NECESSITYWORKS, INC. — COOKIE NOTICE

Version: 1.0 Published at: https://necessityworks.com/legal/cookies Applies to: necessityworks.com and related NW-operated web properties Effective Date: Effective on the date first published at the URL above; current revision date appears in §9.

---

NECESSITYWORKS COOKIE NOTICE

This Cookie Notice describes how NecessityWorks, Inc. (“NW,” “we”) uses cookies and similar technologies on necessityworks.com and related web properties. It supplements our Privacy Policy.

1. What Are Cookies?

Cookies are small text files placed on your device by the websites you visit. Similar technologies include pixels, tags, local storage, session storage, SDKs, and fingerprinting techniques. We refer to all of these as “cookies” throughout this Notice.

2. How We Use Cookies

We use a deliberately small set of cookies, limited to operating the site and protecting it against abuse. We use cookies to:

• Operate the site (authentication, session management, CSRF protection)
• Protect against bots, abuse, and denial-of-service attacks
• Remember your consent preferences
• Process payments at checkout (Stripe-set cookies during the checkout flow)

We do not currently use analytics cookies, marketing/advertising cookies, behavioral tracking, cross-site tracking, social-widget cookies, video-embed cookies, or fingerprinting beyond what is necessary for security. If we add any of these in the future, this Notice will be updated and you will be presented with an opportunity to consent (where required).

3. Cookie Categories

We currently deploy only Strictly Necessary cookies. The categories below describe what we may deploy if we expand our cookie footprint; each non-essential category would be gated behind opt-in consent (in jurisdictions where required) before any cookie in that category is set.

3.1 Strictly Necessary

These cookies are required for the site to function and are set without consent (consistent with ePrivacy and CCPA exceptions for strictly necessary cookies). You cannot disable them without making parts of the site unusable. Examples: authentication, session, CSRF protection, security and bot mitigation, payment checkout.

3.2 Functional (not currently deployed)

These cookies would remember your preferences (e.g., language, region, accessibility options).

3.3 Analytics / Performance (not currently deployed)

These cookies would help us understand site usage. We are not currently using Google Analytics, Plausible, Mixpanel, Fathom, PostHog, or any other analytics provider. If we add analytics, we will (a) update this Notice, (b) prefer first-party analytics where practical, and (c) gate non-essential analytics behind opt-in consent in the EEA/UK/Switzerland.

3.4 Marketing / Advertising (not currently deployed)

These cookies would deliver advertising relevant to you and measure marketing effectiveness. We do not currently use any marketing or advertising cookies (no Meta Pixel, no LinkedIn Insight Tag, no Google Ads conversion tags, no retargeting pixels). If we add any in the future, this Notice will be updated and opt-in consent will be required before any such cookie is set in the EEA/UK/Switzerland or for users who have exercised “do not sell/share” rights under CCPA and analogous state laws.

4. Cookie Inventory

The following is our current inventory. We update this list when cookies change.

Cookie / Technology	Category	Purpose	First-party / Third-party	Retention
nw_session	Strictly Necessary	Maintain Authorized User session in the Platform	First-party	Session (cleared on browser close or logout)
nw_csrf	Strictly Necessary	Cross-site request forgery (CSRF) token	First-party	Session
__cf_bm, cf_clearance	Strictly Necessary	Cloudflare bot management and rate-limiting (sole purpose: distinguishing humans from automated traffic)	Third-party (Cloudflare)	30 minutes (__cf_bm); up to 1 year (cf_clearance)
Stripe checkout cookies (__stripe_mid, __stripe_sid)	Strictly Necessary	Set by Stripe during the checkout flow for fraud detection and payment processing. Only set when you actively engage Stripe checkout.	Third-party (Stripe)	1 year (__stripe_mid); 30 minutes (__stripe_sid)
Google Workspace form cookies (where embedded)	Strictly Necessary	Set by Google when you submit a contact / marketing form hosted by Google Forms. Only set if you submit such a form.	Third-party (Google)	Per Google’s published policy

That is the complete current inventory. If any item not in this list appears on necessityworks.com, it was deployed in error — please report to [email protected].

5. Managing Your Preferences

5.1 Consent Banner

Because we currently use only Strictly Necessary cookies, we do not display an interruptive consent banner. If and when we add non-essential cookies, we will deploy a consent banner that lets you accept, reject, or customize non-essential cookies. You will be able to revisit your choices anytime via a “Cookie Preferences” link in the footer.

5.2 Browser Controls

Most browsers let you block or delete cookies via their settings. Blocking strictly necessary cookies will prevent NW’s site and Platform from working (e.g., you will not be able to log in or check out).

5.3 Global Privacy Control (GPC)

We honor the Global Privacy Control (GPC) signal as an opt-out of “sale” / “sharing” for advertising purposes, in line with California law (and similar state laws). Because we do not currently sell or share Personal Data (see Privacy Policy §7.2), the GPC signal currently has no operational effect — but it is recognized and recorded for the user’s account.

5.4 Industry Opt-Out Tools (informational)

If we later add interest-based advertising cookies, you will also be able to use:

• Digital Advertising Alliance (DAA): https://optout.aboutads.info/
• Network Advertising Initiative (NAI): https://optout.networkadvertising.org/
• European Interactive Digital Advertising Alliance (EDAA): https://www.youronlinechoices.eu/

5.5 Mobile

If you access the site from a mobile device, you can limit interest-based advertising in your device settings (“Limit Ad Tracking” on iOS; “Opt out of Ads Personalization” on Android).

6. Do Not Track (DNT)

Because there is no industry consensus on how to respond to “Do Not Track” browser signals, we do not respond to them in a manner different from our default. We do honor GPC signals (see §5.3).

7. Third-Party Cookies and Services

The third-party cookies in our current inventory (§4) are limited to Cloudflare (bot mitigation), Stripe (payment processing), and Google (where you submit a contact form). These third parties collect and process data according to their own privacy policies:

• Cloudflare: https://www.cloudflare.com/privacypolicy/
• Stripe: https://stripe.com/privacy
• Google: https://policies.google.com/privacy

When you interact with those services, you may be subject to their terms.

8. Regional Specifics

8.1 EEA / UK / Switzerland

Under the ePrivacy Directive (as transposed locally) and GDPR / UK GDPR / Swiss FADP, strictly necessary cookies do not require consent; non-essential cookies do. Because we currently use only strictly necessary cookies, we do not display a cookie consent banner. If we add non-essential cookies, the consent banner will offer granular opt-in choice.

8.2 California

California residents may opt out of “sale” or “sharing” of Personal Data via the GPC signal or by emailing [email protected]. As of the date of this Notice, NW does not sell or share Personal Data through cookies; this opt-out is recorded for future-proofing.

8.3 Other US States

Residents of other states with comprehensive privacy laws (e.g., Virginia, Colorado, Connecticut, Texas, Oregon, Utah, Delaware) can exercise analogous rights. See our Privacy Policy §7.2.

9. Changes to This Notice

We’ll update this Notice as our cookie use changes. Material changes will take effect no earlier than thirty (30) days after they are posted, unless a shorter period is required by law. Please check the revision date at the top.

10. Contact

For questions about this Cookie Notice: [email protected]