diff --git a/clavitor.ai/templates/cookies.tmpl b/clavitor.ai/templates/cookies.tmpl
new file mode 100644
index 0000000..0db8a02
--- /dev/null
+++ b/clavitor.ai/templates/cookies.tmpl
@@ -0,0 +1,67 @@
+{{define "cookies"}}
+
+
No banner. Here's why.
+
EU law (ePrivacy Directive Art. 5(3) and GDPR) requires consent before storing or accessing information on a user's device unless that information is "strictly necessary for the provision of a service explicitly requested by the user." Session cookies, authentication cookies, and CSRF security cookies are explicitly named in the exemption.
+
Clavitor uses exactly two cookies. Both are strictly necessary. Both are exempt from the consent requirement. There is nothing to consent to, so we do not show a banner asking for consent — that would be misleading.
+
+
The two cookies
+
+
+
+ | Name | Lifetime | Purpose | Flags |
|---|
+
+
+
+ clv_onb |
+ 1 hour |
+ Carries your in-progress signup state across the three onboarding pages (signup → profile → plan). Without this cookie, the form on page 2 would have no idea who page 1 was. The value is HMAC-signed so it cannot be forged or modified by anyone but us. |
+ HttpOnly
Secure
SameSite=Lax |
+
+
+ clv_oauth_state_* |
+ 10 minutes |
+ One per provider (Google, Apple, Meta) when you click a social sign-in button. Holds a random CSRF nonce that the OAuth callback verifies before exchanging the code — the standard defence against CSRF attacks on OAuth flows. Deleted the moment the callback completes. |
+ HttpOnly
Secure
SameSite=Lax |
+
+
+
+
+
Why these are strictly necessary
+
clv_onb is required to provide the signup feature you explicitly requested by clicking "Get started". Without it, the multi-step form cannot remember which account you're creating. There is no functional alternative.
+
clv_oauth_state_* is a security cookie required to safely complete a social sign-in. Without it, your OAuth callback could be hijacked by a CSRF attack. The exemption explicitly covers "user-input cookies" and security cookies of this kind (see WP29 Opinion 04/2012, EDPB Guidelines 03/2022).
+
+
What we do NOT use
+
+
+ - Analytics: No Google Analytics, Plausible, Fathom, or self-hosted analytics. Zero.
+ - Marketing pixels: No Meta Pixel, no LinkedIn Insight, no retargeting.
+ - Third-party scripts: No CDN-hosted libraries. No Google Fonts (we self-host the woff2 files).
+ - Local storage / IndexedDB / sessionStorage: none. EU law treats these the same as cookies, and we use none of them.
+ - Fingerprinting: none.
+ - "Remember me" cookies: none. Future authentication will use WebAuthn passkeys, which your browser stores separately from cookies.
+
+
+
+
How to control them
+
Both cookies are deleted automatically — clv_oauth_state_* after the OAuth callback, clv_onb after one hour or when you finish signup. You can delete them manually any time through your browser's cookie settings:
+
+ - Chrome / Edge / Brave: Settings → Privacy and security → Cookies and other site data
+ - Firefox: Settings → Privacy & Security → Cookies and Site Data
+ - Safari: Preferences → Privacy → Cookies and website data
+
+
Note: Blocking clv_onb mid-signup will reset you to step 1. Blocking clv_oauth_state_* will prevent social sign-in from completing.
+
+
Changes to this policy
+
If we ever add a third cookie, we will update this page and the privacy policy. We will not add tracking or analytics cookies, ever — that's a brand commitment, not just a legal one.
+
+
Last updated: April 2026
+
+{{end}}
diff --git a/clavitor.ai/templates/dpa.tmpl b/clavitor.ai/templates/dpa.tmpl
new file mode 100644
index 0000000..93d3d6b
--- /dev/null
+++ b/clavitor.ai/templates/dpa.tmpl
@@ -0,0 +1,104 @@
+{{define "dpa"}}
+
+
1. Definitions
+
"Controller" means the natural person who creates and owns the data within their Clavitor vault. You are always the Controller of your own credentials and personal data.
+
"Processor" means Clavitor.ai, the entity that provides hosting infrastructure, encryption orchestration, and data storage services on behalf of the Controller.
+
"Data Subject" means the natural person whose personal data is processed — this may be you (the Controller) or others whose data you store in your vault (family members, employees, clients).
+
"Personal Data" means any information relating to an identified or identifiable natural person stored in your vault, including but not limited to: credentials, passwords, API keys, payment card data, identity documents, and contact information.
+
"Processing" means any operation performed on Personal Data, including collection, storage, encryption, transmission, backup, and deletion.
+
+
2. Processing Details
+
+
+
+ | Subject matter |
+ Encrypted credential vault hosting and related services |
+
+
+ | Duration |
+ For the term of your subscription, plus 30 days for compliance backups (not restorable) |
+
+
+ | Nature and purpose |
+ Storage of encrypted data; authentication orchestration; backup and disaster recovery; technical support (with zero-knowledge limitations) |
+
+
+ | Type of Personal Data |
+ User credentials, authentication tokens, payment card data, identity documents, secure notes, TOTP seeds, metadata |
+
+
+ | Categories of Data Subjects |
+ Controller (account holder) and third parties whose data Controller chooses to store |
+
+
+
+
+
3. Obligations of the Processor
+
3.1 Process only on documented instructions. Clavitor processes Personal Data only to provide the hosted vault service as described in our Terms of Service. We do not use data for our own purposes, train AI models, derive insights, or monetize beyond subscription fees.
+
3.2 Ensure confidentiality. All Clavitor personnel with potential access to infrastructure are bound by confidentiality agreements. Access is granted on principle of least privilege and logged.
+
3.3 Implement security measures. We implement:
+
+ - End-to-end encryption: Data encrypted at rest and in transit
+ - Tiered encryption (L2/L3): Identity fields encrypted with WebAuthn PRF — not decryptable by us
+ - Zero-knowledge architecture: We cannot decrypt vault contents; only metadata (entry IDs, types, timestamps) is readable
+ - WebAuthn/passkey authentication: No passwords stored server-side
+ - Geographic distribution: 21 POPs with encrypted replication
+ - Incident response: 24/7 monitoring, automated alerts, documented breach procedures
+
+
3.4 Subprocessor transparency. We use only the subprocessors listed in our Subprocessor List. We notify subscribers 30 days before adding any new subprocessor.
+
3.5 Assist with Data Subject rights. Upon your request, we will assist you in responding to requests from Data Subjects exercising rights under GDPR/FADP (access, rectification, erasure, portability, restriction, objection). Note: Due to encryption architecture, we cannot access or modify encrypted vault contents; assistance is limited to account-level operations.
+
3.6 Assist with security obligations. We provide security documentation, penetration test summaries (NDA required for details), and audit logs on request.
+
3.7 Delete or return data. Upon subscription termination, we delete all active data immediately per our Cancellation Policy. Compliance backups are retained for 30 days only and then destroyed. Data cannot be returned in decrypted form (we don't have keys).
+
3.8 Audit and inspection. Upon 30 days written notice, you may audit our compliance with this DPA. Audits are conducted at our Zürich headquarters or virtually. We provide relevant documentation; direct infrastructure access requires security clearance. Self-hosted Community Edition users perform their own audits.
+
3.9 Notify of breaches. We notify you within 24 hours of discovering any breach affecting your Personal Data. We will never delay notification for investigation or legal review.
+
3.10 Document processing activities. We maintain records of processing activities and make summaries available upon request.
+
+
4. Obligations of the Controller
+
You warrant that:
+
+ - You have lawful basis to process Personal Data in your vault
+ - You have provided appropriate privacy notices to Data Subjects whose data you store
+ - You will not store data in violation of applicable laws (e.g., child pornography, terrorism-related data)
+ - You will promptly notify us of any Data Subject requests or regulatory inquiries
+
+
+
5. Data Location and Transfer
+
Your vault data is stored encrypted at the Point of Presence (POP) geographically nearest to your access pattern. Primary and backup POPs are in different regions for resilience. The complete list of 21 POPs with cities, providers, and compliance certifications is maintained in our POP database.
+
Infrastructure providers used for POPs include: Amazon Web Services (primary provider for most regions), ISHosting (Istanbul, Almaty), HostAfrica (Lagos, Nairobi), and Hostkey (Zürich POP). Zürich HQ operations (billing, administrative) also use Hostkey.
+
All POPs are either:
+
+ - In jurisdictions with adequacy decisions (EU, EEA, Switzerland, UK, Canada, etc.)
+ - Bound by Standard Contractual Clauses (SCCs) where no adequacy decision exists
+
+
Due to our encryption architecture (zero-knowledge), even data stored in non-adequate jurisdictions is technically protected. We cannot decrypt it; neither can local authorities. DNS resolution is handled by Cloudflare; no vault data ever passes through their network.
+
+
6. Encryption and Technical Measures
+
Our architecture is designed so that we cannot access your sensitive data even if compelled:
+
+ - L1 (Metadata): Entry IDs, titles (if unmarked), types, timestamps — visible to us for service operation
+ - L2 (Standard fields): Passwords, usernames, API keys — encrypted with server-held keys, decryptable only with your active session
+ - L3 (Identity fields): Credit cards, CVV, passport numbers, SSNs — encrypted with WebAuthn PRF, a key derived from your biometric/device that never leaves your possession. We mathematically cannot decrypt these.
+
+
+
7. Contact
+
For DPA-related inquiries:
+
Data Protection Officer (DPO)
+ Clavitor.ai
+ c/o Johan Jongsma
+ privacy@clavitor.ai
+
Zürich, Switzerland
+
+
8. Effective Date and Changes
+
This DPA is effective as of your subscription start date and remains in effect until termination. Changes are notified 30 days in advance. Continued use constitutes acceptance.
+
+
Last updated: April 2026 | Version 1.0
+
+{{end}}
diff --git a/clavitor.ai/templates/footer.tmpl b/clavitor.ai/templates/footer.tmpl
index 8a332c2..5a3055d 100644
--- a/clavitor.ai/templates/footer.tmpl
+++ b/clavitor.ai/templates/footer.tmpl
@@ -1,52 +1,53 @@
{{define "footer"}}
-