Version 1.3 · Last updated 8 October 2026
Controller: NUADU Holding Pte. Ltd., UEN 201905864N, Singapore | Contact: privacy@nuadu.com
This policy explains which cookies and browser storage nuadu.com uses. It supplements the Privacy Policy.
1. Legal Framework
Under ePrivacy Directive Art. 5(3) and the national laws implementing it (in Poland, the Electronic Communications Law), NUADU (a) informs you before any non-essential cookie or storage is used, (b) obtains active consent for non-essential storage, (c) lets you choose per category, and (d) lets you withdraw at any time. Strictly necessary storage is exempt from consent but is disclosed below.
Last audit: 2026-10-02, in a live browser session against the current build. NUADU repeats the audit at every release that adds a third-party script.
2. What nuadu.com Uses
Audit method: a fresh browser session on the site, before and after giving analytics consent, on the home page, a demo page and the pronunciation demo (2026-10-02).
Before you make a choice: nuadu.com sets no cookies and writes nothing to localStorage. The only third-party script loaded is Cloudflare Turnstile, which set no cookie during the audit.
2.1 Strictly Necessary (no consent required)
| Item | Type | Provider | Purpose | Duration |
|---|---|---|---|---|
nuadu_analytics_consent | localStorage | NUADU | Stores your analytics choice (usage analytics and session replay, each accepted or declined, with a timestamp) | Until you clear it or change it in "Analytics preferences" |
nuadu_v4_theme | localStorage | NUADU | Remembers light or dark theme, only if you switch it | Until cleared |
demo_registered | sessionStorage | NUADU | Written when you unlock the live demos, so the email gate is not shown again in this browser session; contains no email address | Until the browser session ends |
| Cloudflare Turnstile | script | Cloudflare | Bot verification on the contact form, the demo gate and every AI demo request. May set cf_clearance / __cf_bm when a challenge is issued; none was set during the audit | Up to 30 minutes |
| Microsoft Speech SDK | script | Microsoft | Loaded on the speaking and pronunciation demos only, to stream audio to Azure AI Speech; sets no cookie | — |
Turnstile processes browser signals (IP address, browser characteristics, interaction patterns) to tell humans from bots. NUADU classifies it as strictly necessary because the forms cannot be offered safely without it. Cloudflare acts as processor under its DPA.
2.2 Analytics (consent required)
Loaded only after you choose "Accept all" or save a choice with analytics on. When Google Tag Manager is in use, the tags are delivered through it; the container itself sets no cookie and fires analytics tags only.
| Item | Type | Provider | Purpose | Duration |
|---|---|---|---|---|
AMP_<project> | cookie | Amplitude, Inc. (EU data centre) | Pseudonymous device identifier and session for usage analytics | 12 months |
AMP_MKTG_<project> | cookie | Amplitude | Attribution: referrer and campaign parameters of the visit | 12 months |
EXP_<project>_identity, EXP_<project> | cookie + localStorage | Amplitude Experiment | Identifier for feature-variant assignment | 12 months |
AMP_unsent_<project>, AMP_remote_config_<project>, AMP_SR_START_<project>_* | localStorage | Amplitude | Event queue, SDK configuration, session-replay session marker | Until cleared |
Session replay is a separate choice in the banner. With it on, Amplitude records how you move through the page; text typed into forms is masked. Scripts come from cdn.eu.amplitude.com and cdn.amplitude.com; event data is sent to Amplitude's EU data centre.
Lawful basis: consent (Art. 6(1)(a) GDPR), given per option.
2.3 Marketing (not used)
nuadu.com uses no advertising cookies, pixels or tags. Google Tag Manager is configured to fire analytics tags only. This section will be updated, and consent requested again, if that changes.
3. Third-Party Scripts
| Service | Provider | Category | Loaded |
|---|---|---|---|
| Cloudflare Turnstile | Cloudflare, Inc. | Strictly necessary | Every page |
| Microsoft Speech SDK | Microsoft | Strictly necessary | Speaking and pronunciation demos |
| Google Tag Manager (when in use) | Analytics (container) | After consent | |
| Amplitude Analytics, Amplitude Session Replay, Amplitude Experiment | Amplitude, Inc. (EU) | Analytics | After consent |
Constructor, UserWay and Crisp are used by the NUADU assessment platform for Institutional Clients (see nuadu.com/trust). They are not loaded on nuadu.com.
4. Managing Your Choices
- Analytics preferences: the first visit shows a banner with two separate options — usage analytics, and session replay — and the buttons Reject all · Save choices · Accept all. You can change or withdraw your choice at any time via "Analytics preferences" in the site footer. Withdrawing stops new collection; delete the
AMP_*andEXP_*cookies in your browser to remove the identifier. - Demo gate memory: the
demo_registeredflag is deleted automatically when you close the browser session. To delete your demo registration itself, write to privacy@nuadu.com. - Browser settings: you can block or delete cookies and site data in your browser. Blocking Cloudflare's verification cookie prevents the forms from submitting.
5. Updates
NUADU updates this policy when the storage or the scripts change. A new category or a new provider is shown in an updated banner that asks for consent again.