Cookie Policy

Cookies are small text files stored on the user's device during browsing. They can be first-party (set by the visited site) or third-party (set by external services). This Cookie Policy describes the types of cookies used by the Sherlok platform and how to manage them, in compliance with Regulation (EU) 2016/679 (GDPR) and the guidelines of the Italian Data Protection Authority regarding cookies.

The cookies used on the Platform fall into the following categories: a) Technical / Necessary Cookies (no consent required) These are essential for the Platform to function and cannot be disabled. They include: - Session cookies for user authentication (next-auth.session-token) - Language cookie (sherlok_lang): remembers the chosen language (Italian, English or Chinese). It is set when the language is chosen from the selector or a link with the lang parameter is opened, and lasts 365 days. When the language is chosen from the selector, the same preference is also saved in the browser's local storage (localStorage). - Cookie choice cookie (cookie-consent): remembers whether the user clicked "Accept all" or "Necessary only", for 365 days. The same choice is also saved in the browser's local storage (localStorage). - Security cookies (CSRF protection) b) Analytics Cookies (consent required) Used to collect aggregate information about Platform usage to improve the service: - Google Analytics (GA4): anonymous collection of browsing data, pages visited, session duration, traffic source. IP address is anonymized. - Microsoft Clarity: click maps and pseudonymous session recording (clicks, scrolling, pointer movements), to understand where use of the Platform breaks off. All page text, including data typed into forms, is masked before it is sent to Microsoft. Clarity is not active on the messages, personal area, profile, settings, payment and billing, sign-up and login, listing editing and administration pages. Microsoft may process data in the United States, under the standard contractual clauses and the EU-US Data Privacy Framework. c) Functional Cookies (consent required) Enable additional features such as map integration: - Google Maps: used to display the location of businesses on listings. d) Visit Origin Measurement Cookie (consent required) The first-party cookie sherlok_attr measures where a visit came from, to understand which channels bring new users. It is set only if the user clicks "Accept all" and lasts 90 days. With "Necessary only" it is not set and, if already present, it is deleted. It contains: - the source and medium of the visit (for example a search engine, an AI assistant, a social network, another website or an advertising campaign); - any campaign parameters (utm_source, utm_medium, utm_campaign, utm_content, utm_term) and ad click identifiers (gclid, gbraid, wbraid from Google Ads; fbclid from Meta); - only the address of the referring website, never the page or search the visitor came from; - the entry page on Sherlok, without sensitive parameters, and the date of the visit. Before the user chooses, this information stays only in the memory of the open page and is not saved. If the user signs up while the cookie is present and full consent is active, its content is linked to the account to measure the acquisition channel; without full consent the cookie is not read. e) First-Party Cookies Currently Set Regardless of the Banner Choice The following cookies are set by Sherlok even if the user chooses "Necessary only" or has not chosen yet: - sherlok_anon_id (365 days): a random browser identifier, set on the first page viewed, used to count unique visitors each day. On every page viewed Sherlok records on its own servers, linked to this identifier (or to the account, if the user is logged in): the first page viewed that day, the name of the referring website and any utm parameters, country, region and city derived from the IP address, a cryptographic fingerprint (hash) of the IP address, the browser type, the number of pages viewed and, if an A/B test is running, the assigned version and the actions measured by the test. - sherlok_exp (180 days): set only while an A/B test is running. It contains the version of the pages assigned to the browser, so that the same version is shown on every visit. The version is sent with visits and, at sign-up, saved on the account to measure the test result. When no tests are running any more, the cookie is expired. - sherlok_ref (30 days): set when an invitation link with the ref parameter is opened. It contains the invitation code, which is linked to the account at sign-up and offered as a discount code at purchase. - sherlok_ref_counted (30 days): set when an invitation link is opened. It contains the invitation code and prevents the same click from being counted twice. The click is recorded on Sherlok's servers with a fingerprint (hash) of the IP address, country, region and city, browser and device type, and the Sherlok page the visitor landed on. Note on email notifications. The transactional emails sent by the Platform (account notifications, messages, AI matching suggestions, notices regarding profile visibility to advertisers) do not use cookies. Their purposes and legal bases are described in the Privacy Policy. The "anonymous visibility" preference is an account setting stored server-side and not in a cookie.

| Cookie | Type | Duration | Purpose | |---|---|---|---| | next-auth.session-token | Necessary | Session | User authentication | | __Secure-next-auth.session-token | Necessary | Session | User authentication (HTTPS) | | cookie-consent | Necessary | 365 days | Stores cookie preferences (also in localStorage) | | sherlok_lang | Necessary | 365 days | Chosen language | | sherlok_anon_id | First-party statistics, set without consent | 365 days | Random identifier to count unique visitors each day | | sherlok_exp | A/B test, set without consent | 180 days | Version of the pages assigned during an A/B test | | sherlok_ref | Invitation program, set without consent | 30 days | Invitation link code, for sign-up and discount | | sherlok_ref_counted | Invitation program, set without consent | 30 days | Prevents counting a click on an invitation link twice | | _ga, _ga_* | Analytics | 2 years | Google Analytics - browsing statistics | | _clck, _clsk | Analytics | 1 year / 1 day | Microsoft Clarity - click maps and session recording | | MUID, CLID, ANONCHK, SM, MR | Analytics (third party) | Up to 1 year | Microsoft Clarity - clarity.ms and bing.com domains | | sherlok_attr | Visit origin measurement | 90 days | Where the visit came from (source, medium, campaign, ad click identifier, referring website, entry page); only with "Accept all" | | NIDP, CONSENT | Functional | Variable | Google Maps - map display |

On first access to the Platform, an informational banner requests consent for the activation of analytics, functional and visit origin measurement cookies. The user can: - Accept all cookies by clicking "Accept all." - Reject non-essential cookies by clicking "Necessary only." - Change preferences at any time through their browser settings. Technical/necessary cookies are always active as they are essential for the Platform to function. The cookies listed under letter e) of section 2 are also currently set regardless of the choice.

Users can manage or delete cookies directly from their browser. Below are instructions for the main browsers: - Google Chrome: Settings → Privacy and security → Cookies and other site data - Firefox: Settings → Privacy & Security → Cookies and Site Data - Safari: Preferences → Privacy → Manage Website Data - Safari (iOS): Settings → Safari → Block Cookies - Microsoft Edge: Settings → Cookies and site permissions → Manage and delete cookies Disabling certain cookies may limit the functionality of the Platform.

Some cookies are set by third-party services integrated into the Platform. For more information on their privacy policies: - Google Analytics: https://policies.google.com/privacy - Microsoft Clarity: https://privacy.microsoft.com/privacystatement - Google Maps: https://policies.google.com/privacy - Google OAuth: https://policies.google.com/privacy Users can disable Google Analytics by installing the browser add-on available at: https://tools.google.com/dlpage/gaoptout

Under the GDPR, users have the right to access, rectify, erase, restrict, and port their data, as well as to object to processing. To exercise these rights or for information about cookies, contact: [email protected] Users also have the right to file a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).

We reserve the right to update this Cookie Policy. The last update date is indicated at the top of this document. In the event of substantial changes, the consent banner will be updated.

Sherlok Milan, Italy Email: [email protected]