Cookie Policy

KLARI TECHNOLOGIES LIMITED

Effective date: 18 September 2026

Klari uses cookies exclusively to keep you signed in and to remember your active organisation. We do not run analytics, advertising or session-replay cookies. This policy sets out exactly what we set, why, and for how long.

It should be read together with our Privacy Notice, our Terms of Service and our Data Processing Agreement.

1. What cookies are

Cookies are small text files that a site stores on your device. They let a service recognise your device between requests — which is what keeps you signed in.

References to "cookies" in this policy include the equivalent browser technologies where we use them for the same purpose, namely:

• browser local storage;
• browser session storage;
• authentication tokens.

We do not use pixels, web beacons, device fingerprinting or third-party tracking identifiers.

2. What we set

On the authenticated product (app.klari.ng) we use the following cookies and browser storage. The first two are first-party session and workspace cookies; the third is a functional display preference.

Cookie name	Purpose	Type	Lifespan	Flags
Session cookies whose names begin sb- (an access token and a refresh token)	Holds the access and refresh tokens for your signed-in session. Without these you cannot use the product.	Strictly necessary	Persistent — up to 400 days, cleared when you sign out. The access token inside it is short-lived and rotated continuously.	HttpOnly · Secure · SameSite=Lax
klari_current_org	Remembers which of your organisation memberships is the active workspace. Revalidated against your memberships on every read.	Strictly necessary	1 year	HttpOnly · Secure · SameSite=Lax
theme (browser local storage)	Stores the display preference selected with the theme control. It does not contain account or Tenant Data.	Functional preference	Until replaced or cleared by you	Browser local storage

That is the complete current inventory. The marketing site does not set authentication cookies. If you use its theme control, it may store the theme preference in browser local storage.

3. Why we use them

We use cookies for these purposes only:

3.1 Authentication. To identify a signed-in user and maintain a secure session.

3.2 Workspace selection. To remember which organisation you are working in, where you belong to more than one.

3.3 Security and integrity. The session cookies carry the HttpOnly, Secure and SameSite=Lax flags, which are themselves protective measures: they stop page scripts from reading your session token and limit its exposure to cross-site requests.

3.4 Display preference. To remember the theme you selected.

We do not use cookies for advertising, analytics, profiling or cross-site tracking.

4. What we do not set

Consistently with the above, Klari does not use:

• analytics cookies of any kind (no Google Analytics, no Plausible, no Mixpanel, no PostHog);
• advertising or retargeting cookies;
• third-party advertising networks;
• cross-site tracking technologies;
• session-replay or screen-recording tools;
• marketing profiling or behavioural monitoring.

Klari does not sell personal data obtained through cookies or any other means.

If we ever add a cookie that does not fit the strictly-necessary or functional-preference categories, we will implement a conspicuous consent mechanism before it loads. That has not happened yet, and this policy will be updated before it does.

5. First-party and third-party cookies

First-party. Every cookie in the inventory at section 2 is set by Klari on a Klari domain.

Third-party. Klari does not permit third-party advertising or tracking cookies on its website or platform. Our infrastructure providers, listed as sub-processors at https://klari.ng/security, operate the systems that issue and validate the session tokens described above; they do not set independent tracking cookies through our service.

6. Retention

Session cookies expire when the browser session ends.

Persistent cookies remain for the period stated in the inventory at section 2, or until you delete them.

We review these lifespans periodically to confirm they remain proportionate to their purpose.

7. Legal basis

GAID 2025 Article 19 regulates cookies and similar tracking tools and provides a narrow exception for necessary cookies.

Our assessment is as follows. The session and active-organisation cookies are strictly necessary: they exist solely to deliver the authenticated service you have asked for and to protect its security and integrity, and the product cannot function without them. We therefore treat them as falling within the Article 19 exception. The theme local-storage item is written only when you operate the theme control yourself, contains no personal data and performs no tracking.

We are confirming that analysis with Nigerian counsel. If the confirmed position requires consent for any item above, we will implement a consent mechanism and update this policy before relying on that item.

This policy is information about what is used. It is not a request for, or a record of, consent.

8. Managing your preferences

You can control cookies at any time:

• Sign out of Klari to clear the authentication and active-organisation cookies.
• Use your browser settings to view, delete, block or restrict cookies, or to be notified when a cookie is placed.
• Clear your browser storage to remove the theme preference.

Please note the consequences: clearing the authentication cookies will sign you out, and clearing the active-organisation cookie will reset you to your alphabetically-first organisation membership. Because the session cookies are strictly necessary, blocking them prevents use of the product.

9. International transfers

Information associated with these cookies is processed on the same infrastructure as the rest of the Service, which is hosted in Frankfurt, Germany (eu-central-1).

Klari is a Nigerian company whose infrastructure is in Germany, so this can involve a transfer of personal data out of Nigeria. The transfer mechanism is under review with Nigerian privacy counsel and is not settled; the position is set out in full at section 5 of our Privacy Notice, and Klari does not rely on any adequacy decision of the Commission.

10. Changes to this policy

We post a revised effective date when this policy changes. Every previous version stays available in the Trust Centre at https://klari.ng/trust/cookie-policy, each pinned to the SHA-256 of the text that was in force.

We will update this policy before, not after, adding any cookie that is not in the inventory at section 2.

11. Contact

Klari Technologies Limited (RC 9542173) Lagos, Nigeria

Questions about cookies: privacy@klari.ng

If you are dissatisfied with our response, you may lodge a complaint with the:

Nigeria Data Protection Commission (NDPC) https://ndpc.gov.ng