This notice explains the cookies and similar technologies used on the NERMO website and portals. It restates and expands Section 13 of the Privacy Policy, which governs the processing of any associated personal data.
1. Our approach: strictly necessary, one preference cookie, and consent-based analytics/advertising on the website
NERMO uses strictly necessary cookies, plus a single optional theme-preference cookie:
- Session and authentication cookies — set by the NERMO portals, the NERMO sign-in page (login.nermo.io) and our self-hosted identity provider to sign you in and keep you signed in, including short-lived cookies that carry one sign-in in progress.
- Sign-in hint cookies — two first-party cookies the portals set when you sign in and remove when you sign out: one tells the website to show “Dashboard” instead of “Log in”; the other records which portal this browser signed in to last, so the sign-in page can take you straight there and so only one portal stays signed in per browser. They grant no access by themselves.
- Security protections — forms and authenticated requests are protected against forgery by same-origin checks; apart from the sign-in-in-progress cookies listed below, no separate anti-forgery token cookie is set.
- Anti-abuse token on the application forms — the public “Request Access” and “Apply as Vendor” forms use an anti-bot challenge (Cloudflare Turnstile), which issues a one-time token, submitted with the form and not stored as a cookie, solely to distinguish humans from automated abuse. The challenge itself comes from Cloudflare, which may set its own cookies on its own domain under its Turnstile privacy policy.
- Theme preference — a single first-party cookie that remembers the light/dark theme you choose, so the website and the portals render with the same theme. It is set only when you pick a theme and stores nothing but that choice.
On the public website (nermo.io) only, and only with your consent, we additionally use:
- Analytics cookies — Google Analytics measurement cookies (
_ga,_ga_*), host-scoped to nermo.io, used to understand how the website is used. Off until you grant the Analytics purpose in the consent banner. - Advertising cookies — Google advertising cookies (
_gcl_au), used to measure our ad campaigns and support remarketing. Off until you separately grant the Advertising purpose.
The portals use no analytics or advertising cookies — they set strictly necessary and theme-preference cookies only. Nothing consent-based is loaded anywhere before you opt in: until a purpose is granted, no request is made to Google at all. We do not sell browsing data, and analytics/advertising cookies never reach the portals, the API, or the MCP endpoint (all such cookies are host-scoped to the website).
Consent is collected through the website’s consent banner: each purpose is a separate toggle, rejecting is as easy as accepting, and a stored choice can be changed at any time via “Cookie preferences” (site footer and application forms). A consent choice is stored for 12 months, after which we ask again; if the purposes or recipients described in this notice materially change, we ask again before the stored choice is reused.
2. Cookie table
| Cookie | Set by | Purpose | Type | Duration |
|---|---|---|---|---|
__Host-nermo_client_session, __Host-nermo_vendor_session, __Host-nermo_staff_session | NERMO portals | Keep you signed in to the Client Portal, the Vendor Portal or the Staff Console | Strictly necessary (first-party) | 12 hours after the last activity |
__Host-nermo_client_oidc_*, __Host-nermo_vendor_oidc_*, __Host-nermo_staff_oidc_* | NERMO portals | Carry one sign-in in progress (its security values and the page you asked for), one cookie per sign-in | Strictly necessary (first-party) | 30 minutes |
__Host-nermo_login | NERMO sign-in page (login.nermo.io) | Holds a sign-in while you replace a temporary password | Strictly necessary (first-party) | 10 minutes |
__Host-nermo_handoff | NERMO sign-in page (login.nermo.io) | Hands a finished sign-in to your portal | Strictly necessary (first-party) | 5 minutes |
__Host-nermo_connect | NERMO sign-in page (login.nermo.io) | Carries one AI-application connection in progress | Strictly necessary (first-party) | 10 minutes |
__Host-nermo_device | NERMO sign-in page (login.nermo.io) | Recognises a browser that signed in to your account before, so that failed sign-in attempts by other people do not lock you out on this browser; holds no account name; httpOnly | Strictly necessary (first-party) | 90 days, renewed at each sign-in |
nermo_signed_in | NERMO portals (read by the website) | Shows “Dashboard” instead of “Log in” on the website after you sign in on this browser; holds no identifier | Strictly necessary (first-party, .nermo.io) | 90 days, or until you sign out |
nermo_portal | NERMO portals (read by the sign-in page and the portals) | Records which portal this browser signed in to last (client, vendor or staff), to keep one portal signed in per browser and to take you there; httpOnly | Strictly necessary (first-party, .nermo.io) | 90 days, or until you sign out |
| Identity-provider session cookies | NERMO’s self-hosted identity provider | Single sign-on session with our EU-hosted identity service | Strictly necessary (first-party) | Session |
| — (none set) | NERMO portals / website | Apart from the sign-in cookies above, cross-site request forgery is prevented without a token cookie, by same-origin checks on every state-changing request | Strictly necessary (first-party) | — |
nermo_theme | NERMO website and portals | Remembers your light/dark theme choice across NERMO surfaces | Optional functional (first-party; user-requested preference, consent-exempt) | 12 months |
turnstileToken — submitted as a field of the application form, not stored as a cookie | Cloudflare Turnstile (application forms only) | Distinguishes human applicants from automated abuse | Strictly necessary (anti-abuse) | Single submission |
nermo_consent | NERMO website | Stores your consent choices per purpose, the notice version shown, and the decision time | Strictly necessary (first-party; consent state) | 12 months |
_ga | Google Analytics (website only, host-scoped to nermo.io) | Distinguishes visitors for analytics measurement | Analytics (consent-based) | 12 months |
_ga_* | Google Analytics (website only, host-scoped) | Keeps per-property session state for analytics measurement | Analytics (consent-based) | 12 months |
_gcl_au | Google (website only, host-scoped) | Ad-campaign conversion linking | Advertising (consent-based) | 3 months |
3. Managing cookies
You can block or delete cookies in your browser settings. Blocking the strictly necessary cookies will prevent sign-in and form submission from working; blocking the theme-preference cookie only means your theme choice will not follow you across NERMO surfaces. Analytics and advertising cookies can additionally be granted, refused, or withdrawn at any time via “Cookie preferences” in the site footer; withdrawal stops collection immediately and deletes the associated Google cookies.