What these technologies are
This Cookie Policy explains how AVEN STUDIOS računalniško programiranje Marko Vodopivec s.p., doing business as SameSideSystems, uses browser storage and related technology on this U.S.-facing website. The responsible operator is established in Slovenia. Read this policy together with the Privacy Policy.
- Cookies are small text records a website or third party asks a browser to store and return.
- Local storage keeps key/value records in a browser until they expire by application logic or a user clears them. Unlike a cookie, the browser does not attach local-storage data to each HTTP request.
- Pixels, tags, and software development kits can send events and identifiers to a provider when a page or action occurs.
- Heatmaps and session replay can summarize clicks, scrolling, navigation, and—in some implementations—visible page content or interactions. They require especially careful masking and exclusion.
- Server logs are generated when a browser requests site resources. They are not cookies, but can include IP address, request path, browser details, and timestamps.
The SameSideSystems preference manager does not, by itself, load Google Analytics, Microsoft Clarity, Vercel Web Analytics, an advertising pixel, or another optional provider. Google Analytics 4, Microsoft Clarity, and Vercel Web Analytics are explicitly registered as Analytics tools and load only after affirmative Analytics consent. The embedded LeadConnector/HighLevel chat is registered under Preferences and remains completely unloaded until a visitor affirmatively enables Preferences. No Advertising provider is currently registered.
Categories and strict defaults
| Category | Purpose | Default | Examples |
|---|---|---|---|
| Strictly necessary | Operate security, navigation, forms, load balancing, and privacy controls that a visitor requests or the site reasonably needs to function. | Always active; it cannot be disabled in the preference panel. | Privacy choice record; essential security or infrastructure storage after it is verified and listed. |
| Preferences | Enable optional display, accessibility, media, convenience, or communications features. | Off until selected. | LeadConnector/HighLevel embedded chat. |
| Analytics | Measure use and performance, diagnose errors, and improve content or usability. This category also covers heatmaps/session replay in the included implementation. | Off until selected. | Google Analytics 4, Microsoft Clarity, and Vercel Web Analytics. |
| Advertising | Attribute campaigns, measure ads, limit repetition, or support audiences and targeted advertising. It also represents sale/share opt-out status in this client-side layer. | Off until selected; forced off when GPC is detected. | Not currently used. No advertising, social, retargeting, or conversion provider is registered. |
Accepting optional technology is not required to browse the public pages. If a future feature genuinely needs a preference technology, describe the consequence of declining without making a broader category mandatory.
Production technology inventory
This table records the implemented technologies and the results of production scans before consent, after acceptance, after rejection, and after withdrawal on July 17, 2026. The chat row reflects the current implementation and requires a fresh production storage scan after deployment. Durations combine live browser results with provider documentation; browser rules and user settings can shorten a stated maximum.
| Provider / technology | Name + type | Purpose + data | Duration | Category |
|---|---|---|---|---|
| SameSideSystems privacy preference manager (first party) | sameside_privacy_choices_v1Browser local storage |
Stores policy version; necessary, preference, analytics, and advertising choices; GPC status; choice source; update and expiry timestamps. The included module does not transmit this record. | 180 days after the latest saved choice, unless the browser record is cleared sooner. | Strictly necessary |
| SameSideSystems privacy launcher state (first party) | sameside_privacy_choices_v1_launcher_dismissed_1Browser session storage |
Remembers that the floating privacy-choice launcher was dismissed for the current tab session. The module does not transmit this value. | Current browser-tab session, or until session storage is cleared. | Strictly necessary |
| Vercel hosting and delivery | Server request and runtime logs; no Vercel browser cookie or local-storage entry was observed in the fresh no-consent production scan. | Delivers and secures the site and can process IP address, request path, browser details, timestamps, and operational events. See Vercel's privacy notice. | Under the current Hobby plan, runtime logs are available to us for up to one hour. Vercel may process or retain operational and security data under its own terms and notice. | Strictly necessary |
| SameSideSystems inquiry form, Vercel hosting, and Resend email delivery | No marketing cookie or persistent browser identifier. The form uses a browser-session landing-path value for limited first-party attribution and sends the submitted inquiry through the website server. | Receive and route a requested website-preview, service, or call inquiry; prevent basic automated abuse; preserve limited first-party source context; and send the inquiry to our business inbox. Form-field values are not sent to Google Analytics or Microsoft Clarity events. | Browser-session attribution expires when the browser-tab session ends. Submitted inquiry records are retained only while responding or maintaining the resulting business relationship, and afterward as reasonably needed for business, security, dispute, and legal records. | Strictly necessary / service requested by the visitor |
| LeadConnector/HighLevel embedded chat | After Preferences consent, provider-controlled script, iframe, network requests, and any browser storage set from widgets.leadconnectorhq.com or related provider domains. |
Provides an optional chat interface for visitors who enable it and choose to request a response; processes page, device, network, conversation context, and information a visitor chooses to submit. Review the notice shown inside the widget before providing information. | Controlled by the provider and configured widget-account owner. Exact browser-storage names and durations require verification in a fresh production scan. | Preferences (off until affirmative consent) |
Google Analytics 4G-Y19M3CD407 |
_ga and _ga_Y19M3CD407 first-party cookies; Google tag loaded from googletagmanager.com. |
Measures page views, navigation, campaign parameters, engagement, coarse device/geography, and performance events after analytics consent. Google Signals and ad personalization are disabled. See Google's privacy policy and GA cookie documentation. | The live Chrome audit showed a 400-day maximum for both cookies; browser limits or user settings may shorten it. The GA4 property's separate raw user/event retention setting still requires dashboard verification before legal approval. | Analytics |
| Microsoft Clarity Project xnkc53r9o9 |
_clck first-party cookie; _clsk first-party cookie; _cltk browser session storage; Clarity script and network tag. |
Creates consented heatmaps and session replays from clicks, scrolling, navigation, device/region information, and visible page interactions. The project uses Balanced masking, which masks input fields and detected numbers and email addresses. See Microsoft's privacy statement and Clarity cookie documentation. | _clck: 365 days observed; _clsk: 1 day observed; _cltk: browser session. Clarity recordings are generally retained up to 30 days, selected/favorited recordings up to 9 months, and heatmaps up to 9 months. |
Analytics |
| Vercel Web Analytics | No browser cookie or local-storage identifier. The script and page-view requests use /_vercel/insights/*. |
Measures anonymized page views, routes, referrers, and coarse device and location data after analytics consent. See Vercel's Web Analytics documentation and Vercel's privacy notice. | Analytics data is retained under the project's Vercel plan and Vercel's current terms; this provider does not set a persistent browser identifier. | Analytics |
| Advertising, social, retargeting, and conversion providers | Not used. No provider, pixel, cookie, local-storage entry, or conversion tag is registered in the production consent manager. | The category is reserved for future use and remains off. A provider cannot be added without an inventory, consent, contract, and policy update. | Not applicable while unused. | Advertising |
Inventory rule
If a scan discovers a technology not listed here, pause or block it, determine its purpose and legal classification, update the consent integration and policies, and complete contract/vendor review before enabling it in production.
Accept, reject, or manage
On a first visit—or after the stored choice expires or the consent version changes—the preference banner offers equally available actions to Accept all, Reject non-essential, or Manage choices. No optional category is preselected.
You can change your mind at any time by selecting Privacy choices. A saved update applies immediately to SameSideSystems-controlled optional loading on that browser. Clearing browser storage resets the record, and using another browser or device requires a separate choice unless SameSideSystems implements a legally appropriate account-level preference system.
Disabling Preferences stops the registered LeadConnector/HighLevel chat loader and reloads the page if the provider had already started. Disabling Analytics stops the registered Google Analytics, Microsoft Clarity, and Vercel Web Analytics loaders, removes known first-party analytics cookies and storage where technically possible, and reloads the page. A preference change affects future collection on this browser; it does not automatically erase information a provider received before withdrawal. A separate privacy request may be needed for retained data.
You can also use browser controls to block or delete cookies and site data. Those controls can affect site functionality and do not necessarily communicate a statutory opt-out to every business.
Global Privacy Control and Do Not Track
If your browser sends Global Privacy Control (GPC), the server recognizes Sec-GPC: 1, varies the HTML response by that header, and supplies the result to the browser preference manager before optional scripts can load. GPC keeps advertising, sale, and sharing uses off for that browser—even if you select “Accept all.” The site currently has no account system or server-side advertising integration to which the signal must be propagated.
We do not separately respond to the older, non-standardized “Do Not Track” setting. Microsoft Clarity does not independently honor Do Not Track, but on this website it remains unloaded unless you affirmatively enable analytics.
GPC does not automatically disable measurement that is genuinely outside an applicable sale/share/targeted-advertising opt-out, but this implementation remains conservative: all optional analytics and advertising are off until the visitor affirmatively selects them.
Heatmap and session-replay safeguards
Microsoft Clarity is active only after analytics consent. The production project uses the following safeguards:
- load the provider only after analytics consent;
- use Clarity's Balanced masking profile, which masks input fields and detected numbers and email addresses;
- keep advertising consent denied and avoid registering Clarity as an advertising provider;
- mark the complete inquiry drawer and its fields for masking and never include submitted values in analytics events;
- test network traffic, consent withdrawal, cookie cleanup, and GPC behavior against production.
Configured provider and settings: Microsoft Clarity project xnkc53r9o9; Balanced masking; additional masking on the complete inquiry drawer; recordings generally retained up to 30 days, selected or favorited recordings up to 9 months, and heatmaps up to 9 months. Masking is risk reduction, not a guarantee that all page content is anonymous. Form releases require a production recording and network review to confirm that typed and submitted values remain excluded.
Audits, updates, and contact
We will update this policy when technology, purposes, providers, configurations, or legal requirements change. We run browser/network scans and a manual provider review before every production release that changes tracking and at least quarterly.
Questions or privacy requests can be sent to hello@samesidesystems.com. The responsible legal entity and postal address are listed in the Privacy Policy.