Cookies and similar storage
Cookies are browser records; sessionStorage is scoped to an origin and tab session. Some security state lives on the server rather than in a separate browser cookie. The inventory below distinguishes public browsing from administration.
Categories and legal assessment
Essential preferences/security functions support the site and authenticated administration. Analytics and Marketing are independently optional, initially off. reCAPTCHA is a separate third-party security integration whose cookie classification requires legal approval; it is not silently classified as essential.
Choose, reopen and withdraw
Accept All allows optional categories except Marketing when GPC is active. Reject Optional denies both. Customize lets you save each category independently. Open Cookie Preferences from the footer to inspect or change the saved answer. No signal or no saved answer is not permission.
Choices expire after 180 days. An outdated, malformed, expired or future-dated record is ignored. A material category/provider change increments the consent version and asks again. Refusing optional categories does not prevent a quote request.
Withdrawal sends denied signals, stops application analytics and attempts to clear accessible recognized first-party Google cookies. If GTM was loaded, the page reloads to stop that document. Third-party cookies, alternate cookie paths and information already sent may remain; use browser/provider controls too.
Google services and container inventory
reCAPTCHA can load on submission of quote, login or forgot-password forms. Google documents the _GRECAPTCHA cookie for risk analysis, but its actual domain, expiry and other storage must be checked in the configured environment. See Google's links below.
GTM is a loader, not proof that GA4 or a specific advertising tag is active. A real container inventory and network inspection are required before enabling it. Cookies, recipients, purposes, paths and expiry for actual tags must be added to the approved inventory; unknown cookie names and lifetimes are not invented here.
Updates
Effective date: Business information awaiting verification (preview only). Last updated: Business information awaiting verification (preview only). Questions: support@colverano.com.
Cookies and storage inventory
| Cookie or storage | Provider | Purpose | Retention | Category | Type / scope / reason |
|---|---|---|---|---|---|
| colverano_consent | Colverano / first party | Analytics/Marketing choices, version and save time; may be personal information in context. | 180 days | Preference / essential | Cookie (Secure on HTTPS, SameSite=Lax, readable by script); Host, Path=/. Remembers optional choices; no account or form contents. |
| COLVERANO_SESSION | Colverano / first party | Opaque administrator session id. Created in authentication/CSRF flows, not ordinary public browsing. | Session cookie; server 30-minute idle and 12-hour authenticated limits; challenge 5 minutes | Admin security | HttpOnly cookie, Secure in production, SameSite=Lax; API host, Path=/. Needed for protected administration. Not a public visitor tracking cookie. |
| CSRF token (server session; no separate CSRF cookie) | Colverano / first party | GET /admin/auth/csrf returns a token; the client holds it in memory and sends X-XSRF-TOKEN. | Session/token lifecycle; renewed with authentication steps | Admin security | Server session and JavaScript memory; Admin API/session. Prevents forged state-changing administrator requests. |
| colverano:accepted-quote-reference | Colverano / first party | Quote reference for the confirmation page; not sent in the URL or analytics. | Tab session (browser session restoration may preserve it) | Confirmation | sessionStorage; Frontend origin / tab. Supports the requested confirmation, not tracking. |
| colverano-admin-locale | Colverano / first party | Administrator interface language preference, if selected. | Until local storage is cleared | Admin preference | localStorage; Frontend origin / admin UI. Only interface language; no authentication token. |
| Google reCAPTCHA cookies and storage | Google / third party | Risk analysis on quote/login/forgot-password submission. Google documents _GRECAPTCHA; deployment inventory still required. | Google-controlled; confirm actual cookies/expiry in production | Security; legal classification requires approval | Third-party script/cookie/storage; Google domains; confirm actual paths. Not automatically designated strictly necessary; see Google policies. |
| Storage of tags in the configured GTM container | Actual providers must be confirmed | Business information awaiting verification (preview only). Application analytics events require Analytics permission; Marketing-only does not enable them. | Per actual tag/provider settings | Analytics / Marketing | Cookies and other tag storage; Actual tag domains and paths require inventory. Optional; loaded only after permitted category choice. The container must enforce each tag's consent requirements. |
This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply. Google may process device, network and interaction information when you submit this form.