Production-candidate policy · Human legal review required before launch
1. Cookies and similar technologies
Cookies are small values stored by a browser. Similar browser storage may also remember information. They can keep a session secure, remember preferences, or—where enabled with consent—help measure how a site is used.
2. Strictly necessary technologies
Currently Natty uses technologies needed for core operation, including secure Better Auth account sessions, origin and abuse protections, and language preference. These are not used for advertising and cannot all be disabled through a consent tool without making the requested feature unavailable.
3. Preferences
A locale preference may remember whether the interface should be shown in English or Spanish. Browser settings can remove this preference, after which the deterministic default language is used.
4. Consent and analytics stack
Currently Natty integrates CookieYes for consent management, Google Tag Manager for controlled tag delivery, and Google Analytics 4 for limited product-funnel measurement where the deployed environment is configured for analytics.
Analytics storage is denied by default. GTM and GA4 analytics are withheld until you grant analytics consent. Rejecting or later withdrawing that consent keeps future application analytics events from being sent. Advertising storage and advertising personalization remain denied.
5. Analytics data limits
Analytics events use limited values such as Program or specialization slugs, locale, filter choice, entry point, page path, and checkout stage. They must not intentionally include names, email addresses, phone or WhatsApp numbers, user, Enrollment, Order or payment identifiers, sensitive onboarding answers, body measurements, health/history information, authentication material, or payment credentials.
A visit to the checkout-success return page is measured only as a browser return. It is not treated as payment confirmation or a GA purchase event.
6. Your choices
You can accept, reject, or customize optional cookies in the CookieYes banner. The “Cookie preferences” action in the public footer reopens those controls so analytics consent can be changed or withdrawn. Browser settings can also remove cookies, although blocking necessary cookies can prevent sign-in or other requested functions.
7. Runtime declaration and updates
We do not maintain a permanent exhaustive cookie list in this text. CookieYes scanning and its runtime declaration provide the deployed cookie categorization after the production domain has been scanned and reviewed. Questions should be sent to [PRIVACY CONTACT — LEGAL_REVIEW_REQUIRED].