Cookie Policy
Last updated: 6 September 2026
1.Short summary
NuovaCRM uses two cookies, and both are strictly necessary for the service to work. Advertising cookies, tracking pixels, third-party analytics cookies and social media cookies are not used.
This is why we do not display a cookie consent window: consent is required for cookies that are not strictly necessary. If a cookie that is not strictly necessary is added, this page and the consent flow will change before it does.
2.Cookies used
| Name | Purpose | Duration | Type |
|---|---|---|---|
nuova_session | Keeps the session open. Without this cookie you would have to sign in again on every page. | 14 days | Strictly necessary |
nuova_locale | To know the interface language (tr / en / it) at the first paint. The value is written from the preference on your account. | 1 year | Strictly necessary |
3.Technical properties
nuova_session is HttpOnly: no script running in the browser can read it. This is what prevents a script injected into the page from stealing your session.
nuova_locale is not HttpOnly, because the language switcher needs to be able to update it. It contains nothing but a language code; were it captured, the worst outcome is that the interface opens in another language.
Both are marked SameSite=Lax and, in production, Secure; they are sent over HTTPS only.
The session cookie is not written to the parent domain. That is, the klinika.nuovacrm.com cookie is never sent to another organisation's address. This is a deliberate choice: sending a single cookie to the addresses of all organisations would mean that a vulnerability at one organisation could bring down the session of another.
4.Local storage that is not a cookie
Your interface preferences (table column widths, sorting, density) are held in your browser's local storage under the key nuova.prefs. This is not a cookie — it is never sent to the server. The authoritative source is the record on your account; the local copy only speeds up loading. When you clear your browser data, your preferences come back from your account.
5.Third-party cookies
We do not place third-party scripts on NuovaCRM pages; therefore no third-party cookie is created on our domain.
When an organisation connects its Google or Meta account, you are redirected to a consent screen. That screen opens on Google's or Meta's own domain and uses their own cookies in accordance with their own policies; we have no access to those cookies.
6.Refusing cookies
Every browser allows cookies to be blocked. However, if nuova_session is blocked, signing in is not possible — it is the only thing that carries the session. So refusing this cookie means not using the service. This is not a restriction, but a technical requirement of signing in.
To end a session, Sign out is enough: the cookie is deleted and the session record on the server is invalidated as well.
7.Related pages
Which data is processed is written in the Privacy Policy, and how rights are exercised in the KVKK (Turkish Personal Data Protection Law No. 6698) and GDPR Privacy Notice.