Cookie Notice

1. Essential cookies only

The audited CRM application uses cookies that are necessary to authenticate users, maintain secure sessions and keep the selected organization or super-administrator context. It does not currently load optional analytics, advertising or session-replay scripts, so an “Accept All” banner is not used.

2. Cookies used

• Supabase authentication cookies (`sb-<project-ref>-auth-token` and chunked variants) store and refresh the signed-in session. A temporary PKCE code-verifier cookie may be used during authentication and password-recovery flows.
• `org_context` is an HTTP-only, SameSite=Lax session cookie that identifies the organization selected at login. The server revalidates the user and active membership; the cookie is not trusted by itself.
• `sa_context` is an HTTP-only, SameSite=Lax session cookie used only for the separate super-administrator area. The server revalidates super-administrator status.

3. Browser storage

The audited application code does not create localStorage or sessionStorage values. Supabase SSR is configured to keep the authentication session in cookies.

4. Your choices

Browsers can block or delete cookies, but disabling these essential cookies prevents secure login or causes the session and selected organization context to be lost. If optional tracking is added later, this notice and the consent behavior must be reviewed before it is enabled.