1. General provisions
Cookies are small files a website stores on your device. We also use local storage, which works in a similar way. This notice covers both across bravolisa.lu and app.bravolisa.lu.
We use two kinds:
- Necessary – you cannot sign in or use BravoLisa without them. These are set as soon as you arrive, and EU law does not require us to ask first.
- Analytics – Google Analytics, which tells us how the product is used. These are not set unless you say yes. Refusing is as easy as accepting, and you can change your mind at any time.
We do not use advertising or marketing cookies, we do not build profiles, and we do not sell or share cookie data.
BravoLisa is operated by the person or entity named in our About Us section. Our Privacy Policy explains how we handle personal data more broadly.
2. Where your data stays on your device
Our tax calculator and free invoice generator run in your browser. Whatever you type into them stays on your device – we do not receive, store or see it.
3. Necessary cookies
These are set without asking, because BravoLisa cannot work without them.
| What | Who sets it | Purpose | How long |
|---|---|---|---|
| __session | Clerk | Holds the signed token that proves you are logged in, so our servers know it is you. It is sent with your requests and cannot be read by scripts in your browser. | Your session; refreshed while you stay active |
| __client_uat | Clerk | A timestamp that lets the page tell whether you are signed in without asking our servers. It holds no information about you. | 1 year, renewed on each visit |
| _cfuvid | Cloudflare | Tells apart visitors sharing the same internet connection, so our security and rate limiting do not block the wrong person. Set by Cloudflare’s network, not by us. It is not used to track you across other websites. | Your session |
Clerk and Cloudflare are separate companies acting for us. They may handle this data outside the EEA. Our Privacy Policy sets out the safeguards that apply to international processing.
4. Analytics cookies – only if you agree
We use Google Analytics 4 to see which features are used and where people get stuck. Google Analytics is not loaded and its analytics cookies are not placed until you accept analytics cookies.
| What | Purpose | How long |
|---|---|---|
| _ga | A random number that lets Google Analytics recognise your browser on a return visit, so we can count visitors rather than page loads. | 2 years (some browsers shorten this) |
| Google Analytics session cookie(s) | Keeps track of the current visit, such as when it started, how long it lasted and what was viewed. The exact cookie name can vary with the Google Analytics implementation. | 2 years |
| Short-lived Google Analytics cookie(s), where set | Helps distinguish visitors over a short window. The exact cookie name may vary with the Google Analytics implementation. | 24 hours |
The random number in these cookies counts as personal data under the GDPR, even though it does not carry your name. Google Analytics is run by Google, which may process this data outside the EU. See Google’s description of these cookies and our Privacy Policy for the transfer safeguards.
If you say no, we simply do not measure your visit. Nothing about BravoLisa changes.
5. Acceptance and refusing cookies
The first time you arrive, a banner gives you equally prominent options to Accept all, Reject all or Manage settings. Accepting and refusing each take one click, refusing is not hidden behind extra steps, and nothing is pre-ticked.
To change your answer later, use the Cookie settings link in the footer. Withdrawing is as easy as giving consent. Withdrawal applies going forward; it does not undo measurement that already happened before you changed your mind.
We keep a record of what you chose and when, because we have to be able to show that consent was properly obtained.
6. Other third parties
6.1 Contact and waiting-list forms
Our contact and waiting-list forms are run by Formspree, a US company. When you submit one, Formspree receives your name, email address, message and IP address so we can read your enquiry. Formspree processes this for us under a signed data processing agreement.
6.2 Fonts and embedded content
Our fonts come from our own servers. No third party is contacted and no cookie is set.
Embedded video, where we use it, loads only when you choose to play it. That provider may then set its own cookies under its own notice.
6.3 Payments
When paid plans launch, Stripe processes payments and may set cookies needed to complete a payment and prevent fraud.
7. Turning cookies off in your browser
You can block or delete cookies and local storage in your browser settings. This is separate from the consent banner and covers everything, including the necessary cookies.
Blocking the necessary ones will sign you out and may stop you signing in at all. It does not delete anything in your BravoLisa account. Clearing browser storage may also delete unsaved drafts held on your device, and it clears your cookie choice, so the banner will ask again.
8. Legal basis, contact, changes
Necessary cookies rely on the exemption in Article 5(3) of the ePrivacy Directive; the related personal data is processed to perform our contract with you and to keep BravoLisa secure (Article 6(1)(b) and (f) GDPR). Analytics cookies are placed and read on the basis of your consent under Article 5(3) ePrivacy, and the resulting personal data is processed on the basis of that same consent (Article 6(1)(a) GDPR).
Questions: privacy [at] bravolisa [dot] lu. Our full details are in About Us.
You can complain to the Luxembourg supervisory authority: CNPD, 15 boulevard du Jazz, L-4370 Belvaux, www.cnpd.public.lu.
We update this notice when our technologies, providers or the law change. The date at the top shows the last change.