Effective date: not yet in force. Last drafted 27 July 2026.
1.What this covers
This policy covers cookies and equivalent browser storage — localStorage and
sessionStorage — set on worldwatch.so and on the dealer application. Read
it alongside the Privacy Policy, which explains what we do with the
data these technologies produce.
A cookie is a small file a site stores in your browser. Some are strictly necessary, meaning the service cannot work without them. Everything else needs your consent under Article 5(3) of the ePrivacy Directive and its Dutch implementation in the Telecommunicatiewet.
2.The public marketing site
The pages you can read without signing in are deliberately close to cookie-free. The public tier loads no authentication SDK and no advertising tag, and the HTML served is identical for every visitor.
| Name | Purpose | Type | Duration |
|---|---|---|---|
NEXT_LOCALE | Remembers the language you chose, so the site does not keep guessing from your browser settings | Preference | 1 year |
wwmlang | Records that you dismissed the "this page is also available in your language" banner, so it is not shown again | Preference | 1 year |
__client_uat (and __client_uat_<suffix> on preview deployments) | Read, not written, on public pages: it is how the page decides whether to show "Sign in" or "Go to dashboard" before anything renders. Set by our identity provider when you sign in | Strictly necessary | Session, managed by the identity provider |
Page analytics and performance measurement on the public site are provided by Vercel Web Analytics and Vercel Speed Insights, which are cookieless and do not identify individual visitors.
3.The dealer application
| Name | Purpose | Type | Duration |
|---|---|---|---|
__session | The signed session token that authenticates each request | Strictly necessary | Short-lived, refreshed continuously while you are signed in |
__client_uat | Signed-in state, used by our routing layer to decide whether a page needs authentication | Strictly necessary | Session |
__clerk_db_jwt | Development and preview environments only, where third-party cookie restrictions require it | Strictly necessary | Session |
NEXT_LOCALE | Language preference, shared with the public site | Preference | 1 year |
wwm-onboarding-just-completed | Prevents the onboarding flow from bouncing you backwards in the seconds after you finish it | Strictly necessary | 30 seconds |
__stripe_mid, __stripe_sid | Set by Stripe on billing and checkout pages to detect payment fraud | Strictly necessary | 1 year and 30 minutes respectively |
We also use browser storage rather than cookies for a few things that never
leave your device: theme records whether you chose light, dark or system
appearance; wwm.auth-machine.v2 and wwm.auth-machine.v1.idempotency-key keep
your place in onboarding if you close the tab, and stop a repeated submission
creating two accounts; wwm.get-started.register-dealer in sessionStorage
holds a one-off reference for a single attempt at creating a dealer profile, so
that a resubmitted form does not register a second business, and is discarded
once the profile has been created; wwm.activeCatalogImportId and
wwm.acknowledgedCatalogImportId track a catalogue import in progress; and
agent_session_id in sessionStorage keeps one assistant conversation together
for the length of a tab.
4.Diagnostics
Our error monitoring provider, Sentry, sets no cookies. It records error reports, performance traces and — for a sampled share of sessions, plus every session in which an error occurs — a replay of interface interactions, so that a fault can be reproduced. Authentication tokens, credentials and request bodies are stripped before an event is sent. TO BE CONFIRMED: whether replay masking is configured strictly enough that customer names and addresses visible on screen are redacted, and what the retention period on the Sentry organisation is.
5.Marketing attribution
The sign-up and onboarding flow loads a script from Cometly, which attributes a new dealer account to the campaign that produced it. It is not loaded on the public marketing pages or anywhere else in the application. TO BE CONFIRMED: the cookies and identifiers Cometly sets, and their durations, must be listed here individually.
6.Consent, and an open compliance gap
Strictly necessary cookies do not require consent. Everything else does, before it is set.
Worldwatch does not currently present a consent banner, and the Cometly script in section 5 is loaded without asking. Under Article 5(3) of the ePrivacy Directive that is a gap, and it must be closed before this policy is published: either the attribution script is gated behind prior consent, or it is removed. The two preference cookies in section 2 are set only as a direct result of an action you take — choosing a language, dismissing a banner — which is the narrow basis on which they are treated as necessary to deliver a service you asked for; that reading also needs review.
7.Controlling cookies yourself
Every major browser lets you see, block and delete cookies from its settings.
Blocking strictly necessary cookies will stop you signing in and will break
parts of the dealer application. Clearing NEXT_LOCALE or wwmlang simply
means the site asks about your language again.
Browser-level signals such as Global Privacy Control are honoured where the law requires it (TO BE CONFIRMED: whether the application honours them today; it does not appear to read them).
8.Changes
We may change this policy as the software changes. The date at the top of the page changes with it.
9.Governing language
This policy is published in English, and any translation is offered for convenience only. If a translated version conflicts with the English version, the English version governs.