Cookie Policy
Last updated: August 27, 2026
This Cookie Policy explains how HAIEC (“HAIEC,” “we,” “us”) uses cookies and similar technologies on haiec.com. This policy supplements our Privacy Policy.
Summary
- We use essential cookies required for the platform to function
- We use privacy-focused analytics (Vercel Analytics) that do not use cookies for tracking
- On the public marketing site we use RB2B, which sets first-party cookies to identify the company a visitor belongs to (see Section 4). A cookie notice is displayed on the public marketing site. RB2B does not run on authenticated product areas (dashboard, admin, account, etc.)
- We do not use advertising cookies or cross-site tracking cookies
- We do not sell data collected via cookies
1. What Are Cookies?
Cookies are small text files stored on your device when you visit a website. They are used to remember your preferences, maintain your session, and provide essential functionality.
“Similar technologies” include localStorage and sessionStorage, which serve similar purposes but are stored differently in your browser.
2. Cookies We Use
Essential Cookies (Strictly Necessary)
These cookies are required for the platform to function. They cannot be disabled.
| Cookie | Purpose | Duration | Provider |
|---|---|---|---|
| next-auth.session-token | Maintains your authenticated session | Session (expires on browser close or after 24 hours) | HAIEC (NextAuth.js) |
| next-auth.csrf-token | Prevents cross-site request forgery attacks | Session | HAIEC (NextAuth.js) |
| next-auth.callback-url | Stores the return URL after authentication | Session | HAIEC (NextAuth.js) |
| __Secure-next-auth.session-token | Secure session token (HTTPS only) | Session | HAIEC (NextAuth.js) |
Local Storage (Similar Technologies)
We use browser localStorage for the following purposes:
| Key | Purpose | Data Stored |
|---|---|---|
| Wizard progress | Saves compliance wizard progress so you can resume later | Encrypted assessment responses (no PII) |
| UI preferences | Remembers sidebar state, theme preferences | UI configuration only |
| Demo state | Tracks onboarding demo progress | Step index and completion status |
| Scan preferences | Remembers email notification preferences for scans | Boolean toggle value |
3. Cookies We Do NOT Use
- Advertising cookies: We do not run ads or use advertising tracking pixels.
- Cross-site tracking cookies: We do not track your activity across other websites. RB2B’s cookies are first-party (scoped to
haiec.com) and are not used to follow you elsewhere. - Fingerprinting: We do not use browser fingerprinting techniques.
4. Analytics
Vercel Analytics
We use Vercel Analytics for privacy-focused web analytics. Vercel Analytics:
- Does not use cookies for tracking
- Does not collect personally identifiable information
- Collects only anonymized, aggregated page view data
- Is compliant with GDPR, CCPA, and PECR without requiring cookie consent
RB2B (Visitor Identification)
On the public marketing site only (e.g. home, product, research, pricing, and contact pages), we use RB2B to understand which companies are showing interest in HAIEC. RB2B:
- Sets first-party cookies on the
haiec.comdomain to recognize returning visitors and identify the company they belong to - Loads only on public marketing pages — it does not run on authenticated product areas (dashboard, admin, account, settings, login, or API routes)
- Does not run in development, test, CI, or on preview deployments — only on the production
haiec.comdomain - Does not use advertising cookies and does not track your activity across other websites
- Person-level identification is supported by RB2B only within the United States
RB2B’s privacy policy is available at https://www.rb2b.com/privacy-policy.
5. Third-Party Service Cookies
The following third-party services may set their own cookies when you interact with their features:
| Service | When Used | Cookie Policy |
|---|---|---|
| Stripe | During payment processing (checkout page only) | https://stripe.com/privacy |
| GitHub | During OAuth login flow | https://docs.github.com/en/site-policy/privacy-policies |
| During OAuth login flow | https://policies.google.com/privacy |
6. Managing Cookies
You can manage cookies through your browser settings. Most browsers allow you to:
- View what cookies are stored and delete them individually
- Block third-party cookies
- Block all cookies from specific sites
- Block all cookies entirely
- Delete all cookies when you close your browser
Note: Blocking essential cookies will prevent you from logging in to HAIEC. The platform requires session cookies to function.
7. Legal Basis (GDPR / ePrivacy)
- Essential cookies: Set under the “strictly necessary” exemption (Article 5(3) ePrivacy Directive). No consent required.
- Vercel Analytics: Does not use cookies and processes only anonymized data. No cookie consent required under ePrivacy Directive.
- RB2B (visitor identification): Sets first-party cookies on the public marketing site to identify the company a visitor belongs to. RB2B is scoped to public marketing pages only and does not run on authenticated product areas. We display a cookie notice on the public marketing site informing visitors of cookie usage. Opt-out is available at https://app.retention.com/optout(and at https://www.rb2b.com/rb2b-gdpr-opt-out for GDPR international opt-out).
Questions?
For questions about our cookie practices:
- Email: privacy@haiec.com
- General: contact@haiec.com