Cookie Policy
This Cookie Policy ("Policy") explains how Nxera Digital LLC ("Nxera," "we," "us," "our") uses cookies and similar tracking technologies on: getnxera.com and all of its subdomains; the plan pages and member pages Nxera hosts in a client's name at getnxera.com/m/ and on custom domains (each, a "Plan Page"); and the Nxera client portal (collectively, the "Sites"). This Policy is incorporated into the Nxera Privacy Policy and the Nxera Terms of Service.
By accessing or using the Sites, you acknowledge that you have read this Policy. Where consent is required by applicable law, your continued use after notice constitutes acceptance to the extent permitted by law.
1. What Are Cookies and Similar Technologies?
A "cookie" is a small text file placed on your device when you visit a website. Cookies allow the website to recognize your device and remember information about your visit. We also use similar technologies including local storage, session storage, server-side log files, and tag-manager scripts (collectively with cookies, "Tracking Technologies"). For brevity we refer to all of them as "cookies" in this Policy.
Cookies can be:
- First-party (set by the domain you are visiting) or third-party (set by another domain whose content is loaded on the page);
- Session (deleted when you close your browser) or persistent (remain until they expire or you delete them);
- Strictly necessary, functional, analytics, or advertising (we do not use advertising cookies).
2. Categories of Cookies We Use
2.1 Strictly Necessary Cookies
These cookies are essential for the Sites to function. Without them, you cannot sign in, complete a checkout, maintain a session, or use core features. Strictly necessary cookies do not require consent under any applicable law.
| Cookie / Token | Purpose | Provider | Duration |
|---|---|---|---|
nx_portal_session |
Keeps you signed in to the client portal (HttpOnly) | Nxera (first-party) | Up to 30 days, extended while you use the portal |
sb-access-token, sb-refresh-token |
Sign-in for the legacy subscriber account page | Supabase Auth (first-party) | Session / 30 days |
cf_clearance, __cf_bm |
Bot check on our forms (Cloudflare Turnstile) and fraud prevention | Cloudflare (third-party) | Up to 30 minutes |
__stripe_mid, __stripe_sid |
Payment-form security and fraud prevention on Stripe-hosted checkout and billing pages | Stripe (third-party) | Up to 1 year / 30 minutes |
| Sign-in link and claim tokens | Single-use tokens in the links we email you; not stored as cookies | Nxera (first-party) | Until used or expired |
2.2 Functional Cookies
These cookies remember your preferences and improve your experience. They are not strictly necessary but materially improve usability.
| Cookie / Storage | Purpose | Duration |
|---|---|---|
nxera_dismissed_notices |
Remembers banners or notices you have dismissed | 1 year |
| Local storage entries on the portal | Remembers the tab or segment you last opened | Until cleared |
2.3 Analytics Cookies
We use Google Analytics 4, loaded through Google Tag Manager, on getnxera.com marketing pages to understand how visitors use the Sites and which pages lead to a scan request or a checkout. GA4 sets first-party cookies and sends page, event, and device data to Google. We have IP anonymization enabled and we do not use GA4 for advertising or remarketing. We read GA4 reports in aggregate through the Google Analytics Data API.
| Cookie | Purpose | Provider | Duration |
|---|---|---|---|
_ga |
Distinguishes visitors | Google Analytics (first-party) | Up to 2 years |
_ga_<container id> |
Keeps session state | Google Analytics (first-party) | Up to 2 years |
| Server-side request logs | Page views, traffic sources, conversion events (aggregated) | Nxera | Per the Privacy Policy log retention |
We do not use Facebook Pixel, TikTok Pixel, LinkedIn Insight Tag, or any third-party advertising or remarketing tracker on the Sites.
2.4 Advertising/Marketing Cookies
We do not currently use advertising or marketing cookies on the Sites. If we ever introduce them, we will update this Policy, deploy a consent banner where required, and provide a clear opt-out before activation.
2.5 Error Reporting
getnxera.com sends error reports to Sentry so we can fix problems. Sentry does not set cookies on the Sites; an error report can include the page, browser, and IP address at the time of the error.
3. Cookies on Plan Pages
Plan Pages at getnxera.com/m/ and on custom domains are shown in the name of the Client operating them. The cookies set on those pages are: (a) Strictly necessary cookies set by Nxera infrastructure (Cloudflare Turnstile on forms, the page framework); (b) Cookies set by Stripe when a member proceeds to Stripe-hosted checkout or the Stripe billing portal; (c) No analytics cookies: Plan Pages do not load Google Tag Manager or Google Analytics.
Nxera controls which cookies a Plan Page sets; Clients cannot add third-party widgets or trackers to a Plan Page. Visitors and members should consult the Client's own privacy notice for anything beyond what this Policy describes.
4. Your Choices
4.1 Browser Controls
You can configure your browser to refuse some or all cookies, to delete existing cookies, or to alert you when cookies are being set. Each browser is different; consult your browser's help documentation. Disabling strictly necessary cookies will prevent the Sites from functioning correctly, including preventing sign-in and checkout.
4.2 Google Analytics Opt-Out
You can prevent GA4 from collecting data about your visits by installing the Google Analytics opt-out browser add-on (https://tools.google.com/dlpage/gaoptout) or by blocking the _ga cookies in your browser.
4.3 Do Not Track (DNT)
Some browsers send a "Do Not Track" (DNT) signal. There is no industry consensus on how to interpret DNT signals; we do not currently respond to DNT signals. We do, however, refrain from selling or sharing Personal Data and we honor opt-out signals required by applicable law as described below.
4.4 Global Privacy Control (GPC)
Where required by applicable law (for example for California residents under CCPA/CPRA), we honor the Global Privacy Control signal as a valid request to opt out of the sale or sharing of Personal Data. As stated in our Privacy Policy, we do not sell or share Personal Data, so the practical effect of GPC on our practices is limited; we still log GPC signals received as a record of compliance.
4.5 California Residents (CCPA/CPRA)
California residents have additional rights under the CCPA/CPRA, including the right to opt out of the sale or sharing of personal information. Nxera does not sell or share personal information and does not use cookies for cross-context behavioral advertising, so no separate sale/share opt-out mechanism is required for cookie data. To exercise other CCPA rights (access, deletion, correction, portability), see our Privacy Policy.
4.6 Other US States
Residents of states with comprehensive privacy laws (Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Tennessee, Indiana, Florida, Delaware, New Jersey, New Hampshire, Maryland, Minnesota, Rhode Island, and any others as they take effect) have equivalent rights as described in our Privacy Policy.
4.7 Future International Compliance
Nxera currently provides Services to U.S. Clients. If we expand to jurisdictions that require explicit prior consent for non-essential cookies (such as the European Union under GDPR/ePrivacy, the United Kingdom under PECR, Brazil under LGPD, or Canada under PIPEDA), we will deploy a consent banner that meets local requirements before enrolling Clients in those jurisdictions.
5. Third-Party Cookies and Data Recipients
The following third parties may set cookies on the Sites or receive cookie-related data:
| Provider | Purpose | Privacy Policy |
|---|---|---|
| Google LLC | Google Analytics 4 and Google Tag Manager; font delivery | https://policies.google.com/privacy |
| Cloudflare, Inc. | Turnstile bot check on forms | https://www.cloudflare.com/privacypolicy |
| Stripe, Inc. | Checkout, billing portal, fraud prevention | https://stripe.com/privacy |
| Supabase, Inc. | Sign-in for the legacy account page, database | https://supabase.com/privacy |
| Vercel Inc. | Hosting and content delivery | https://vercel.com/legal/privacy-policy |
| Functional Software, Inc. (Sentry) | Error reporting, getnxera.com and the Nxera owner app | https://sentry.io/privacy/ |
| jsDelivr (Prospect One s.r.o.) | Script CDN on some pages; receives your IP address when a script loads | https://www.jsdelivr.com/terms/privacy-policy-jsdelivr-net |
We do not control these third parties or their cookie practices. We recommend reviewing their privacy policies. The current Sub-processor list is also published in the Data Processing Addendum and at getnxera.com/sub-processors.
6. How Long We Retain Cookie Data
Cookie data is retained for the duration of the cookie as listed in Section 2 (or for the period stated by the third-party provider). GA4 event data is retained in Google Analytics for fourteen (14) months. Aggregated server-side analytics data is retained on the same schedule as application logs (up to 24 months) per our Privacy Policy.
7. Disputes
Any dispute arising out of or relating to this Policy is subject to the dispute-resolution provisions in Section 16 of the Terms, including binding individual arbitration, class-action waiver, and the one-year limitations period.
8. Updates to This Policy
We may update this Policy from time to time to reflect changes in the cookies we use or applicable law. Material changes will be communicated by email or by posting a notice on the Sites at least thirty (30) days before they take effect.
9. Contact
Questions about cookies: info@getnxera.com (subject line: "Cookie Question")
Nxera Digital LLC 1201 E Ponce De Leon Blvd Coral Gables, FL 33134
This Cookie Policy was last updated on September 1, 2026. Version 3.0.