Cookie Policy

Effective date: 18 May 2026 — Version 1.3 (updated 20 August 2026)

Short version: We set two strictly necessary HTTP cookies for authentication and cross-domain session detection. A third cookie stores your language preference if you switch languages. We also store your consent choice and, only if you accept analytics, a PostHog visitor ID in your browser's localStorage. Advertising measurement is a separate, off-by-default permission: nothing advertising-related is loaded or stored unless you switch it on, and we never use it to track you across other websites or to build advertising audiences.

Last audited: 28 May 2026 — Production audit of pennapay.com and app.pennasystems.com via browser DevTools inspection (pre- and post-consent flows verified; cookies and localStorage inspected before consent, after Accept, and after Decline).

1. What is a cookie?

A cookie is a small text file stored on your device by your browser when you visit a website. Cookies help websites remember your preferences or keep you logged in. Under GDPR and the Danish cookie rules derived from the ePrivacy Directive (EU 2002/58/EC, as amended by 2009/136/EC), we must tell you which cookies we use and obtain your consent for any cookies that are not strictly necessary.

This policy also covers localStorage identifiers, which have the same privacy impact as cookies and are treated equivalently under current EDPB guidance.

2. Cookies we set

PennaSystems classifies cookies and similar client-side identifiers according to the four categories established under the ePrivacy Directive and EDPB guidance:

Strictly necessary — required for the platform to function (e.g. keeping you logged in, remembering your language). No consent required (ePrivacy Directive Art. 5(3) exemption for technically necessary storage).
Functional — improve usability without being essential (e.g. remembering UI preferences). Consent required where they are not strictly necessary.
Analytics — measure how the platform is used. Consent required for non-anonymous analytics or where the identifier persists across sessions.
Marketing / advertising — used for advertising purposes. Always require your consent, are declined by default, and can be withdrawn at any time. You can grant this category together with analytics using Accept all, or grant it on its own — or refuse it on its own — from the granular toggles under Manage preferences. We do not use this category to track you across other websites, to build advertising audiences, or to retarget you.

PennaSystems sets strictly necessary cookies (listed in the table below) and uses one consent-gated analytics identifier (the PostHog visitor ID, stored in browser localStorage rather than as a cookie — see §3 below). We do not set functional cookies (UI preferences such as theme and builder layout are stored in localStorage, not in cookies). The only advertising cookies that can ever appear are the Google Ads conversion cookies described in §6, they appear only after you grant the advertising-measurement permission, and no other advertising or retargeting technology is used on this site.

The following table lists every HTTP cookie set by pennapay.com, app.pennasystems.com, and pennasystems.com.

Name	Domain	Category	Purpose	Lifetime	HttpOnly	Set by
`access_token`	app.pennasystems.com	Strictly necessary	Stores your JSON Web Token (JWT) authentication credential. Required to keep you logged in. HttpOnly prevents JavaScript access; Secure flag ensures HTTPS-only transmission.	30 days (or until logout)	Yes	Server
`ps_session`	.pennasystems.com	Strictly necessary	Session presence flag — value is always `1` and contains no personal data or auth credentials. Allows pennasystems.com to detect that you are logged in and update its button from "Sign in" to "Open dashboard". Set and cleared alongside `access_token`.	30 days (or until logout)	No	Server
`penna-locale`	pennapay.com, app.pennasystems.com	Strictly necessary	Stores your chosen display language (`en` or `da`). Only set when you explicitly click the language toggle — not set automatically. Allows your preference to persist across page loads.	1 year	No	Client (lang-toggle.js)
`_gcl_`, `_gac_`	pennapay.com, app.pennasystems.com	Advertising — consent required	Google Ads conversion measurement: records that a visit originated from one of our advertisements, so a later signup can be matched to it. Set by Google's conversion tag, and only after you switch on the Advertising measurement permission described in §6. If you have not granted that permission, the tag is never loaded and these cookies are never created. They contain no name or email address, and they are not used to build advertising audiences or to retarget you.	Up to 90 days (Google's default), or immediately deleted when you withdraw the permission	No	Google (conversion tag, consent-gated)

That is the complete list of HTTP cookies. Apart from the consent-gated Google Ads conversion cookies in the last row, we set no advertising cookies, no retargeting cookies and no cross-site tracking cookies of any kind — and that last row stays empty on your device unless you switch the permission on yourself.

3. localStorage items we store

In addition to HTTP cookies, we store the following items in your browser's localStorage. These are not transmitted to our servers with every request, but they persist across browser sessions until cleared.

Key	Domain	Category	Purpose	Lifetime	Set by
`cookie_consent_v2`	pennapay.com, app.pennasystems.com	Strictly necessary	Records your consent choices (analytics on/off, advertising measurement on/off, timestamp, schema version). Required to remember your decision and avoid showing the banner on every visit. The consent record itself is exempt from the consent requirement under the ePrivacy Directive.	Persistent (until you clear localStorage or the banner resets)	cookie-banner.js (set when you interact with the consent banner)
`ph_{key}_posthog`	pennapay.com, app.pennasystems.com	Analytics — consent required	PostHog visitor state: a random device ID and session identifiers used to understand how the product is used. Contains no name, email, or other directly identifying information for anonymous visitors. Only stored after you accept analytics.	Persistent (removed immediately if you withdraw consent)	PostHog library (only initialized after you accept analytics)

If you decline analytics, only cookie_consent_v2 is stored in localStorage. The ph_* key is never created.

4. Analytics tools we use

PostHog Analytics

We use PostHog (PostHog, Inc., EU Cloud) for product and web analytics. PostHog:

Stores a random visitor ID in your browser's localStorage (the ph_{key}_posthog entry above). It does not set HTTP cookies.
Does not collect or store IP addresses in identifiable form.
Records: page URL, referrer domain, country (country-level only), browser family, device type, and in-app feature usage events.
For logged-in users, events are linked to your PennaSystems account ID so we can understand how features are used.
All data is stored on EU servers (AWS eu-central-1, Frankfurt). No data leaves the EU.
No advertising profiles are created. No data is sold or shared with third parties for advertising.

PostHog is only initialized after you grant analytics consent. You can clear the PostHog visitor ID at any time by withdrawing consent below or by clearing localStorage for our domains in your browser's developer tools (Application → Local Storage → delete the ph_* key). PostHog privacy policy →

Cloudflare Web Analytics

We use Cloudflare Web Analytics as a secondary analytics layer. It:

Sets no cookies and creates no client-side identifiers — it does not fingerprint browsers.
Records aggregate metrics only: page loads, performance timings, error rates.
Because it creates no persistent client-side identifier, it is loaded without requiring consent under the ePrivacy strictly-necessary exemption.
Data is processed by Cloudflare (USA) under Standard Contractual Clauses.

Cloudflare privacy policy →

5. Cookies set by subprocessors during checkout

When you initiate a paid subscription, Stripe's checkout page may set Stripe-specific cookies on its own domain. These are governed by Stripe's cookie policy, not ours. We have no control over them once you are on Stripe's checkout page.

6. Third-party cookies and advertising

Apart from the consent-gated Google Ads conversion tag described immediately below, we embed no third-party advertising scripts, social media widgets, or tracking pixels. No other third-party HTTP cookie is set by any content originating on our pages.

If you follow a link from our site to a third party (e.g. Stripe's payment page), that third party may set its own cookies governed by its own cookie policy.

Google Ads conversion measurement

We use a single Google Ads conversion tag, and only to answer one question: did someone who clicked one of our advertisements go on to create an account. It is the only advertising technology on this site.

It is governed by two independent switches, and it runs only when both are on. The first is yours: the Advertising measurement permission, described in §7. The second is ours: a server setting that determines whether an advertising account is configured at all. When that server setting is off, no Google host is permitted by our Content Security Policy and no request reaches Google from any visitor, whatever they have consented to. Turning it on is a material change to this policy: we announce it in our legal changelog at least 14 days before it takes effect (§10), so that changelog — not this paragraph — is the authoritative record of whether we are currently advertising.

This is what does and does not happen, in both states:

Without your permission, nothing is requested from Google at all. We use Google's basic consent mode, which means the tag is not loaded before consent — not even in the cookieless "consent signal" form that Google's advanced mode permits. Refusing costs you nothing and hides nothing: every part of this site works identically either way.
The permission is declined by default. It is granted only if you choose Accept all on the cookie banner, which names advertising measurement as one of the things it turns on, or if you switch that single category on under Manage preferences. Reject all leaves it off, and so does ignoring the banner.
With the permission on, Google Ads sets its own cookies (names beginning _gcl_ and _gac_) so that a signup can be matched to the advertisement that led to it. Google acts as an independent controller for the data it receives through that tag; its use of it is governed by Google's own privacy terms, not by ours.
Ad personalisation and remarketing stay switched off even after you consent. We measure whether an advertisement worked; we do not build advertising audiences and we do not retarget you elsewhere. This is enforced in our own code, not left to a setting in an advertising console.
We do not use Enhanced Conversions and do not send your email address, hashed or otherwise, to Google.
Switching the permission back off deletes those cookies immediately and instructs Google to stop using advertising storage. This runs on every page load while the permission is off, so withdrawal is enforced and not merely recorded.
If we ever widen what this tag does, we will update this policy first, on the notice period described in section 10.

7. Your consent

The strictly necessary items listed in Sections 2 and 3 (access_token, ps_session, penna-locale, cookie_consent_v2) do not require your consent under GDPR Art. 6(1)(b) (performance of a contract) and the ePrivacy Directive exemption for technically necessary cookies.

Cloudflare Web Analytics sets no cookies and creates no client-side identifiers; it operates without consent under the ePrivacy strictly-necessary exemption.

PostHog stores a random visitor ID in localStorage. PostHog is only initialized after you grant analytics consent on the cookie banner.

The banner offers three choices, and every optional category is declined until you choose — closing or ignoring the banner grants nothing:

Accept all — grants both optional categories: analytics and advertising measurement. The banner names both before you press it.
Reject all — grants neither. It is presented with the same size, weight and prominence as Accept all; refusing is exactly as easy as accepting, and costs you no functionality.
Manage preferences — a separate on/off control for each category, so you can grant analytics without advertising, or advertising without analytics. Nothing is pre-ticked.

You may change or withdraw any of these choices at any time, without giving a reason and without affecting the lawfulness of what happened before you withdrew. Withdrawing the advertising permission also deletes the associated cookies (§6). Use the button below, or the link in the site footer:

8. How to control or delete cookies

You can control and delete cookies at any time through your browser settings:

Chrome: Settings → Privacy and security → Cookies and other site data
Firefox: Settings → Privacy & Security → Cookies and Site Data
Safari: Preferences → Privacy → Manage Website Data
Edge: Settings → Cookies and site permissions → Cookies and site data

Impact of deleting specific items:

Deleting access_token will log you out of PennaSystems.
Deleting ps_session will hide the "Open dashboard" shortcut on pennasystems.com until your next login.
Deleting penna-locale will reset your language to your browser's default on next visit.
Deleting cookie_consent_v2 from localStorage will cause the consent banner to reappear on your next visit.
Deleting ph_* keys from localStorage removes your PostHog visitor ID.
Deleting _gcl_* or _gac_* cookies removes Google Ads' record of which advertisement led you here. They exist on your device only if you granted the advertising-measurement permission; withdrawing it deletes them for you.

9. Do Not Track

We do not track you across other websites, build advertising profiles, or share your browsing with data brokers — with or without a Do Not Track signal, and whatever you have consented to here. Our practices therefore already align with what DNT requests, and we do not alter our behaviour in response to the signal. The advertising-measurement permission in §6 does not change this: it measures whether one of our own advertisements led to a signup on our own site, and it is off unless you switch it on.

10. Changes to this policy

If we add new cookies or materially change how we use existing ones, we will update this policy and display a notice on the site at least 14 days before the change takes effect. Registered users will also be notified by email if the change affects the authenticated application.

11. Contact

Questions about our use of cookies or this policy:
PennaSystems (CVR 46522036)
privacy@pennapay.com
We respond within 5 business days.

You may also contact Datatilsynet (the Danish Data Protection Agency) at [email protected] if you wish to lodge a complaint about how we use cookies or process personal data, or you may contact the supervisory authority in your EU/EEA country of residence.