1The short version
Vederca sets one cookie, and only while you sign in with Google, to protect that sign-in. Everything else we keep is in your browser's local or session storage, it is listed in full below, and nothing outside the strictly necessary items is stored until you allow it.
Most sites that publish a cookie policy are describing third party advertising and tracking tags. We run none: no advertising network, no data broker, and no third party analytics service. What we store is what the platform needs to sign you in, remember the settings you choose in the portals and not lose your work, plus our own traffic measurement on the public website, which is off until you allow it.
This policy sits alongside our , which explains how we handle personal information more broadly.
2Cookies, local storage and why the difference matters
A cookie is a small file a site stores on your device and sends back to its server with every request. Local storage and session storage also keep data in your browser, but the browser never transmits them automatically: our code has to read them and choose to send something.
We use local and session storage rather than cookies, apart from the one short-lived sign-in cookie listed below. In substance the privacy question is the same, which is why we ask for your consent in the same way and describe it all here. Session storage is cleared by your browser when you close the tab.
When a buying organisation pays an invoice through Stripe, a vendor buys or manages Vederca Plus on Stripe's pages, or you sign in with Google, you are on their pages for that step, and their own cookie policies apply there.
3Everything we store, item by item
| Item | Category | What it does | How long |
|---|---|---|---|
| rfp-auth-storage | Strictly necessary | Keeps you signed in to the Procure portal and admin console between page loads. | Until you sign out or clear site data |
| vendor-auth-storage | Strictly necessary | Keeps you signed in to the vendor portal between page loads. | Until you sign out or clear site data |
| vd_google_oauth | Strictly necessary | Our only cookie, set only while you sign in with Google. It lets our server check that the sign-in coming back from Google is the one you started, which protects you from forged sign-ins. The site's scripts cannot read it. | Cookie: deleted when the sign-in completes, and expires after 10 minutes in any case |
| vederca-cookie-consent | Strictly necessary | Records the choice you make on this page so we do not ask again, and so we can honour it. | Until the policy version changes, or you clear it |
| vederca-theme-mode | Strictly necessary | Remembers the appearance you chose (light, dark, or your device's setting) on the sign-in page or in a portal, so pages open in it. | Until you clear site data |
| vederca-theme-chosen-*, vederca-theme-synced-*, vederca-portal-engaged-*, vederca-portal-visits-* | Strictly necessary | Remember that you have answered the one-off appearance question in a portal, that your answer has been saved to your account, and how long you have used the portal, so the question is asked once and at a sensible moment rather than on every visit. | Until you clear site data. The marker ending -counted is session storage, cleared when you close the tab |
| intake-conversation-storage | Strictly necessary | Holds an in-progress procurement request conversation in the Procure portal so a refresh does not lose your answers. | Until you clear site data. It is emptied once the request is submitted |
| vederca-demo-mode | Strictly necessary | Holds the Procure portal demo while you explore it, including what you have changed in it, so a refresh keeps your place. Nothing in the demo is saved to an account. | Session storage, cleared when you close the tab |
| vd_registry_view:* | Strictly necessary | Notes that you have already opened a vendor listing in the directory during this visit, so the listing's daily view total counts you once. It holds no identifier and is never sent to us. | Session storage, cleared when you close the tab |
| vd_region | Preferences | The country you chose in the region picker, so the vendor registry shows the vendors that operate there. Only kept when you allow preference storage; otherwise your choice lasts for the visit. | Until you change it or clear site data |
| vd_industry | Preferences | The kind of institution you told the product registry you buy for (a bank, a credit union, an insurer and so on), so products built for it come first. Only kept when you allow preference storage; otherwise your choice lasts for the visit. | Until you change it or clear site data |
| vd_compare | Strictly necessary | Holds the products you picked to compare in the registry (their names and registry addresses, at most four), so the list follows you from page to page. It is sent to us only if you choose to invite those products to a procurement when you sign up, so they are saved with your account. | Until you empty the list or clear site data |
| kai-sidebar-width | Strictly necessary | Remembers how wide you made the Kai panel in the buyer or vendor portal. | Until you clear site data |
| vendor-requirements-filters | Strictly necessary | Remembers the requirement filters you set in a vendor response workspace. | Until you clear site data |
| kai-profile-review-hidden | Strictly necessary | Remembers that you hid the Kai profile review prompt in the vendor portal. | Session storage, cleared when you close the tab |
| vp-verified-banner-dismissed-* | Strictly necessary | Remembers that you dismissed the Verified badge card on your vendor portal dashboard. | Until you clear site data |
| vederca-abn-check:* | Strictly necessary | Keeps the result of your organisation's ABN lookup in the vendor portal, so a reload does not query the register again. | Session storage, cleared when you close the tab |
| vederca-admin-ui, timeline-card-expanded | Strictly necessary | Used only in the admin console by the Vederca team: whether its sidebar is collapsed, and whether a procurement timeline was left expanded. | Until you clear site data |
| vd_chunk_reload | Strictly necessary | Records the time the site last reloaded a page because part of it could not be loaded, usually after an update, so it never reloads more than once a minute. | Session storage, cleared when you close the tab |
| vd_no_track | Strictly necessary | Records that you have asked not to be measured. While it is set, no analytics are collected, whatever your choice in the consent panel. | Until you clear site data |
| vd_internal | Strictly necessary | Set only in browsers the Vederca team uses for the admin console, so the team's own visits are left out of the site's visitor counts. It never adds to what is measured. | Until you clear site data |
| vd_internal_reported | Strictly necessary | Set in a Vederca team browser once it has asked our server to leave its earlier visits out of the counts, so it asks only once per tab. | Session storage, cleared when you close the tab |
| vd_visitor_id | Analytics | A random identifier that lets us count a returning visitor once rather than twice. It is not linked to your account and is never shared. | Until you clear site data, and removed immediately if you decline this category |
| vd_session_id | Analytics | Groups the pages you look at in one sitting into a single visit. A visit ends after 30 minutes of inactivity. | Replaced after 30 minutes of inactivity, and removed immediately if you decline this category |
| vd_session_at | Analytics | The time of your last activity, used to work out when the visit above has ended. | Updated as you browse, and removed immediately if you decline this category |
Strictly necessary items cannot be switched off, because without them you cannot stay signed in, the portals cannot keep the settings you choose there, and we cannot record the choice you make here. If you would rather we stored nothing, do not sign in, and clear site data when you leave.
4The categories you can control
Preferences
Remembers choices you make on the public website. Today that is one item: the country you pick in the region picker (vd_region), so the vendor registry keeps showing the vendors that operate there. Without this category your choice lasts for the visit only. The settings the portals remember, such as the width of the Kai panel or your appearance choice, are part of the service you are using there, so they are listed above as strictly necessary.
Analytics
Measures how the public pages of the site are used, so we can see which pages work and which do not. This is first party only: the data goes to our own servers, not to a third party analytics service, and it is never sold or shared.
When you allow it, we record your IP address, your browser's user agent (which identifies the browser and type of device), language setting and screen size, an approximate location (country, region and city) worked out from your browser's time zone, the pages you view, the site that referred you, the link you arrived by including any campaign (utm_*) parameters and ad click identifier, clicks on labelled page elements, how far down a page you scroll, and how long you spend on it. We do not record anything you type: form events carry the form's name and nothing from its fields. Analytics records are deleted after 12 months.
Measurement covers the public site only and stops the moment you enter a portal or the admin console, so your actual product use is never measured here. Decline this category, or turn it off later under Cookie settings, and nothing more is collected about your visit and the three identifiers above are deleted from your browser.
One count does not depend on this category, because it uses no storage and identifies no one: arriving through one of our tracked campaign links is counted against that link, with the page it opened, the type of device and the referring site's domain. Nothing is written to your browser for it, and the sets out what it records. The same goes for our daily totals of page views on the public pages, kept only as counts by page, referring domain, campaign link, type of device and country, which the Privacy Policy also describes.
Marketing
Would measure campaigns and personalise content. We do not currently use any marketing or advertising storage, and we run no third party advertising tags. The category exists so that your choice is already on record before we ever introduce one, and so introducing one cannot happen behind your back.
Anything we add to a category in future will be listed in the table above and loaded only after you have allowed that category. Adding one is a material change, so the policy version will be bumped and you will be asked again.
5Changing your choice
You can change your mind at any time, and doing so takes effect immediately: anything in a category you turn off is deleted from your browser as soon as you save.
The same control is in the website footer and in the user guide, under Cookie settings.
6Controlling storage in your browser
Independently of the choice above, your browser can block or clear site data. Blocking storage for this site will sign you out and will prevent us from remembering your consent choice, so you will be asked each visit.
Because we run no advertising or cross-site tracking, browser signals such as Do Not Track and Global Privacy Control have nothing here to act on. If that changes, we will honour them and say so on this page.
7Changes to this policy
We may update this policy. Where the change is material, including any addition to the preferences, analytics or marketing categories, the version is bumped and your saved choice stops counting as consent to the new version, so you will be asked again. This version is 1.5, effective 8 October 2026.
8How to reach us
Email support@vederca.com with the subject "Privacy", or, if you have an account, use the support console in the buyer or vendor portal. The page in the user guide sets out the other ways to reach us.
These documents are published by A.C.N. 699 804 307 Pty Ltd trading as Vederca (ABN 27 699 804 307, ACN 699 804 307), an Australian private company based in Western Australia, Australia.