Cookie Policy
Version 1.0 Effective Date: April 2026
Operated by GIBQ Operations LLC under license from Global Institute for Biomedical Quality.
1. About This Cookie Policy
This Cookie Policy explains how GIBQ Operations LLC, a Delaware limited liability company ("we," "us," or "our"), uses cookies and similar technologies on gibq.org and any related online services we operate (the "Services"). It supplements our Privacy Policy and our Terms of Service, both of which are incorporated by reference.
This document is structured in two parts. Part A describes the cookies and similar technologies that are currently in use on the Services. Part B describes additional categories of cookies and similar technologies that we expect to introduce in a future phase, together with the consent controls that will apply when we do. We have published Part B in advance, rather than rewrite this Policy when those technologies are introduced, so that visitors can see the full picture of how we treat cookies before any non-essential technology is loaded.
2. What Are Cookies and Similar Technologies
A "cookie" is a small text file that a website places on your browser or device when you visit. Cookies allow a website to recognize your browser, remember your preferences, keep you signed in, and measure how the site is used. "Similar technologies" include local storage, session storage, pixels, web beacons, software development kits, and device fingerprinting techniques that perform comparable functions.
In this Policy, references to "cookies" include both cookies and these similar technologies, unless we expressly distinguish them. Cookies may be set by us ("first-party cookies") or by a third-party service we use ("third-party cookies"). They may persist only for the duration of a single browsing session ("session cookies") or remain on your device for a defined period ("persistent cookies").
3. Categories of Cookies
We classify cookies into four categories, following the framework used by most consent management standards in the United States and the European Union.
| Category | Purpose | Consent Required |
|---|---|---|
| Strictly Necessary | Required for the Services to function. Includes session, authentication, security, and load-balancing cookies. Without these, the site cannot operate. | No — exempt under all applicable laws |
| Performance / Analytics | Help us understand how the Services are used so we can improve them. May be cookieless and privacy-friendly (no consent needed) or cookie-based and identifying (consent needed). | Depends on implementation — see Parts A and B |
| Functional | Remember preferences and choices, such as language, region, or display settings. We do not currently use functional cookies. | Yes, when used |
| Advertising / Targeting | Track visitors across websites to deliver relevant advertising and measure advertising effectiveness. We do not currently use advertising cookies. Planned for a future phase (see Part B). | Yes, when used |
PART A — Currently In Use on the Services
4. Cookies and Technologies Currently in Use
As of the Effective Date of this Policy, the Services use only the cookies and technologies listed in Sections 4.1 and 4.2 below. We do not currently load any advertising, retargeting, conversion-tracking, or cross-site behavioral analytics technologies. We do not currently use cookies that require your consent under EU, UK, or U.S. state privacy laws.
4.1 Strictly-Necessary Cookies
Strictly-necessary cookies are required for the Services to function correctly. These cookies are exempt from consent requirements under the EU ePrivacy Directive, the UK Privacy and Electronic Communications Regulations, and U.S. state privacy laws.
| Cookie / Technology | Provider | Purpose | Duration |
|---|---|---|---|
| Session cookie | First party (gibq.org) | Maintain your session while navigating the Services | Session |
| Authentication token | First party / Supabase Auth | Keep you signed in to vendor application accounts | Session, with mandatory re-authentication every 8 hours |
| CSRF token | First party (gibq.org) | Protect against cross-site request forgery attacks | Session |
| Load balancing | Vercel | Route requests to the appropriate server for site reliability | Session |
| Cookie preferences (when deployed) | First party or consent management provider | Remember your cookie preferences once non-essential cookies are introduced | Up to 12 months |
4.2 Privacy-Friendly Analytics
We use Vercel Analytics and Vercel Speed Insights to understand how the Services are used and to improve performance. These tools are designed to operate without setting tracking cookies, without collecting personally identifying information, and without performing cross-site tracking.
| Tool | Provider | Data Collected | Cookies Set |
|---|---|---|---|
| Vercel Analytics | Vercel Inc. | Aggregated page views, referrer, country (no IP storage), device type | None |
| Vercel Speed Insights | Vercel Inc. | Aggregated performance metrics (load time, interaction time) | None |
Because these tools do not set cookies and do not collect personally identifying information, they do not require consent under applicable privacy laws. We disclose them here for transparency.
5. What We Do Not Use Today
As of the Effective Date of this Policy, we do not use any of the following on the Services:
- Advertising cookies or pixels (including Meta Pixel, Google Ads conversion tags, Reddit Pixel, LinkedIn Insight Tag, or TikTok Pixel).
- Cross-site behavioral tracking technologies.
- Session-replay or heat-mapping tools (such as Hotjar, FullStory, or Microsoft Clarity).
- Identity-graph or fingerprinting providers.
- Third-party analytics that set persistent identifiers (such as Google Analytics in default configuration).
If and when we introduce any of these technologies, the consent controls described in Part B will apply, and this Policy will be updated to move the relevant rows from Part B to Part A.
PART B — Planned Future Use and Consent Controls
6. Planned Cookies and Technologies
Important: The cookies and technologies described in this Part B are not currently loaded on the Services. They are described here in advance so that visitors can see the full picture of how we plan to treat cookies. Before any technology in this Part B is activated, this Policy will be updated and a consent management tool will be deployed that allows you to accept or reject these categories before they load.
In a future phase of operations, we expect to launch advertising and conversion-measurement campaigns to support awareness of the GIBQ Verified standard. When that occurs, we anticipate using some or all of the following technologies. Each of these requires your prior, informed consent in the EEA, the United Kingdom, and Switzerland, and provides opt-out rights to residents of California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, Tennessee, Indiana, Iowa, Delaware, New Jersey, New Hampshire, and other U.S. states with similar privacy laws.
| Technology | Provider | Purpose | Category |
|---|---|---|---|
| Meta Pixel | Meta Platforms, Inc. | Measure effectiveness of campaigns on Facebook and Instagram and deliver retargeted advertising | Advertising |
| Google Ads conversion tag | Google LLC | Measure effectiveness of Google Ads campaigns and deliver retargeted advertising | Advertising |
| Google Analytics 4 (if introduced) | Google LLC | Detailed visitor analytics with persistent identifiers (alternative to Vercel Analytics) | Performance / Analytics |
| Reddit Pixel | Reddit, Inc. | Measure effectiveness of campaigns on Reddit and deliver retargeted advertising | Advertising |
| LinkedIn Insight Tag (potential) | LinkedIn Corporation | Measure effectiveness of campaigns on LinkedIn and deliver retargeted advertising | Advertising |
This list is illustrative and not exhaustive. We may add or remove specific providers; in any case, the consent rules described below apply uniformly to all advertising and non-essential analytics technologies.
7. Consent Controls Before Activation
Before any cookie or technology described in Section 6 is loaded on the Services, we will deploy a consent management tool that meets the requirements set out below. We will not pre-load any non-essential technology pending consent.
7.1 EEA, United Kingdom, and Switzerland
Visitors located in the EEA, the United Kingdom, or Switzerland will see a consent banner the first time they visit the Services after non-essential technologies are introduced. The banner will:
- Prevent any non-essential cookie or technology from loading until you make a choice.
- Present "Accept All," "Reject All," and "Manage Preferences" options with equal visual prominence.
- Allow you to grant or withdraw consent on a per-category basis (for example, accept analytics but reject advertising).
- Record your consent choice with a timestamp and version of this Policy in effect at the time.
- Permit you to change your choice at any time using a persistent cookie-preferences link in the site footer.
Consent is freely given, specific, informed, and unambiguous, consistent with Article 4(11) and Article 7 of the GDPR.
7.2 United States
Visitors in U.S. states that grant cookie-related rights will see, at a minimum:
- A clear notice when non-essential technologies are first loaded, with a link to this Policy.
- A persistent "Do Not Sell or Share My Personal Information" link in the site footer (or, in some states, "Your Privacy Choices").
- Recognition of Global Privacy Control (GPC) and similar opt-out preference signals where required by applicable law.
- The ability to opt out of "sale" or "sharing" of personal information for cross-context behavioral advertising at any time, without an account.
7.3 Children
The Services are intended for business and professional use, not for minors. We will not knowingly enable advertising or analytics technologies in a manner that targets minors under the age of sixteen (16).
7.4 When This Policy Will Be Updated
On or before the date that any non-essential cookie or technology is first activated on the Services, we will update this Policy by moving the applicable row from Part B to Part A and adding the specific cookie names, durations, and providers that have been deployed. The Effective Date at the top of this Policy will be revised, and we will provide notice of material changes through the Services or by other reasonable means.
8. How You Can Manage Cookies
8.1 Through the Consent Tool
Once a consent management tool is deployed, you may use it at any time to grant or withdraw consent for non-essential cookies. A persistent link in the footer of the Services will provide access to your preferences.
8.2 Through Your Browser
Most browsers allow you to view, manage, and delete cookies directly. Instructions are typically available in the "Help," "Privacy," or "Settings" section of your browser. You can also configure your browser to block all cookies, to alert you before a cookie is set, or to delete cookies when you close the browser. Note that blocking strictly-necessary cookies may prevent parts of the Services from functioning correctly.
8.3 Do Not Track and Global Privacy Control
Some browsers transmit a "Do Not Track" (DNT) signal. There is no industry consensus on how websites should respond to DNT, and we do not currently respond to DNT signals. We do, however, plan to recognize Global Privacy Control (GPC) signals once non-essential technologies are introduced, in line with Section 7.2 above and applicable U.S. state privacy laws.
9. Relationship to Other Policies
This Cookie Policy supplements, and should be read together with, the following:
- Privacy Policy — describes how we collect, use, disclose, and safeguard personal information generally, and explains your privacy rights.
- Terms of Service — governs your use of the Services.
In the event of a conflict between this Cookie Policy and the Privacy Policy on a matter specific to cookies, this Cookie Policy controls. In the event of a conflict on any other matter, the Privacy Policy or Terms of Service, as applicable, controls.
10. Changes to This Cookie Policy
We may update this Cookie Policy from time to time to reflect changes in our practices, the technologies we use, legal requirements, or other factors. When we make changes, we will revise the "Effective Date" at the top of this Policy and, if the changes are material, provide additional notice through the Services or by other reasonable means. We will always update this Policy before activating any non-essential cookie or technology described in Part B.
11. Contact
Questions about this Cookie Policy may be directed to:
GIBQ Operations LLC Attn: Privacy Officer Email: privacy@gibq.org General inquiries: info@gibq.org Website: gibq.org
12. Governing Law and Venue
This Cookie Policy and any disputes arising under or in connection with it shall be governed by and construed in accordance with the laws of the State of Delaware, without regard to its conflict-of-laws principles. Any action, suit, or proceeding arising under or in connection with this Policy shall be brought exclusively in the state or federal courts located in Wilmington, Delaware, and the parties consent to the personal jurisdiction of such courts and waive any objection based on inconvenient forum. Nothing in this Section limits any non-waivable rights you may have under the consumer protection or privacy laws of your state, country, or region of residence.
GIBQ Operations LLC · Cookie Policy v1.0 · April 2026 Operated under license from Global Institute for Biomedical Quality.