Legal
Cookie Policy
How Native Keeper uses cookies and similar technologies when you visit our website or use our Service.
Last updated: 10 June 2026 · Version 1.0
1. Introduction
This Cookie Policy explains how NeonStack Ltd (company number 16933096), trading as Native Keeper ("Native Keeper", "we", "us", or "our"), uses cookies and similar technologies when you visit nativekeeper.com or use our Service.
It explains what these technologies are, why we use them, what data they collect, and how you can control them. It should be read alongside our Privacy Policy.
For questions, contact legal@nativekeeper.com.
2. What are cookies?
A cookie is a small text file stored on your device when you visit a website. Cookies let websites remember information such as your preferred language, whether you are logged in, or your accessibility settings.
In this Policy, "cookies" also includes local and session storage, pixels and tracking beacons, software development kits, and device-fingerprinting technologies.
3. Where you encounter Native Keeper cookies
| Where | What applies |
|---|---|
| nativekeeper.com, including our marketing site, product dashboard, and app | This Cookie Policy applies to cookies set by Native Keeper on these pages. |
| A page delivered by Native Keeper on behalf of a customer | Our customer, as Controller, is responsible for its own cookie consent. This Policy describes what is technically set, but legal responsibility for consent may sit with the customer. |
Native Keeper is primarily an internal HR platform used by employer administrators. It is not usually embedded on other websites or used publicly, so this Policy focuses on nativekeeper.com.
4. Why we use cookies
| Purpose | What it does |
|---|---|
| Strictly necessary | Keeps you logged in, remembers security preferences, protects against fraud, and enables the Service. |
| Functional | Remembers preferences such as language, theme, and dashboard layout. |
| Analytics | Helps us understand how the Service is used so we can improve it. |
| Performance and security | Detects errors, blocks abuse, and manages traffic. |
| Marketing (only with consent) | Measures marketing campaign effectiveness on our public marketing pages. |
5. Categories of cookies we use
We organise cookies into the categories shown in our consent banner.
5.1 Strictly necessary cookies
These cookies are essential for the Service to work. They cannot be switched off. They do not track you for marketing.
| Cookie name | Provider | Purpose | Duration |
|---|---|---|---|
| nk_session | Native Keeper | Maintains your logged-in session | Session |
| nk_csrf | Native Keeper | Protects against cross-site request forgery attacks | Session |
| nk_auth | Native Keeper | Authenticates your account | 30 days |
| sb-access-token, sb-refresh-token | Supabase | Authentication for the application backend | Session / 7 days |
| __cf_bm, cf_clearance | Cloudflare | Bot detection, DDoS protection, and security | 30 minutes / 30 days |
| __stripe_mid, __stripe_sid | Stripe | Fraud prevention on payment pages | 1 year / 30 minutes |
| nk_consent | Native Keeper | Records your cookie consent choices | 12 months |
Legal basis: These are exempt from the consent requirement under PECR Regulation 6(4) because they are strictly necessary for the service you requested.
5.2 Functional cookies
These cookies remember choices you make to provide a better experience. They are set only after you accept this category.
| Cookie name | Provider | Purpose | Duration |
|---|---|---|---|
| nk_locale | Native Keeper | Remembers your language preference | 12 months |
| nk_theme | Native Keeper | Remembers your light or dark mode setting | 12 months |
| nk_dashboard_prefs | Native Keeper | Remembers dashboard layout and filter preferences | 12 months |
| crisp-client/* | Crisp IM SAS | Keeps your support chat history available across sessions | 6 months |
Legal basis: Consent (PECR Regulation 6(1); UK GDPR Article 6(1)(a)).
5.3 Analytics cookies
These cookies help us understand how customers use the Service so we can improve it. They are set only after you accept this category.
| Cookie name | Provider | Purpose | Duration |
|---|---|---|---|
| ph_*_posthog, ph_session_* | PostHog | Traffic analytics and privacy-masked session replay on public marketing pages | 12 months |
| _vercel_analytics_* | Vercel | Anonymised web vitals and performance analytics on our marketing site | Session |
PostHog is used only after consent on public marketing pages. It records page journeys, campaign attribution, clicks and privacy-masked visual playback of page interactions. All input fields are masked before capture. Authenticated, portal, login, signup, registration, authentication and quote routes are technically excluded, and we do not use PostHog to record workforce records or customer account activity. Analytics identifiers are retained for no longer than 12 months unless earlier deletion is requested.
Legal basis: Prior consent under PECR Regulation 6(1) and UK GDPR Article 6(1)(a). Consent is optional and may be withdrawn at any time.
5.4 Marketing cookies
We do not currently use marketing or advertising cookies. If we add any, we will update this Policy and request consent before they are set.
Legal basis: Consent.
6. Third-party cookies and similar technologies
Some cookies are set by third parties whose services we use. They may process collected data under their own privacy policies.
| Third party | Role | More information |
|---|---|---|
| Cloudflare | Security and CDN | cloudflare.com/privacypolicy |
| Supabase | Authentication and database | supabase.com/privacy |
| Stripe | Payment processing | stripe.com/privacy |
| PostHog | Product analytics | posthog.com/privacy |
| Vercel | Hosting and analytics | vercel.com/legal/privacy-policy |
| Crisp | Support chat | crisp.chat/en/privacy |
Where these providers act as our Sub-processors, they are listed on our Sub-processors page. Where they set cookies on our site, they may also act as independent controllers for that limited purpose.
7. How to control cookies
7.1 Through our consent banner
On your first visit, you can allow optional analytics or continue with necessary cookies only. Both choices are presented with equal prominence. You can withdraw or change your choice at any time through "Cookie preferences" in the website footer. Withdrawing consent stops future collection; you may also ask us to delete identifiable analytics data collected under your consent.
7.2 Through your browser
Most browsers let you block all or third-party cookies, delete cookies when the browser closes, and remove existing cookies. Blocking strictly necessary cookies will prevent login and other core features from working.
7.3 Global Privacy Control (GPC)
We honour the Global Privacy Control browser signal as a request to opt out of any sale or sharing of Personal Data under CCPA/CPRA and apply it to non-essential cookie preferences.
7.4 Do Not Track (DNT)
Our PostHog analytics configuration respects supported Do Not Track browser signals. We also honour GPC as a request to keep non-essential analytics disabled.
8. Cookies and your other privacy rights
Cookies may involve processing Personal Data, such as an IP address. Your rights of access, deletion, objection, withdrawal of consent, and others therefore apply. See Section 10 of our Privacy Policy.
You can withdraw cookie consent at any time through Cookie preferences. Withdrawal does not affect processing that was lawful before withdrawal.
9. A note about workforce data
These cookies relate only to your interactions with nativekeeper.com and the Native Keeper application as an account holder. They are not used to track or profile employees, workers, or other individuals whose records customers hold in the Service. Workforce data is governed by our Privacy Policy and DPA.
10. Changes to this Policy
We may update this Policy when cookies or tools change, a vendor changes its cookie behaviour, or law and regulatory guidance changes. For material changes, we will update the date above and re-prompt for consent where changes substantially affect non-essential cookies.
11. Contact us
Email: legal@nativekeeper.com
Postal address: NeonStack Ltd, The North Colchester Business Centre, 340 The Crescent, Colchester, England, CO4 9AD, United Kingdom
You may also complain to the Information Commissioner's Office or the supervisory authority in your country.