Cookie Notice

1. Who we are, and the short version of this notice

CYBER WAVE INC., a corporation existing under the laws of Ontario, Canada (Ontario Corporation Number 1000780137), located in Markham, Ontario, Canada ("CyberWave", "we", "us" or "our") publishes this notice for the marketing website at cyberwave.ca and the CyberWave Sentinel application at sentinel.cyberwave.ca. It should be read with our Privacy Policy, Terms of Service, Subprocessors, Data Processing Addendum and AI Features & Data Use Notice.

The short version, and it is unusual enough to state at the top rather than bury:

• Neither the website nor the Sentinel application uses analytics, advertising or tracking cookies, and neither loads analytics, advertising or tracking scripts.
• What the application does use is a short list: authentication session cookies, set by our authentication provider Supabase, that keep you signed in; browser storage entries that hold interface state; and a service worker that keeps an offline page cache on your device. Section 5 lists them.
• We use no advertising, retargeting or conversion-measurement technology anywhere. No pixel, no conversion tag, no cross-site tracker.
• There is no cookie consent banner and no "Cookie settings" link, because no non-essential cookie is set. If we ever introduce an analytics or advertising technology, nothing of that kind will load before you agree to it, and this notice will be updated before it is deployed (sections 6, 8 and 12).

We would rather publish a short, accurate list than a long, impressive one. A notice that names cookies we do not set misrepresents where your information goes just as surely as one that omits cookies we do.

2. Who this is written for

The Services are sold to organisations for business use. When you accept the Terms of Service or create an account, you represent that you are of legal age to contract, that you are using the Services for business or professional purposes and not for personal, family or household purposes, and that you have authority to bind the organisation you act for.

Where mandatory consumer protection or privacy law nonetheless applies to you, that law prevails over anything in this notice that would give you less. A term of ours that conflicts with a mandatory right is read down, not enforced.

What CyberWave is not:

• Sentinel supports readiness, governance, assessment, evidence organisation and control management. CyberWave does not certify compliance, issue audit opinions, guarantee compliance, or replace independent auditors, certification bodies or legal counsel. Framework references are informational readiness mappings.
• CyberWave is not an insurer or an insurance broker. We do not bind coverage and do not guarantee coverage, premium reduction, claim payment or insurer acceptance.
• We do not operate a security operations centre or provide 24/7 monitoring, and we do not provide managed detection and response, incident response retainers, penetration testing or forensics.
• AI features are assistive and optional. Outputs may contain errors, must be reviewed, and do not replace professional judgement.

3. What this notice covers — and why "cookies" is the wrong word for it

A cookie is a small file a site asks your browser to store and send back on later requests. But a notice that covered only cookies would be under-inclusive, because several things that behave the same way are not cookies. So this notice covers cookies and similar technologies, meaning all of:

Where this notice says "cookie" for readability, read it as covering everything in the table above.

4. The three categories

This notice uses exactly three categories. Only the first is in use.

The rule that matters more than the categories: no analytics technology and no advertising technology is loaded before consent is given for that category. Today none is loaded at all. If that changes, no provider will be registered, no script requested and no cookie written until you have made a choice that allows the category. A banner that appears after the tags have already fired is a notice that you were tracked, not a request for permission, and we do not intend to end up there.

5. The actual inventory

5.1 sentinel.cyberwave.ca — the Sentinel application

No analytics cookie. No advertising cookie. No tracking script.

5.2 cyberwave.ca — the marketing website

The marketing website is hosted by Vercel (section 10). CyberWave sets no analytics, advertising or tracking cookies on it and loads no analytics, advertising or tracking scripts on it. No non-essential cookie is set on the website, which is why it shows no cookie consent banner (section 8).

5.3 How lifetimes are shown

Where a cookie is written by a provider's service configuration rather than by CyberWave's own code, as the authentication cookies in section 5.1 are, its lifetime is set by that configuration, and this notice does not state a figure for it. We do not copy a figure from a vendor's documentation page that may not match our configuration.

localStorage entries and the offline page cache stay on your device until they are removed or replaced, and sessionStorage is cleared when the tab is closed. You can remove all of them at any time by clearing site data for the application in your browser.

6. Consent, and the four things it is not

6.1 The four things that are not the same thing

These are four different things, and conflating any two of them would be both a compliance defect and a dark pattern:

Accepting the Terms does not switch on analytics or advertising, and it does not add you to a mailing list. Nothing here bundles a permission you did not ask for into a step you had to complete.

6.2 If we ever ask for consent

We do not ask for cookie consent today, because there is nothing optional to ask about. If we ever introduce an analytics or advertising technology, the consent step will be in place before that technology loads, and it will follow these rules:

• Nothing optional is pre-ticked. Analytics and Advertising both start off. A box you never actively ticked is not consent.
• Refusing is exactly as easy as accepting. Refusing and accepting will be the same kind of control, with the same prominence, and the same single click.
• It fails closed. No stored decision means not granted for everything except strictly necessary technologies. A cleared browser, a private window, a blocked-storage setting, a malformed value, a decision recorded against an older version of this notice — every one of those is treated as "no", never as "assume yes".
• Granular, per purpose. You will be able to allow analytics and refuse advertising.
• If a purpose changes, we ask again. Adding a new purpose changes this notice's version, and an earlier "yes" is not treated as covering something it was never shown.

6.3 How to withdraw or change your choice

Consent you cannot withdraw is not consent. Because we ask for no optional consent today, there is no optional choice to withdraw. If we introduce an optional technology, you will be able to change your choice at any time. Your browser's own controls also let you block or delete cookies and site data for our sites entirely, at any time. See section 7 for what that affects.

What refusing costs you: nothing. Refusing or withdrawing analytics and advertising consent, if we ever ask for it, does not degrade the website, does not affect the Sentinel application, does not change your price, and does not affect your trial. A 14-day free trial is available for the plan you select, Essentials or Full Platform only, with no payment card required, no automatic charge and no automatic conversion to a paid plan; a cookie choice has no bearing on any of that, and there is no cookie-based billing or conversion mechanism to be affected. Continuing after a trial means choosing a paid subscription, and your data is not deleted because a trial ended.

Withdrawal applies from the moment you make it. It stops future use; it cannot un-collect something already collected, and we will not pretend otherwise. If you want information already held about you deleted, that is a separate and real right — the Privacy Policy, section 18, sets out how to exercise it.

7. Strictly necessary technologies, and what happens if you block them

We do not ask permission for strictly necessary technologies, and this is the reason: they are not a use of your information for a purpose of ours that sits alongside the service — they are part of the mechanism by which the service works. The authentication cookie is your session. Interface state and the offline page cache are part of how the application itself behaves.

You can still block them in your browser, and we will not attempt to work around it. If you do:

• On the application: if you block cookies, you will not be able to sign in, or you will be signed out on every request. There is no degraded mode, because there is no session. If you block or clear browser storage, the application may not keep interface state, and the offline page cache will not be available.
• On the website: CyberWave sets no non-essential cookie there, so there is no analytics or advertising cookie of ours for your browser settings to block.

8. Why there is no cookie banner, stated plainly

Neither the website nor the application shows a cookie consent banner or a "Cookie settings" link. That is not an oversight: no non-essential cookie is set, and no analytics, advertising or tracking script is loaded, so there is nothing optional to ask permission for. A banner asking you to accept tracking that does not happen would misdescribe our sites.

That position has two consequences we treat as decisions rather than as tasks:

1. Consent comes before the first tag, not after. If we ever introduce an analytics or advertising technology, the consent step described in section 6.2 will be in place before that technology loads. Retrofitting consent onto a site that already fires trackers leaves a period during which it fired them without consent — and that period does not go away once a banner is added.
2. This notice changes first. Adding a non-essential technology is a material change to this notice, published before the technology is deployed (section 12).

9. Global Privacy Control, and Do Not Track

9.1 Global Privacy Control (GPC)

Global Privacy Control is a signal your browser or a browser extension can send to say that you do not want your information sold or shared for advertising. It is a setting you turn on once, rather than a choice you have to make on every site.

Today there is nothing for it to switch off. We run no advertising technology at all, on the website or in the application.

If we ever introduce advertising technology, we will honour GPC as a refusal of the Advertising category. Where the signal is present, advertising will start denied and stay denied unless you deliberately turn it on yourself. It will not prevent you making a positive choice, because a signal should not become a lock that prevents you changing your mind.

9.2 Do Not Track

The older "Do Not Track" browser header was never given a settled meaning, and different sites read it differently. Rather than claim to honour a signal whose meaning we would be inventing, we have committed to honouring Global Privacy Control, which has one (section 9.1). If Do Not Track is later given a standard meaning we will say how we treat it.

10. Where cookie and request information is processed

Cookies, browser storage and the offline page cache themselves sit in your browser, on your device. The requests that carry cookies reach infrastructure that is not all in Canada, and we are not going to imply otherwise:

GoDaddy provides domain registration and DNS for our domains. It does not host the website or the application.

We do not say that everything stays in Canada, because it does not. CyberWave's database, authentication records and file storage are hosted in Canada (ca-central-1). Application hosting and compute, AI features, email delivery, payment processing and our support mailbox involve service providers that may process data outside Canada, including in the United States: AI requests are sent to Anthropic in the United States from CyberWave's servers, never from your browser; application and account emails are sent through Resend in the United States; payment processing for paid subscriptions is handled by Stripe and may take place outside Canada; and email you send to support@cyberwave.ca is handled through Microsoft 365, via GoDaddy, and may be processed outside Canada. While information is in another country it may be accessible to the courts, law enforcement and national security authorities of that country, and a contract cannot override a lawful order made there. The full picture, provider by provider, is in the Subprocessors document and the Privacy Policy, section 11.

11. How this list is maintained, and the law it answers to

11.1 Maintained from what actually runs

This notice is based on what the website and the application actually set and load — not on a template, and not on the dependency list in our source code. The distinction is the whole point: our codebase contains an analytics library and an error-tracking library, and neither is active in production. A notice built from the list of software packages would have named two providers that receive nothing from us. Naming a provider that receives nothing is as inaccurate as omitting one that does; both misrepresent where your information goes.

We review this inventory:

• whenever an analytics or advertising technology is added, changed or removed; and
• whenever the hosting or authentication provider changes.

11.2 The legal position, described accurately

Canada has no standalone cookie-consent statute. There is no Canadian equivalent of a rule that says "obtain consent before setting a non-essential cookie". What applies instead is general privacy law, and it gets to a similar place by a different route:

• PIPEDA requires knowledge and consent for the collection, use and disclosure of personal information, and consent is valid only if a person in our audience could reasonably be expected to understand the nature, purpose and consequences of it. Information about a browser, an IP address and browsing behaviour is read broadly as personal information; it is not exempt because it contains no name.
• PIPEDA also imposes an independent limit that consent cannot cure: a collection or use must be one a reasonable person would consider appropriate in the circumstances. A click on "Accept all" does not make an inappropriate purpose appropriate, so any new measurement purpose would be assessed on its merits before it was ever put behind a consent request.
• Consent must not be bundled as a condition of supplying a service beyond what the service actually requires, and it must be as easy to refuse as to give. That is why, if we ever introduce analytics or advertising, each will be independently refusable and refusing will cost nothing.
• Consent is withdrawable at any time, which is why section 6.3 exists.
• Quebec adds two requirements that bear directly on this notice. An enterprise that collects personal information through technological means must publish a confidentiality policy in clear and simple language and disclose the use of those technologies. And where a technology has functions allowing a person to be identified, located or profiled, the enterprise must inform the person of the use of the technology and of the means available to activate those functions — the Commission d'accès à l'information's position being that such functions may not be on by default. Quebec's privacy-by-default rule expressly does not apply to browser cookie settings, so it does not do the work people often assume; the s. 8.1 duty does.

We apply a stricter standard than the Canadian baseline requires, deliberately. Today we load nothing non-essential at all. If that changes, we will load nothing non-essential before consent, per category, with refusal as easy as acceptance, which is closer to a European standard than to a Canadian one. We hold to it because the cheapest moment to get this right is before the first tag exists, and because a company selling cybersecurity readiness should not be running the sloppier of two available configurations on its own website.

12. Changes to this notice

• Versioning. Every version carries an opaque, stable version string — this one is COOKIES_2026_09_V1. It is never reformatted and never reused.
• Non-material changes — clarifications and corrections — are published with a new version string and an updated effective date.
• Adding, changing or removing a cookie or a similar technology is a material change. It is published here before the technology is deployed, not after. Where the change introduces a new purpose, consent is asked for, not assumed from an earlier decision.

Questions about this notice, or about a cookie you have found that is not listed here. Contact CyberWave's privacy contact at support@cyberwave.ca (subject: Privacy). If you find something on one of our sites that this notice does not name, we want to know.

CyberWave Cookie Notice, version COOKIES_2026_09_V1. © 2026 CyberWave.