managing cookies, visit your browser's help documentation or allaboutcookies.org.

Contact

If you have questions about our use of cookies, please contact us at hello@dogrc.com.