Cookie Policy

Last updated: 15 May 2026

This Cookie Policy explains how Super Nova Research Inc. (“Super Nova,” “Draft&Goal,” “we,” “us,” or “our”) uses cookies and similar technologies on the two websites it operates:

• https://dng.ai — our marketing website (the “Marketing Site”).
• https://studio.dng.ai — our authenticated product environment used to access the Draft&Goal platform (the “Studio”). The Studio is operated as a strictly privacy-preserving environment subject to the EU/UK General Data Protection Regulation (GDPR/UK GDPR), Quebec Law 25, and our information-security and AI-management commitments (ISO/IEC 27001 and ISO/IEC 42001).

The two websites have different cookie practices, and this policy describes both. Where a section applies to only one of the websites, this is stated explicitly. Where the information collected via cookies constitutes personal information, this policy should be read together with our Privacy Policy at https://dng.ai/privacy-policy/ and the Subprocessor List at https://trustcenter.dng.ai. In case of conflict between this Cookie Policy and the Privacy Policy on cookie-specific matters, this Cookie Policy controls.

This policy is aligned with:

• GDPR / UK GDPR and Article 5(3) of the ePrivacy Directive;
• Quebec Law 25 (Act respecting the protection of personal information in the private sector, as modernized);
• Canadian PIPEDA and CCPA / CPRA and other applicable U.S. state privacy laws;
• ISO/IEC 27001:2022 — information security management (controls applied to cookie-related data flows, storage, and transfers);
• ISO/IEC 42001:2023 — AI management system (transparency, accountability, and data-governance controls applicable to AI-supported features).

1. Quick comparison — dng.ai vs. studio.dng.ai

2. What are cookies?

Cookies are small data files stored on your device when you visit a website. They are widely used to make websites function, improve performance, and provide reporting and personalization. Similar technologies — such as web beacons, pixels, tags, software development kits, and local and session storage — are used for the same purposes and are covered by this policy. References to “cookies” below include these similar technologies.

Cookies set by Super Nova on a domain we operate are called first-party cookies. Cookies set by third parties through our websites (for example, analytics or advertising vendors) are third-party cookies.

3. Why we use cookies

3.1 dng.ai (Marketing Site)

On the Marketing Site we use first- and third-party cookies for:

• Strictly necessary purposes — bot protection, load balancing, security, language selection, consent management, and basic page rendering.
• Performance and functionality — remembering preferences, supporting forms, and maintaining live-chat continuity (set only with your consent where required).
• Analytics and product improvement — understanding how the Marketing Site is used and measuring marketing effectiveness (set only with your consent).
• Advertising and marketing measurement — delivering, capping, and measuring advertising on third-party platforms (set only with your consent).

3.2 studio.dng.ai (Studio)

On the Studio we use cookies only for:

• Strictly necessary purposes — session authentication, security (including CSRF and bot protection), and the technical delivery of the application.
• Privacy-preserving, cookieless analytics — a Google Analytics deployment configured without persistent cross-site identifiers, IP address truncation/anonymisation, advertising features disabled, no Google Signals, and no joining with other Google services. This configuration meets the criteria for consent exemption under the CNIL’s guidance on audience-measurement tools (Deliberation no. 2020-091 and subsequent recommendations) and is consistent with EDPB guidance on first-party, strictly internal statistical measurement.

We do not use advertising, retargeting, marketing measurement, social-media, profiling, or cross-context behavioral advertising cookies on the Studio. We do not share Studio analytics data with advertising platforms.

4. Legal basis for processing

4.1 GDPR / UK GDPR (both websites)

• Strictly necessary cookies are exempt from the consent requirement under Article 5(3) of the ePrivacy Directive because they are technically required to deliver a service explicitly requested by the user. To the extent that personal data is processed through these cookies, we rely on Article 6(1)(f) GDPR (legitimate interests in operating a secure and functional website), having balanced our interests against the rights and freedoms of users.
• Cookieless analytics on the Studio are deployed under the CNIL audience-measurement exemption, on the basis that they (i) are strictly limited to producing anonymised statistics for our own use, (ii) do not allow individuals to be identified or re-identified, and (iii) are not shared with third parties for any other purpose.
• All other cookies on the Marketing Site (functional, analytics, advertising) are set only on the basis of your freely given, specific, informed, and unambiguous consent, obtained through our cookie consent banner before any such cookie is set or accessed on your device (Article 6(1)(a) GDPR and Article 5(3) of the ePrivacy Directive). You may withdraw consent at any time as described in Section 6.1. Withdrawal does not affect the lawfulness of processing that occurred before withdrawal.

4.2 Quebec Law 25

Where Quebec Law 25 applies, we collect personal information through cookies only with your express, granular consent for any technology that identifies, locates, or profiles you. Such technologies are disabled by default and activated only after you provide consent through our Cookie Consent Manager. You may withdraw consent with the same ease with which you provided it. On the Studio, we operate the cookieless analytics configuration described above, which is designed not to identify, locate, or profile individuals.

4.3 United States state privacy laws

We treat Global Privacy Control (GPC) signals as a valid opt-out of the “sale” or “sharing” of personal information for cross-context behavioral advertising purposes for the browser and device on which the signal is enabled. The Studio does not engage in cross-context behavioral advertising.

4.4 Canada (PIPEDA)

Outside Quebec, we apply PIPEDA’s consent and limiting-collection principles. The cookies described in this policy are limited to what is necessary for the purposes identified.

5. Cookies we use

We re-scan both websites using an automated cookie-scanning tool at least quarterly, and whenever we materially change the cookies in use. We update this policy within a reasonable period, typically thirty (30) days, of detecting any change. If you notice a discrepancy between the cookies listed here and the cookies observed on your device, please contact us at [email protected]. The last verified scan was performed on 15 May 2026.

5.1 dng.ai — Strictly necessary cookies

These cookies are required for the Marketing Site to function and cannot be rejected through the Cookie Consent Manager. They do not store personally identifiable information beyond what is needed for security and basic operation.

Note on reCAPTCHA: reCAPTCHA transmits interaction signals to Google for security purposes. We classify it as strictly necessary because it protects forms and authentication endpoints from automated abuse; under our contractual terms with Google, these signals may not be used for advertising. See https://policies.google.com/privacy.

5.2 dng.ai — Performance and functionality cookies

Set only with your consent.

5.3 dng.ai — Analytics and customisation cookies

Set only with your consent.

Microsoft Clarity (the cookies prefixed with _clck, _clsk, CLID, SM, MR, c.gif) records anonymised session replays (mouse movement, clicks, scroll depth) and aggregate heatmaps. Form fields and other potentially sensitive inputs are masked by default. Set only with your consent.

5.4 dng.ai — Advertising cookies

Set only with your consent. Used to make advertising more relevant, prevent the same ad from repeatedly appearing, and measure ad effectiveness.

Note on Google Tag Manager (GTM-5ZH85HL): GTM itself does not set tracking cookies. Cookies fired through GTM are listed in the tables above and are gated by Google Consent Mode v2 in advanced mode, integrated with our CookieYes consent banner. Prior to consent, GA4 and Google Ads tags transmit cookieless, aggregated “modeled” pings only — no advertising or analytics cookies are written and no client identifier is stored on your device until you grant consent.

5.5 studio.dng.ai — Strictly necessary cookies

The Studio sets only strictly necessary cookies. These cannot be rejected because they are required to deliver the application you have requested.

5.6 studio.dng.ai — Cookieless analytics (consent-exempt)

The Studio uses Google Analytics in a cookieless, privacy-preserving configuration, deployed to comply with the GDPR and Quebec Law 25 without requiring prior consent. Specifically:

• No persistent cross-site identifiers are written to your device — no _ga, no _ga_<container_id>, no _gid cookies are set in this configuration.
• IP addresses are anonymised / truncated before any storage or transfer, and no full IP is retained.
• Google advertising features and Google Signals are disabled. Studio analytics data is not used to personalise advertising and is not joined with any other Google service.
• Data is used solely for aggregated, internal audience measurement of the Studio’s usage by Super Nova. It is not shared with third parties for any other purpose.
• A Google Consent Mode v2 default state of “denied” is set at page load for ad_storage, analytics_storage, ad_user_data, and ad_personalization, ensuring that any inadvertently loaded tag would transmit only cookieless modeled pings.
• The configuration follows the criteria of the CNIL guidance on audience-measurement exemption (Deliberation no. 2020-091) and EDPB recommendations on first-party analytics.

If you nevertheless prefer not to be counted in Studio analytics, you may install the Google Analytics opt-out browser add-on at https://tools.google.com/dlpage/gaoptout or block analytics scripts using your browser settings or an extension. Doing so will not affect access to the Studio.

The Studio does not deploy HubSpot tracking, Meta Pixel, LinkedIn Insight, Microsoft Clarity, Bing UET, or any other advertising / cross-context-behavioral-advertising technology. These tags are excluded from firing on the Studio at the tag-management layer.

6. How to control cookies

6.1 Cookie Consent Manager (dng.ai)

When you first visit the Marketing Site, a cookie consent banner appears. No non-essential cookies are set or accessed on your device before you have made a choice. The banner presents options to accept all cookies, reject all non-essential cookies, or customise your preferences by category, with accept and reject options presented with equal visual prominence.

You can review or change your cookie preferences at any time by clicking the “Cookie Settings” link in the footer of every page, or by accessing the Cookie Consent Manager directly at https://dng.ai/#cky-settings.

Strictly necessary cookies cannot be rejected because they are required to operate the Marketing Site. Rejecting or withdrawing consent for non-essential cookies will not affect your ability to access the core content of the Marketing Site.

Your consent choices are stored for a maximum of twelve (12) months, after which we will ask for your consent again.

When you withdraw consent through the Cookie Consent Manager, CookieYes blocks future reads and writes of the relevant cookies and clears non-essential cookies already stored on the current domain. Cookies set on third-party domains may remain on your device until they expire; you can delete them through your browser settings (see Section 6.3).

6.2 Studio (studio.dng.ai)

The Studio’s strictly necessary cookies cannot be rejected because they are required to deliver the authenticated service you have requested. The Studio’s analytics configuration is designed to be consent-exempt and does not place persistent tracking cookies, and the Studio sets a Google Consent Mode v2 default state of “denied” at page load as a defence-in-depth measure. Should we introduce any optional, consent-based technology in the Studio in the future (for example, an in-product survey tool), we will surface a separate, granular consent prompt at the point of activation and update this policy.

6.3 Browser controls

Most browsers allow you to refuse or delete cookies through their settings:

• Google Chrome: https://support.google.com/chrome/answer/95647
• Mozilla Firefox: https://support.mozilla.org/kb/cookies-information-websites-store-on-your-computer
• Apple Safari: https://support.apple.com/guide/safari/manage-cookies-sfri11471/mac
• Microsoft Edge: https://support.microsoft.com/microsoft-edge/delete-cookies-in-microsoft-edge-63947406-40ac-c3b8-57b9-2a946a29ae09
• Opera: https://help.opera.com/latest/web-preferences/#cookies

Refusing strictly necessary cookies through your browser may affect website or Studio functionality.

6.4 Global Privacy Control and Do Not Track

We honour Global Privacy Control (GPC) signals where required by applicable law. When we detect a GPC signal on the Marketing Site, we treat it as an opt-out of the sale or sharing of personal information for cross-context behavioral advertising for that browser and device. The Studio does not engage in cross-context behavioral advertising, so GPC is informational only there. We do not currently respond to legacy Do Not Track (DNT) signals because there is no industry-standard implementation.

6.5 Industry opt-out tools (Marketing Site only)

You can opt out of interest-based advertising from many participating networks via:

• Digital Advertising Alliance: https://optout.aboutads.info
• Digital Advertising Alliance of Canada: https://youradchoices.ca
• European Interactive Digital Advertising Alliance: https://www.youronlinechoices.eu
• Network Advertising Initiative: https://optout.networkadvertising.org

7. Your rights

The rights below apply to personal information collected through cookies on either website. To exercise any of these rights, contact our Privacy Officer (see Section 13).

7.1 Quebec residents (Law 25)

• Right of access to personal information we hold about you.
• Right of rectification of inaccurate, incomplete, or ambiguous information.
• Right to withdraw consent and to request that we cease disseminating, de-index, or re-index personal information.
• Right to data portability of computerised personal information you provided.
• Right to be informed of any decision based exclusively on automated processing and to submit observations.

If you are dissatisfied with our response, you may file a complaint with the Commission d’accès à l’information du Québec at https://www.cai.gouv.qc.ca.

7.2 EEA, UK, and Switzerland residents (GDPR / UK GDPR / FADP)

• Right of access, rectification, erasure, restriction, and portability.
• Right to object to processing based on legitimate interests.
• Right to withdraw consent at any time without affecting the lawfulness of prior processing.
• Right to lodge a complaint with your local supervisory authority.

7.3 California, Colorado, Connecticut, Virginia, and other U.S. state residents

You may have the right, under your state’s comprehensive privacy law (including the laws of California (CCPA/CPRA), Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, Delaware, Iowa, Tennessee, New Hampshire, New Jersey, Minnesota, Maryland, and other states with similar laws in effect), to know what categories of personal information we collect and share, to access and delete that information, to correct inaccuracies, to opt out of the “sale” or “sharing” of personal information for cross-context behavioral advertising, and to limit the use of sensitive personal information. We do not knowingly sell personal information. On the Marketing Site we may “share” certain identifiers and online activity with advertising and analytics providers, which may constitute “sharing” under the CPRA. You can opt out by:

• Using the “Do Not Sell or Share My Personal Information” link in the footer of the Marketing Site, or
• Sending a Global Privacy Control signal from your browser.

The Studio does not “sell” or “share” personal information for cross-context behavioral advertising.

7.4 Other Canadian residents (PIPEDA)

You have the right to access and correct your personal information, and to file a complaint with the Office of the Privacy Commissioner of Canada at https://www.priv.gc.ca.

8. International data transfers

Cookies on the Marketing Site and the Studio are served by providers located in or processing data in jurisdictions including the United States, the European Union, and Canada. When we transfer personal information outside Quebec, the EEA, the UK, or your jurisdiction of residence, we rely on appropriate safeguards:

• the EU-US Data Privacy Framework, the UK Extension, and the Swiss-US Framework where the recipient is certified, pursuant to the European Commission’s adequacy decision of 10 July 2023;
• Standard Contractual Clauses (Commission Decision 2021/914) and the UK International Data Transfer Addendum where DPF certification does not apply or has been suspended;
• documented transfer impact assessments and supplementary contractual, organisational, and technical measures, including encryption in transit and at rest.

A list of our principal cookie-related sub-processors and their respective transfer mechanisms is available at https://trustcenter.dng.ai.

9. ISO 27001 and ISO 42001 alignment

9.1 ISO/IEC 27001 — Information security

The personal data collected through cookies is processed within our information-security management system, which is aligned with ISO/IEC 27001:2022. Controls applied to cookie-related data include:

• Encryption in transit (TLS) for all cookie payloads;
• Restricted role-based access to backend analytics, CRM, and advertising data;
• Logging and monitoring of administrative access to cookie-derived data;
• Documented vendor due-diligence and contractual data-protection terms with each cookie provider listed in Section 5;
• Defined retention limits (set out in Section 5 and in the Privacy Policy) and routine deletion of expired data.

9.2 ISO/IEC 42001 — AI management

The Studio is operated within our AI management system aligned with ISO/IEC 42001:2023. In that context:

• We do not use cookie-derived data to train AI models offered through the Studio or Draft&Goal platform.
• Studio analytics are limited to aggregated, anonymised audience measurement and are governed by the same transparency, accountability, and human-oversight controls that apply to other Studio data flows.
• Material changes to AI-related data flows that may affect cookie-derived data will be reflected in this policy and surfaced in the Studio’s transparency notices.

10. Other tracking technologies

Cookies are not the only way we recognise visitors. We may also use:

• Web beacons and pixel tags — tiny graphics with a unique identifier that allow us to monitor traffic patterns and email open rates (Marketing Site only).
• Local and session storage — browser storage mechanisms used for similar purposes to cookies (both websites; on the Studio limited to session/auth state).
• Server-side identifiers — first-party identifiers passed via API rather than browser cookies, where strictly necessary for the service.

These technologies are subject to the same consent and choice mechanisms as cookies, applied on a per-domain basis as described above.

11. Children’s privacy

Neither website is directed at children. We do not knowingly collect personal information from children through cookies or similar technologies. The applicable age thresholds are:

• European Economic Area — Where we rely on consent under Article 8 GDPR for information-society services offered directly to a child, we do not rely on that consent for children under 16. Where a Member State sets a lower minimum age (but no lower than 13), we apply that lower threshold for users in that Member State. Where we become aware that a user is below the applicable threshold, we delete any personal information collected and disable non-essential cookies for that user.
• Quebec — Under Article 4.1 of the Civil Code of Québec and Law 25, we do not knowingly collect personal information from children under 14 without the consent of a person having parental authority. Where we become aware that a user is below 14, we delete any personal information collected and disable non-essential cookies for that user.
• United States — We do not knowingly collect personal information from children under 13, in accordance with COPPA.
• Other jurisdictions — We apply whichever age threshold is higher: 13 or the local legal minimum.

If you believe a child below the applicable age threshold has provided personal information to us, please contact us immediately at [email protected].

12. Updates to this Cookie Policy

We may update this Cookie Policy from time to time to reflect changes to the cookies we use or for operational, legal, or regulatory reasons. The “Last updated” date at the top indicates when it was last revised. Material changes will be notified through a prominent notice on the Marketing Site, through the Cookie Consent Manager, or via in-Studio notification.

13. Contact us

Questions, requests, or complaints regarding this Cookie Policy or our use of cookies can be directed to our Privacy Officer:

Vincent Terrasi Data Protection Officer (GDPR Art. 37), Privacy Officer (Quebec Law 25), and Person in Charge of the Protection of Personal Information Super Nova Research Inc. Email: [email protected] Postal address: 6795 rue Marconi, Bureau 200, Montréal (Québec) H2S 3J9, Canada

EU and EEA residents — In accordance with Article 27 GDPR, we have appointed an EU Representative:

Super Nova Research Inc. — EU Representative Station F, 5 Parvis Alan Turing, 75013 Paris, France Email: [email protected]

You also have the right to lodge a complaint with the supervisory authority in your country of residence or place of work. A directory of EU supervisory authorities is available at https://edpb.europa.eu/about-edpb/about-edpb/members_en.

• UK residents — Information Commissioner’s Office: https://ico.org.uk/make-a-complaint
• Quebec residents — Commission d’accès à l’information du Québec: https://www.cai.gouv.qc.ca
• Other Canadian residents — Office of the Privacy Commissioner of Canada: https://www.priv.gc.ca