COOKIE POLICY
Last updated March 10, 2026
This Cookie Policy explains how Technologies Bernli Inc. (“Company,” “we,” “us,” and “our”) uses cookies and similar storage technologies to recognize you when you use our application at https://www.bernli.ca (“Application”). This policy is intended for users located in Canada and is drafted to reflect Canadian privacy requirements and best practices for meaningful consent. It explains what these technologies are, why we use them, and your rights to control them. It should be read together with our Privacy Policy, which explains how we handle personal information more generally.
Meaningful consent means we give you clear, understandable information about the cookies and similar technologies we use, the purposes for using them, whether they are essential or optional, and the consequences of accepting or rejecting optional technologies before you make a choice.
1. WHAT ARE COOKIES?
Cookies are small data files placed on your computer or mobile device when you visit a website or use a web application. Similar technologies include local storage, session storage, pixels, tags, software development kits, and embedded third-party tools that can store or access information on your device. Cookies set by the application owner (in this case, Technologies Bernli Inc.) are called “first-party cookies.” Cookies or storage set by another organization through an embedded service, such as a secure iframe, are called “third-party cookies” or “third-party storage.”
2. WHAT COOKIES DO WE USE?
We use first-party cookies and similar storage for the purposes described below. We do not use analytics cookies, advertising cookies, tracking pixels, cross-context behavioural advertising technologies, or fingerprinting. Some embedded third-party services may use their own cookies or storage when you choose to interact with them, as described in Section 5. Our cookies fall into two categories: Essential and Optional Preference.
Essential Cookies (Always Active)
Essential cookies are strictly necessary for the Application to function securely. They cannot be disabled through our cookie banner because the Application cannot provide login, authentication, fraud prevention, security, and consent-management functions without them. These cookies do not store personal information beyond what is needed for those essential purposes.
| Cookie Name | Purpose | Duration | Security |
|---|---|---|---|
| sb-*-auth-token | Authenticates your session after login. Set by Supabase (our database provider) to keep you signed in securely. | Session | httpOnly, Secure, SameSite |
| csrf-token | Protects against Cross-Site Request Forgery (CSRF) attacks. Validates that form submissions and actions originate from our Application. | 1 hour | httpOnly, Secure, SameSite=Strict |
| trusted_device | Remembers your device after successful multi-factor authentication (MFA), so you are not prompted for MFA on every login from the same device. | 7 days | httpOnly, Secure, SameSite=Lax, HMAC-SHA256 signed |
| cookie-consent | Stores your cookie consent preferences (which categories you accepted or rejected) and whether Global Privacy Control (GPC) was detected. | 1 year | First-party, client-side |
Optional Preference Cookies
Optional preference cookies remember your settings and interface choices so you do not have to reconfigure them each time you use the Application. These cookies contain no financial data and are intended to store only interface preferences.
These optional preference cookies are off by default and are only set if you expressly opt in through our cookie consent banner or Application settings. You can refuse them without losing access to the Application. If you reject or withdraw consent for preference cookies, the Application will still function normally, but your interface preferences will not be saved between sessions.
| Cookie Name | Purpose | Duration |
|---|---|---|
| date_range | Saves your selected date range for viewing financial data (e.g., “Last 30 days”). | 30 days |
| time_period | Saves your selected time period preference for charts and reports. | 30 days |
| sidebar:state | Remembers whether the navigation sidebar is expanded or collapsed. | 7 days |
| columnVisibility | Remembers which columns you have shown or hidden in data tables (e.g., transactions). | 1 year |
| NEXT_LOCALE | Saves your language preference (English or French). | 1 year |
3. WHAT WE DO NOT USE
To be transparent, we want to clearly state what we do not use:
-
No analytics or tracking cookies. We do not use Google Analytics, Adobe Analytics, Mixpanel, Segment, or any other analytics platform, and we do not use cookies or similar technologies to profile your use of the Application.
-
No advertising cookies. We do not serve targeted advertising, use advertising networks, or use cookies or similar technologies for cross-context behavioural advertising.
-
No third-party advertising or analytics cookies. We do not allow third-party advertising, analytics, or tracking cookies on the Application. Embedded services described in Section 5 may use their own cookies or storage only when you interact with those services, and those technologies are provided by the third-party service providers, not by Bernli as first-party cookies.
-
No tracking pixels or web beacons. We do not embed tracking pixels, web beacons, or similar tracking tags in our Application or emails.
-
No fingerprinting. We do not use browser, device, canvas, or similar fingerprinting techniques to identify or track you.
4. LOCAL STORAGE
In addition to cookies, our Application may use your browser’s local storage or similar browser storage to save certain interface preferences (such as sidebar width, card ordering, and column visibility). Local storage is different from cookies — it is not automatically sent to our servers with each request and generally remains on your device unless the Application reads it for the preference you selected. This data contains no financial information and is intended to store only layout and display preferences. Non-essential local storage is treated like optional preference cookies: it is off by default, requires express opt-in consent, and can be cleared at any time through your browser settings or changed through the Application settings where available.
5. THIRD-PARTY SERVICES
Our Application integrates with certain third-party service providers that may use their own cookies or storage mechanisms when you choose to interact with them. These are third-party technologies, not Bernli first-party cookies. We do not use these services for cross-context behavioural advertising, and we aim to load or activate non-essential third-party storage only after any required consent has been obtained:
-
Plaid — When you choose to connect your bank account, the Plaid Link interface loads in a secure iframe. Plaid may set or access its own cookies or similar storage within that iframe to facilitate the bank connection process, security, and fraud prevention. Plaid’s technologies are governed by Plaid’s own privacy policy and cookie practices, not by Bernli as first-party cookies. See Plaid’s Privacy Policy for details.
-
hCaptcha — We may use hCaptcha for bot prevention on certain forms. hCaptcha may set or access its own cookies or similar storage to verify you are a human and to help protect the Application from abuse. hCaptcha’s technologies are governed by hCaptcha’s own privacy policy and cookie practices, not by Bernli as first-party cookies. See hCaptcha’s Privacy Policy for details.
Where these third-party technologies operate within their own iframes or embedded interfaces, they are provided and controlled by the relevant third-party service provider and may not be accessible to our Application. Your interaction with Plaid, hCaptcha, or another embedded service may also be governed by that provider’s privacy policy and terms, so you should review those documents before using the embedded service.
6. GLOBAL PRIVACY CONTROL (GPC)
We treat the Global Privacy Control (GPC) signal as a privacy preference signal where required or recognized by applicable Canadian privacy laws and as a matter of our default practice for users in Canada. If your browser sends a GPC signal (Sec-GPC: 1), we automatically:
-
Reject all non-essential (preference) cookies
-
Do not set any preference cookies during your session
If you have GPC enabled but would like to opt in to optional preference cookies for a better experience, you can explicitly override this through our cookie consent banner. Your explicit opt-in will be recorded alongside the fact that GPC was detected, so we maintain a clear record of your informed consent.
7. HOW TO CONTROL COOKIES
Cookie Consent Banner: When you first visit our Application, a cookie consent banner allows you to accept or reject optional preference cookies and other non-essential storage on an express opt-in basis. We will not bundle consent for optional cookies with essential cookies. You can change your preferences or withdraw consent at any time through the Application settings or by clearing cookies and local storage in your browser. Withdrawal does not affect processing that occurred before withdrawal, but we will stop setting non-essential cookies and storage after your updated choice is recorded. Essential cookies cannot be rejected through the banner because they are strictly necessary for the Application to function securely.
Browser Settings: You can also control cookies through your browser settings. For information on managing cookies in your browser, visit:
If you reject, withdraw consent for, or delete optional cookies or similar storage, the Application will still function, but your interface preferences (date ranges, column visibility, language, sidebar state) will not persist between sessions. You may need to re-enter those choices each time you use the Application.
8. UPDATES TO THIS POLICY
We may update this Cookie Policy from time to time to reflect changes in the cookies or similar technologies we use or for legal or regulatory reasons, including developments under PIPEDA, other Canadian federal or provincial privacy requirements, and Quebec privacy requirements. The date at the top of this page indicates when it was last updated. If we make material changes to how we use optional cookies or similar technologies, introduce new non-essential purposes, or change a technology in a way that would reasonably affect your privacy choices, we will provide appropriate notice and, where required, request fresh consent before using those technologies. We encourage you to review this policy periodically.
9. CONTACT US
If you have questions about our use of cookies, consent choices, GPC, retention of consent records, or privacy rights under Canadian privacy laws, please contact our privacy contact at [email protected] or by mail. Quebec users may also contact us at the same address with questions about the governance of personal information and privacy-impact matters related to cookies or similar technologies. If your concern is not resolved, you may ask that it be escalated to the individual responsible for privacy compliance at Bernli:
Technologies Bernli Inc.
3-396 boulevard de la cité
Gatineau, Quebec J8T 8A1
Canada