1. General provisions
Cookies are small files stored on your device. Websites may also use local storage, session storage and similar technologies to store or access information on your device. This Notice applies to the websites and web apps listed in our About Us section, to the extent indicated there. Their features may differ. The tables below identify the sites and technologies they cover; a technology applies only to the site or service named in its description.
We use necessary technologies to provide functions you request. Google Analytics 4 and Microsoft Clarity cookies and storage are used only if you accept analytics, and Google Ads and DoubleClick technologies are used only if you accept marketing. We also use cookieless page counting on bravolisa.lu regardless of your choice; see section 4. You can accept or reject the optional categories, or choose between them in the settings.
We do not sell information collected through cookies or similar technologies. Third-party providers may process information as described below and in our Privacy Policy.
BravoLisa is operated by the person or entity named in our About Us section. Our Privacy Policy explains how we handle personal data more broadly.
2. Information stored on your device and in your account
Some tools, such as our tax calculator and free invoice generator, run in your browser. Information entered into those tools is processed on your device and is not sent to our servers. By contrast, data and drafts created in your BravoLisa account are stored on our servers; they are not stored as drafts on your device.
3. Necessary and functional technologies
These cookies and storage technologies support sign-in, security, the consent choice, checkout, app loading or preferences you select. We use them without asking for consent where they are strictly necessary to provide the service or feature you request.
| Technology and site | Purpose | How long |
|---|---|---|
| __session and __session_<suffix> (Clerk; app.bravolisa.lu; cookie) | Short-lived signed token used to keep you signed in. It is readable by the app’s JavaScript and sent to our API for authentication. | About 60 seconds; refreshed while signed in |
| __client_uat and __client_uat_<suffix> (Clerk; .bravolisa.lu; cookie) | Timestamp used by the app to determine whether a session exists without contacting the server. It contains no other user information. | Up to 400 days; renewed on app visits |
| __client (Clerk; clerk.bravolisa.lu; cookie) | Identifies the browser to Clerk so it can issue session tokens and keep you signed in. | Up to 400 days |
| __cf_bm (Cloudflare via Clerk; clerk.bravolisa.lu; cookie) | Supports Cloudflare bot management to help prevent sign-in requests from being blocked. | About 30 minutes |
| _cfuvid (Cloudflare via Clerk; clerk.bravolisa.lu; cookie) | Supports rate limiting by distinguishing visitors sharing an IP address. It is not used for cross-site tracking. | Your session |
| bl_cookie_consent (BravoLisa; .bravolisa.lu; cookie) | Remembers your choices for optional cookie categories so the banner does not appear on every visit. | 12 months |
The app also uses the following necessary or functional storage.
| Technology and site | Purpose | How long |
|---|---|---|
| __clerk_environment (Clerk; app.bravolisa.lu; local storage) | Caches sign-in configuration so the sign-in page can load faster. It contains no user data. | Until cleared |
| bl_signup_plan (BravoLisa; app.bravolisa.lu; local storage) | Carries the plan you selected from the Plans page through sign-up until onboarding records it. | A few minutes; deleted after use |
| billing:checkoutReturnTo (BravoLisa; app.bravolisa.lu; session storage) | Remembers which page to return to after Stripe checkout. | For the browser tab session; deleted after use |
| Service worker and Cache Storage (BravoLisa; app.bravolisa.lu) | Caches the app’s own code, styles and fonts so it loads quickly and can be installed. API responses and account data are not cached. | Until the next app version or until cleared |
| bl_lang (BravoLisa; app.bravolisa.lu; local storage) | Remembers your selected interface language (English, French or German). | Until cleared |
| bravolisa:install-banner-dismissed (BravoLisa; app.bravolisa.lu; local storage) | Remembers that you dismissed the app installation banner. | Until cleared |
| sidebar_state (BravoLisa; app.bravolisa.lu; cookie) | Records whether the side menu was open or collapsed. | 7 days |
Clerk and Cloudflare are separate providers acting for us. They may process information outside the EEA. Our Privacy Policy describes the safeguards for international processing.
4. Analytics and marketing technologies
Google Analytics 4 and Microsoft Clarity are used for analytics only after you accept analytics technologies. Google Ads and DoubleClick technologies are used for advertising conversion measurement and remarketing only after you accept marketing technologies. These tools are not loaded, and their cookies or local storage are not set or accessed, before you make the relevant choice.
Google Analytics 4 cookies
| Technology and site | Purpose | How long |
|---|---|---|
| _ga (Google Analytics 4; bravolisa.lu and app.bravolisa.lu; cookie) | Random browser identifier used to recognise return visits and count visitors. | Up to 400 days observed |
| _ga_QFBWFQCPXE (Google Analytics 4; bravolisa.lu and app.bravolisa.lu; cookie) | Stores session information for BravoLisa’s Google Analytics property, such as session count and engagement. | Up to 400 days observed |
Microsoft Clarity cookies
| Technology and site | Purpose | How long |
|---|---|---|
| _clck (Microsoft Clarity; .bravolisa.lu; cookie) | Pseudonymous identifier and preferences used to associate visits from the same browser. In the app, an internal user identifier is hashed before upload. | About 1 year |
| _clsk (Microsoft Clarity; .bravolisa.lu; cookie) | Joins page views into a Clarity session recording. Form inputs are masked by the configured Clarity settings. | About 1 day |
Google Ads and DoubleClick technologies
| Technology and site | Purpose | How long |
|---|---|---|
| _gcl_au (Google Ads; bravolisa.lu and app.bravolisa.lu; cookie) | Links a visit to an advertising click so Google Ads can measure sign-up conversions. | Up to 90 days |
| _gcl_ls (Google Ads; bravolisa.lu and app.bravolisa.lu; local storage) | Stores conversion measurement information used by Google Ads. | Up to 90 days |
| test_cookie, IDE and, where set, ar_debug (Google DoubleClick; .doubleclick.net; third-party cookies) | Used for advertising measurement and remarketing. Google may also receive requests from its advertising domains for conversion measurement and remarketing. | test_cookie: about 15 minutes; IDE: up to 13 months; duration of ar_debug may vary |
The identifiers used by these tools may be personal data under the GDPR. Google and Microsoft may process data outside the EU/EEA. Our Privacy Policy explains the relevant safeguards. Cookie names or durations may vary by browser and provider configuration.
On bravolisa.lu, we also use GoatCounter to count page views without cookies or local storage. It runs regardless of your cookie-banner choice. The provider receives the page request and related technical information; see our Privacy Policy for details about personal-data processing.
5. Accepting, refusing and changing your choices
The first time you visit, the banner offers equally prominent options to Accept all, Reject all or Manage settings. Accept all enables analytics and marketing cookies and storage. Reject all disables both optional categories. Manage settings lets you choose analytics and marketing separately. Necessary technologies remain active, and optional categories are not preselected. GoatCounter page counting on bravolisa.lu continues regardless of your choice because it does not use cookies or browser storage.
To change your choice later, use the Cookie settings link in the footer. Withdrawing consent is as easy as giving it and applies going forward; it does not undo processing that took place before you changed your mind. We keep a record of your choice and when you made it.
6. Other third parties
6.1 Embedded content
Embedded video, where available, loads only when you choose to play it. The video provider may then set its own cookies under its own notice.
6.2 Payments
Stripe processes payments. Checkout and the billing portal are hosted by Stripe on its own domain, where Stripe may set cookies needed to complete a payment and prevent fraud.
7. Turning cookies and similar technologies off
You can block or delete cookies and browser storage in your browser settings. This is separate from the consent banner and may also block necessary technologies.
Blocking necessary technologies may sign you out or prevent sign-in. Clearing browser data may also clear your cookie choice and preferences, so the banner may ask again. It does not delete data or drafts stored in your BravoLisa account.
8. Legal basis, contact and changes
Necessary cookies and storage rely on the exception in Article 5(3) of the ePrivacy Directive where they are strictly necessary to provide a service or feature you request. Related personal data is processed to perform our contract with you and to keep BravoLisa secure (Article 6(1)(b) and (f) GDPR). Analytics and marketing cookies or storage are used only with your consent under Article 5(3) ePrivacy; related personal data is processed on the basis of consent under Article 6(1)(a) GDPR.
GoatCounter does not use cookies or local storage. Its processing of page requests and related technical information is described in our Privacy Policy.
Questions: privacy [at] bravolisa [dot] lu. Our full details are in About Us.
You can complain to the Luxembourg supervisory authority: CNPD, 15 boulevard du Jazz, L-4370 Belvaux, www.cnpd.public.lu.
We update this Notice when our technologies, providers or the law change. The date at the top shows the last change.