BeneVets Cookie Notice
Effective date: July 4, 2026 Last updated: July 4, 2026 Version: 1.0
§ 1. In Plain English (Summary)
In plain English: A cookie is a tiny file that a website saves in your browser so the site can remember things between page loads. BeneVets, Inc. ("BeneVets," "we," "our," or "us") uses only a small number of cookies. The most important ones keep you logged in, protect your account from cross-site attacks, and remember your accessibility settings. We use Google Analytics 4 to count how people use the site, with all advertising features turned off. We do not use any advertising or tracking cookies. We honor the Global Privacy Control signal across the entire Service. If your browser sends GPC, we do not load the analytics tag for that session.
§ 2. What Is a Cookie, and What Are "Similar Technologies"?
In plain English: A "cookie" is a small text file. "Similar technologies" include things like local storage and session storage, which work much the same way. We disclose all of them here so you know what is happening in your browser.
A cookie is a small text file that a website asks your browser to store on your device. The browser sends the cookie back to the website on subsequent requests, which lets the website "remember" things between page loads (for example, that you are logged in).
"Similar technologies" include browser features that perform comparable functions, such as:
- Local Storage (
window.localStorage): a key-value store that persists across browser sessions until cleared. - Session Storage (
window.sessionStorage): a key-value store that lasts only as long as the current browser tab is open. - IndexedDB (
window.indexedDB): a larger structured database in the browser. - Web beacons / pixels: a small image embedded in a page that signals to a server when the page loads.
- Server-set fingerprinting: techniques that derive a quasi-identifier from browser characteristics. BeneVets does not use fingerprinting.
This Notice describes BeneVets's use of cookies and the similar technologies above. References in this Notice to "cookies" include similar technologies unless context indicates otherwise.
§ 3. Categories of Cookies BeneVets Uses
In plain English: We group the cookies into three buckets. The first bucket is essential to running the Service. The second bucket is first-party telemetry that we operate ourselves. The third bucket is Google Analytics 4, which Google operates for us and which we have configured to be as privacy-protective as Google allows.
BeneVets's cookies and similar technologies fall into three categories:
§ 3.1. Strictly necessary (essential) cookies
These cookies are required for the Service to function. They cannot be disabled without breaking the Service. Examples: session identifier, cross-site request forgery ("CSRF") token, multi-factor authentication ("MFA") state, accessibility preferences.
§ 3.2. First-party analytics and telemetry
BeneVets operates a small first-party telemetry system to measure aggregate Service usage (e.g., which pages are visited, how long requests take). This telemetry uses cookies and local storage owned by BeneVets only. It does not transmit data to any Third Party. IP addresses are truncated before any persistent storage.
§ 3.3. Third-party analytics - Google Analytics 4
The Service uses Google Analytics 4 ("GA4"), a web-analytics service operated by Google LLC. GA4 sets first-party cookies in the user's browser. BeneVets has configured GA4 to be as privacy-protective as the service permits. See § 8 for the specific GA4 configuration.
BeneVets does not deploy advertising cookies, retargeting cookies, social-media cookies (e.g., Facebook Pixel, LinkedIn Insight Tag), session-replay tools (e.g., Hotjar, FullStory), or fingerprinting libraries.
§ 4. Specific Cookies Enumerated
In plain English: Here is the actual list of cookies the Service sets, what each one does, how long it lasts, and who owns it.
| Cookie / storage key | Type | First or third party | Purpose | Max-age |
|---|---|---|---|---|
__Host-bv_session | HTTP cookie, Secure, HttpOnly, SameSite=Lax | First party (BeneVets) | Authenticated session identifier | 30 days rolling; cleared on logout |
__Host-bv_csrf | HTTP cookie, Secure, HttpOnly, SameSite=Strict | First party (BeneVets) | Cross-site request forgery protection token | Session (browser close) |
__Host-bv_mfa | HTTP cookie, Secure, HttpOnly, SameSite=Strict | First party (BeneVets) | Multi-factor authentication state (interstitial) | 10 minutes |
bv_a11y | HTTP cookie, Secure, SameSite=Lax | First party (BeneVets) | Accessibility preferences (reduced motion, font scale, contrast) | 1 year |
bv_gpc_session | HTTP cookie, Secure, SameSite=Lax | First party (BeneVets) | Records that the Global Privacy Control signal was asserted for the session | Session |
bv_telemetry_id | HTTP cookie, Secure, SameSite=Lax | First party (BeneVets) | Anonymous, rotating client identifier for first-party telemetry; truncated IP only | 90 days |
_ga | HTTP cookie, SameSite=Lax | Third party (Google LLC) set as first-party on the BeneVets domain | Google Analytics 4 client identifier | 13 months (Google default); BeneVets sets the GA4 retention setting to 2 months |
_ga_<CONTAINER_ID> | HTTP cookie, SameSite=Lax | Third party (Google LLC) set as first-party on the BeneVets domain | Google Analytics 4 session state | 13 months (Google default); BeneVets sets the GA4 retention setting to 2 months |
Local Storage and Session Storage keys are enumerated in § 5.
__Host- prefixed cookies are used for the most sensitive cookies and require the Secure, Path=/, and no-Domain attributes per the IETF cookie standard (RFC 6265bis). HttpOnly means the cookie cannot be read by JavaScript in the browser. SameSite controls whether the cookie is sent on cross-site requests.
§ 5. Local Storage and Session Storage
In plain English: Local storage and session storage are similar to cookies but live in the browser instead of being sent to the server on every request. Here is what the Service puts there.
The Service stores the following items in window.localStorage or window.sessionStorage. These items are accessed only by the Service's own JavaScript and are not transmitted to any Third Party unless expressly noted.
| Storage key | Storage type | Purpose | Lifetime |
|---|---|---|---|
bv:ui:theme | localStorage | Light/dark mode preference | Until cleared |
bv:ui:font-scale | localStorage | Font scale preference (a11y) | Until cleared |
bv:ui:reduced-motion | localStorage | Reduced-motion preference (a11y) | Until cleared |
bv:ui:high-contrast | localStorage | High-contrast preference (a11y) | Until cleared |
bv:form-draft:<formId> | localStorage | Auto-save of a VA form draft you are working on, before server-side save | Until form submitted or you clear it |
bv:onboarding:step | sessionStorage | Current step in the onboarding flow | Tab close |
bv:gpc:asserted | sessionStorage | Mirrors bv_gpc_session cookie for client-side guards | Tab close |
bv:csrf:nonce | sessionStorage | Per-page CSRF nonce for fetch requests | Tab close |
BeneVets does not use IndexedDB at v1.
§ 6. How to Manage Cookies in Your Browser
In plain English: You can clear, block, or limit cookies through your browser settings. If you block essential cookies, parts of the Service will not work. The links below point to the relevant settings pages for the major browsers.
You may manage cookies through your browser's settings. Common locations:
- Google Chrome. Settings → Privacy and security → Cookies and other site data.
- Mozilla Firefox. Settings → Privacy and Security → Cookies and Site Data.
- Apple Safari. Settings → Privacy → Cookies and Website Data.
- Microsoft Edge. Settings → Cookies and site permissions → Manage and delete cookies and site data.
- Brave. Settings → Shields and Site Settings → Cookies and other site data.
If you block strictly necessary cookies (e.g., the session cookie or the CSRF token), the Service will not function correctly. Authentication, form preparation, and ProfileVault will not be usable.
You may also clear local and session storage through your browser's developer tools or, for most browsers, through the same "Clear browsing data" interface that handles cookies.
§ 7. Do Not Track and Global Privacy Control
In plain English: "Do Not Track" is an older browser signal that never got a clear standard, so we do not change our behavior based on it. "Global Privacy Control" is a newer, more specific signal, and we honor it across the entire Service.
§ 7.1. Do Not Track
Pursuant to Cal. Bus. & Prof. Code § 22575(b)(5), BeneVets discloses that the Service does not respond differently to a "Do Not Track" signal because no industry standard has been finalized for how such signals should be honored.
§ 7.2. Global Privacy Control (sitewide)
BeneVets honors the Global Privacy Control ("GPC") signal sitewide as a universal opt-out from Sale and Share under Cal. Code Regs. tit. 11, § 7025, Colo. Rev. Stat. § 6-1-1313, Conn. Gen. Stat. § 42-518(d), and analogous provisions in other applicable state privacy laws. When a request to the Service includes the Sec-GPC: 1 HTTP header or an analogous signal, BeneVets:
- Does not load the Google Analytics 4 measurement tag for the session.
- Records the opt-out as a session-scoped preference (
bv_gpc_sessioncookie andbv:gpc:assertedsessionStorage key). - Where the user is authenticated, records the opt-out as an account-scoped preference that persists across sessions and devices.
- Does not display any notification that contradicts or seeks to override the GPC signal.
For more on BeneVets's GPC posture, see § 13 of the Privacy Policy (Document 02).
§ 8. Google Analytics 4 - Specific Disclosures
In plain English: Google Analytics 4 is the only third-party analytics tool we use. We have configured it to be as private as Google permits. We anonymize IP addresses. We turn off "Google Signals." We disable ad personalization. We set retention to the shortest available period, which is 2 months. If your browser sends Global Privacy Control, we do not load Google Analytics for your session at all.
BeneVets uses Google Analytics 4 ("GA4"), a web-analytics service offered by Google LLC. BeneVets's GA4 configuration is as follows:
- IP anonymization. IP anonymization is enabled. Google truncates the IP address before any storage by GA4.
- Google Signals. Google Signals is disabled at the property level.
- Ad personalization. Ad personalization is disabled at the property level and at the event level (
allow_ad_personalization_signals: false). - Data sharing. Google's data-sharing settings between the GA4 property and other Google products and services are restricted to the minimum necessary for the analytics service itself.
- Data retention. GA4 data retention is set to the shortest available setting (2 months) for user-level and event-level data.
- Global Privacy Control. When the user agent transmits
Sec-GPC: 1, the GA4 measurement tag is not loaded for the session. No measurement event is sent to Google for that session. - No advertising identifiers. The GA4 deployment does not transmit advertising identifiers (e.g.,
gclid,dclid) to Google. - Reset on User Logout. When an authenticated user logs out, the GA4 client identifier (
_ga) is reset.
Despite this configuration, some interpretations of Cal. Civ. Code § 1798.140(ah) take the position that any GA4 deployment could be characterized as "sharing" for cross-context behavioral advertising. BeneVets's position is that, with the above configuration, no such sharing occurs. BeneVets treats GPC as a universal opt-out from any conceivable sharing through GA4. The "Do Not Sell or Share My Personal Information" link in the Service footer additionally disables the GA4 tag for the session for users who have not asserted GPC.
§ 9. State-Law Disclosures
In plain English: California law and several similar state laws require us to tell you about cookies in particular ways. We do that here and in the Privacy Policy.
This Notice supplements the Privacy Policy (Document 02). Where state privacy law requires specific cookie disclosures, those disclosures are made here and incorporated into the Privacy Policy by cross-reference. The Privacy Policy is the controlling document.
§ 10. Changes to this Notice
In plain English: If we change this Notice meaningfully, we will tell you. For account holders, we will email you and show a banner on the site. The "Last updated" date at the top reflects when we last changed anything.
BeneVets may amend this Notice from time to time. Material amendments will be communicated to account holders by email and by a banner on the Service for at least thirty (30) days following publication. The "Last updated" date at the top of this Notice reflects the most recent revision.
§ 11. Contact
In plain English: Email privacy@benevets.org with any cookie question.
For cookie-related questions:
- Email:
privacy@benevets.org - Postal mail: BeneVets, Inc. Attn: Privacy Officer 1441 Pomona Road, Suite 20 Corona, CA 92882
§ 12. Cross-References
This Notice is part of an integrated document set. It cross-references and is cross-referenced by:
- Document 02 - Privacy Policy (controlling document for all privacy matters)
- Document 04 - Sub-processor List (identifies Google LLC, Vercel, Inc., and other recipients)
- Document 15 - Automated Decision-Making and AI Notice
End of Cookie Notice.