Status — read first
AI-assisted best-effort draft · not legal advice · not lawyer-reviewed.
This document was drafted with AI assistance as a best-effort starting point. No licensed attorney has reviewed, approved, or certified it, and it is not safe to rely on as a binding or compliant document. A qualified attorney in each operating jurisdiction must review and finish it before it is published or enforced. Nothing here claims an audit, certification, corporate registration, or executed contract that has actually happened.
This inventory has to be verified against the running app before it is published. Engineering re-greps document.cookie, localStorage, and sessionStorage and confirms the table; counsel then classifies each row for ePrivacy/PECR consent. Keep this as the engineering-maintained inventory and have the public page render from it, so the two cannot drift apart again.
Who sets these, and where
This inventory covers the storage set by Vettika, a service operated by Nexprove across both domains it operates — vettika.com and airecruiter.nexprove.com. The same first-party storage is used on both; none of it is shared across unrelated sites. Candidate-facing flows are intended to be analytics-free (see below).
The correction that matters most
Earlier copy said a session cookie was “reserved for if and when we ship sign-in” and omitted the actual login cookies. That was wrong. Better Auth with Google sign-in has been live since Session 3, and recruiters are logging in right now. The auth cookies below are real and set today.
Inventory (verify against the running app before publish)
| Storage key | Type | Set by | Purpose | Category | Retention |
|---|---|---|---|---|---|
| better-auth.session_token | Cookie (HttpOnly, Secure, SameSite=Lax) | Better Auth | Recruiter session — live today | Strictly necessary | Session + ~30 days |
| Better Auth CSRF cookie | Cookie | Better Auth | CSRF protection — live today | Strictly necessary | Session |
| Cookie-consent choice | localStorage | consent store | Records the user's own consent choice | Strictly necessary | Until cleared |
| theme | Cookie / localStorage | next-themes | Light/dark preference | Functional | Until cleared |
| Candidate consent mirror | localStorage | candidate consent store | Local copy of submitted candidate consent, to resume across page loads | Strictly necessary | Until cleared |
| Campaign draft | localStorage | campaign wizard | In-progress campaign draft (recruiter) | Functional | Until cleared / submit |
| Vercel Analytics ID | Cookie | @vercel/analytics | First-party traffic analytics | Analytics — consent-dependent | Short rolling |
| aii_attr, aii_anon | Cookie (first-party) | marketing attribution | Attribution for marketing | Reclassify — see below | Verify |
Storage-key prefixes (aircruiter:, etc.) are historical from the old brand and should be checked against what the current build actually writes. None of these cross sites.
Two things counsel must decide before publish
Is analytics actually running, and is there a banner? The pages have contradicted each other — one said “we do not run analytics and there is no consent banner,” while others said Vercel Analytics runs opt-in behind a consent banner. Both cannot be true. Engineering establishes the ground truth — is analytics live, and is there a working banner — and all pages are made to say the same thing.
The marketing-attribution cookies need a real classification. aii_attr and aii_anon are set for marketing attribution. First-party does not automatically mean strictly necessary under ePrivacy/PECR; marketing-attribution cookies generally need consent for EU/UK visitors. Either gate them behind consent, or have counsel justify the classification in writing. Until that is settled, we do not claim “the law does not require us to interrupt your visit with a banner” — that is a legal conclusion the site cannot yet support.
What we do not set
No Google Analytics, Meta Pixel, or TikTok Pixel. No third-party advertising cookies. No fingerprinting libraries. No session-replay tools. (Verify this remains true at each release.)
Candidate pages
The candidate flows (apply, interview, feedback) should be analytics-free. This is to be enforced at the route boundary, not just by a consent-banner default being off. Where the enforcement is still a default rather than a hard guard, we do not describe it publicly as a guarantee.
How to control cookies
You have several levers:
- Strictly-necessary storage (session and CSRF cookies, your consent choice) cannot be switched off without breaking sign-in — clearing it signs you out.
- Functional and analytics storage can be declined; where a consent banner is in force, your choice is recorded and honored.
- Browser controls let you block or delete cookies and site data for vettika.com and airecruiter.nexprove.com at any time; doing so may sign you out or reset preferences.
Audit cadence
- Before each release: grep for
document.cookie,localStorage.setItem,sessionStorage.setItemand reconcile this table with reality. - Quarterly: counsel reviews the classifications.