The short version: security cookies from Cloudflare that keep the site working, a few small entries that remember your choices and your cart — and, only if you say yes, two Google Analytics cookies. If you fill in our onboarding questionnaire, one cookie of our own keeps you signed in to it. No advertising cookies, no tracking pixels.
Last updated
No advertising cookies. Google Analytics counts your visit only if you say yes; saying no changes nothing else.
Numerra does not use cookies to advertise to you or to follow you around the web. We ask one question — may we count your visit with Google Analytics? — and nothing for that purpose is loaded, set or sent until you say yes. Saying no costs you nothing: every page, the contact form and the prices work exactly the same. You can change your answer at any time with “Cookie settings” at the bottom of every page. The order form and the onboarding questionnaire never load Google Analytics, whatever you answered.
The company responsible for this website, and for anything stored on your device by it.
A cookie is a small text file that a website asks your browser to store and to send back on later requests. It is how a site can tell that two requests came from the same browser.
The law that governs this page is not written in terms of cookies, though. It covers the storing of information on your device, or gaining access to information already stored there, by any technical means at all. Two ordinary browser features do exactly that, so this policy treats them the same way a cookie is treated:
Some things are deliberately not on that list, because they are not storage on your device: your browser’s own cache, and the information your browser sends with every request whether a site asks for it or not, such as your IP address and your user agent string.
For the record, and because people reasonably ask: your raw IP address is never written to our database. What our forms and the questionnaire keep is a salted one-way hash of it, used to rate-limit requests and to investigate abuse, and each such hash is erased 30 days after it was recorded. How we handle the rest of what you send us is described in the privacy policy.
Three kinds of cookie can appear on numerra.eu: Google Analytics cookies, only after you allow statistics (“Accept all”, or the Statistics switch under “Customise”); Cloudflare’s security cookies, which keep the site working; and, only if you use the onboarding questionnaire, our own cookie that keeps you signed in to it. If you decline statistics, an ordinary visit may leave none at all.
Nothing here is set until you allow statistics, and both are deleted if you withdraw.
EN
UA_gaHolds a random number that tells one browser from another, so we can count visitors and see which pages help. It contains no name, email or IP address. Set only after you allow statistics.
Set by: Google Analytics, on numerra.eu (Google is our processor)
Lasts: As long as your consent: 12 months at most, less if you withdraw
_ga_VWHG03JHHZKeeps track of the current visit — its number and timing — for the same Google Analytics property. Set only after you allow statistics.
Set by: Google Analytics, on numerra.eu
Lasts: As long as your consent: 12 months at most, less if you withdraw
They keep the site reachable, the forms free of bots and your questionnaire yours, and none of them follows you to another website. Several appear only when the protection behind them is triggered.
nm_kycKeeps you signed in to your onboarding questionnaire, so that it opens without the link in the address bar and saves as you type. It holds the key from your personal link. It is marked HttpOnly, so no script on the page — ours or anyone else’s — can read it, and it is never sent to another site. Set when you send the order form or open your link; a visitor who does neither never receives it.
Set by: Numerra, on numerra.eu — sent only to the questionnaire’s own server address, /api/onboarding
Lasts: Until you choose “Sign out and stop my link” — which also stops your link everywhere — or 90 days after it was last set — the order form sets it, and so does each opening of your link, even if you unticked “Remember me on this device” before. If you untick that box, until you close the browser. It stops working sooner if the link expires or a new link replaces it.
__cf_bmTells automated traffic apart from people so that bots cannot flood the site. It appears only while Cloudflare’s bot protection is switched on for this site. Cloudflare generates a separate one per site and does not use it to follow you between sites.
Set by: Cloudflare, on numerra.eu
Lasts: 30 minutes of continuous inactivity
cf_clearanceRecords that your browser has already passed a security check, so you are not challenged again on every page. It appears only if a challenge is actually shown to you.
Set by: Cloudflare, on numerra.eu
Lasts: Until the clearance Cloudflare issued for this site expires; Cloudflare does not publish a fixed figure
_cfuvidLets the rate limiter tell apart visitors who share one public IP address — an office, a university, a mobile network — so that one heavy user does not get everyone behind that address blocked. It appears only where a rate-limiting rule is in force.
Set by: Cloudflare, on numerra.eu
Lasts: The browsing session; Cloudflare does not publish a fixed expiry
cf_chl_* (for example cf_chl_rc_m)Used by the Turnstile anti-bot widget while a check is running on our contact form, our order form or the page for a new questionnaire link. These belong to Cloudflare’s own domain rather than ours, and Cloudflare describes them as internal to diagnosing problems with the challenge itself.
Set by: Cloudflare, on challenges.cloudflare.com
Lasts: Short-lived, for the duration of the check
CF_AuthorizationProves that a Numerra administrator has signed in to the internal admin area. It is issued on /admin only, to our own staff only, and a visitor to the public site never receives it. It is listed here for completeness, not because it can reach you.
Set by: Cloudflare Access, on the private admin area
Lasts: For the length of the administrator’s signed-in session
The anti-bot check on our contact form, our order form or the page for a new questionnaire link is Cloudflare Turnstile. It runs in a frame served from challenges.cloudflare.com, and Cloudflare states that it does not set cookies on your device in order to track you. It is loaded on those three pages only — no other page on this site requests it.
Three entries hold choices you made yourself, and one holds your cart. The others belong to the onboarding questionnaire — they appear once you open your questionnaire link — and stay in that browser tab, whichever page of this site it goes on to show, until you close it at the latest. While they last, other scripts on those pages could read them too: Cloudflare Turnstile on the contact form, the order form and the page for a new questionnaire link, and Google Analytics if you allowed statistics. The questionnaire page itself runs only our own code.
nm_consentRemembers your answer to the statistics question: yes or no, when you gave it, the version of the question you saw, and a random reference number that matches our record of your answer.
Type: localStorage, not a cookie
Lasts: 12 months, then we ask again and your new answer replaces it.
Consent: No — it is the record of your choice itself.
nm_langRemembers the language you picked — by switching language, or by closing the suggestion to switch — so the site stops offering you the other one.
Type: localStorage, not a cookie
Lasts: Until you clear this site’s data in your browser. It never leaves your device.
Consent: No — it stores a preference you set yourself.
nm_themeRemembers the light or dark look you picked with the theme switch — in the header, the phone menu or the footer. Choosing “Auto” (as on your device) removes it, and the site follows your device again.
Type: localStorage, not a cookie
Lasts: Until you choose “as on your device” or clear this site’s data in your browser. It never leaves your device.
Consent: No — it stores a preference you set yourself.
nm_cartYour cart: which plans and services you added, how many, and monthly or yearly — keys and numbers only, no name, no email, no price we would trust. Our server prices every order itself.
Type: localStorage, not a cookie
Lasts: Until you empty the cart, place the order, or clear this site’s data in your browser. It is sent to us only when you press “Go to payment”.
Consent: No — strictly necessary for the cart you are using.
nm_kyc_draft:*On the onboarding questionnaire only, one entry per part (nm_kyc_draft:company, nm_kyc_draft:person): a copy of answers you have typed that our server has not yet confirmed saving — for example while your connection drops — so that they are not lost and can be sent when it returns. It carries the questionnaire’s short reference, so it is only ever put back into the questionnaire it came from. Never documents.
Type: sessionStorage, not a cookie
Lasts: Deleted as soon as the server confirms the save, and when you submit. The tab also deletes it when you sign out in it, or open another questionnaire’s link in it — and, while it shows the questionnaire, when you do any of that in another tab. At the latest, it goes when you close the tab.
Consent: No — it is part of the questionnaire you asked to fill in.
nm_kyc_savedThe questionnaire page keeps your personal link and the questionnaire’s short reference in its own entry of the tab’s history — once you open the questionnaire from the link we email you — so that it can offer you the link to save, share or copy and never offers it for another questionnaire, with whether we have emailed it to you; nm_kyc_saved is a marker that you have saved it, so that it stops asking.
Type: sessionStorage, and the questionnaire page’s own history entry, not a cookie
Lasts: The link stays in that history entry, where Back and a reload find it and no other page of this site can read it; it is never put in sessionStorage. The questionnaire forgets it in the tab where you sign out or open another questionnaire’s link — a tab showing the questionnaire also when you do that in another tab. The marker that you saved it stays until you close the tab. The link opens your questionnaire, so on a shared computer choose “Sign out and stop my link” when you finish.
Consent: No — it is part of the questionnaire you asked to fill in.
Nothing you type into the contact form, the order form or the page for a new questionnaire link is saved in your browser. It is sent to us when you press send, and not before. The questionnaire is the one exception, described above: it keeps edits in the tab until our server confirms them.
One question, rejecting as easy as accepting, and nothing from Google until you say yes.
Nothing from Google loads
Not the script, not a cookie, not a single request. We use Google Consent Mode in its “basic” form: the “advanced” one would load Google’s script first and send it data before you agreed.
Reject all, Accept all or Customise
Reject all and Accept all side by side, the same size and style — rejecting takes one tap, exactly as accepting does. “Customise”, under them, shows each purpose with its own switch: Necessary, always on, and Statistics, off until you switch it on. Until you answer, the answer is no — and the site works exactly the same either way.
Two cookies, never longer than your consent
Google Analytics loads once the page has finished loading. Its two cookies are set to expire when your consent does, not after Google’s default of two years.
Any time, from every page
“Cookie settings” at the bottom of every page opens the settings with your current answer in the switch. If you withdraw, we delete both Google Analytics cookies from your browser at once, and Google Analytics does not load again.
24 months, no IP address
A random reference number, yes or no, the version of the question, the page language and the time — so we can show what you agreed to. No name, no email, no IP address: the number is random, and only your browser keeps a copy of it.
After 12 months
Or sooner, if we ever want to use the data for something new: a changed question sets every earlier answer aside.
What it measures, who processes it, and what it never gets. The privacy policy has the full statement.
Google Ads conversion tracking is not installed. If we ever add it, it will be a separate question with its own answer — a yes to statistics never counts as a yes to advertising — and its cookie (_gcl_au) will be listed here before it is ever set.
Your answer can be changed at any time — here, or with “Cookie settings” at the bottom of every page. Both open the settings with your current answer in the switch.
Your browser can also show you what any site has stored, delete it, and block anything new — no permission from us needed:
One caveat before you block everything: the Cloudflare cookies above keep this site reachable and its contact form usable. Blocking them may mean you are challenged repeatedly, or that the form refuses to submit — if that happens, write to us directly instead. Blocking the Google Analytics cookies costs you nothing at all.
The rule behind this page is Article 5(3) of the ePrivacy Directive (2002/58/EC). It is still in force. In Estonia it applies through the Electronic Communications Act, and the consent it refers to is consent as the GDPR defines it — freely given, specific, informed and unambiguous — which is why we ask the way described above.
Two narrow exemptions need no consent: storage done solely to carry out a transmission, and storage strictly necessary to provide a service you have explicitly asked for. Cloudflare’s security cookies, the entries that record your own choices and your cart, and the questionnaire’s sign-in cookie and session entries fall under the second. Google Analytics does not. It needs your consent under Article 5(3), and the processing that follows relies on that consent (GDPR Article 6(1)(a)).
Two things are often reported as having changed this, and neither has. The proposed ePrivacy Regulation, which would have replaced the Directive, was withdrawn by the European Commission in 2025 after years without agreement, so the 2002 Directive remains the law. The Digital Omnibus package, which would move parts of the cookie-consent rules into the GDPR and give effect to consent signalled by the browser itself, is a legislative proposal still working its way through the EU process. A proposal is not law, and nothing on this page relies on one.
If the Omnibus is adopted in a form that changes what this site has to do, this page changes with it — and so does the date at the top.
This page is updated whenever what the site stores changes, not on a schedule. The date at the top is the date of the last substantive change, and older wording is kept on file.
Questions about this policy, about anything we hold about you, or about a request to see or delete it, go to the address below. We answer within one month, as the GDPR requires, and usually much sooner.