Cookie Policy

What cookies and similar technologies are

A cookie is a small text file a website stores on your device. "Similar technologies" covers your browser’s local storage and session storage, which hold small pieces of information in much the same way, and the cache your browser keeps so pages load faster on a second visit. This policy treats all of them the same way, because what matters legally is that something is stored on or read from your device, not which mechanism does it.

Session storage is emptied when you close the tab. Local storage survives until you clear it. Cookies expire on a date the party that set them chooses.

Strictly necessary (always active, no consent required)

These exist because the Site cannot do what you asked without them, which is why they do not require consent. None of them is used to track you or shared with anyone.

• "square_cookie_consent_v2" (local storage, set by us). Your cookie choice, so we do not ask again on every visit. It holds one true/false per category plus the date you chose and a version number for the categories you were shown. The date and version are there because we have to be able to demonstrate that you consented, and to what. It never leaves your device.
• "localeSuggestDismissed" (local storage, set by us). Remembers that you dismissed the suggestion to switch to a different language version, so it does not reappear on every page.
• "sq_estimator_prefill" (session storage, set by us). If you complete the project estimator and choose to send it to us, this carries your estimate to the contact form so you do not retype it. It is emptied when you close the tab, whether or not you send anything.
• "square_chat_token" and "square_chat_seen" (local storage, set by us). Only if you open the chat and send a message. The first is the random token that lets us show you your own conversation when you come back, and it is the only thing tying a reply to you: we do not know who you are unless you tell us. The second is the timestamp of the newest message you have read, so returning does not show everything as unread. Neither is used to track you, and both are written only after you choose to write to us.
• Service worker cache (Cache Storage, set by us). Copies of pages, styles and images your browser has already downloaded, so the Site loads faster and still works on a poor connection. It contains no information about you, only the same public files anyone gets.
• "__Host-sqt" (cookie, set by us, Square Tender Alerts subscribers only). Keeps a subscriber logged in to the subscriber panel after they confirm a login link. It holds a random session token and nothing else, is sent only over HTTPS and only to square.al, cannot be read by scripts on the page, and expires after 30 days or when you log out. It is set only when you log in, so nobody who merely reads the Site ever receives it.

Stays on your device: the CV builder

The free CV builder saves what you type, including any photograph you add, under the key "cv-shqip-v1" in your own browser’s local storage. It is never transmitted to us. We cannot see it, we do not have a copy, and it is not on our servers. It stays there until you use the tool’s own clear control or clear your browser storage, so if you are on a shared or public computer, clear it when you are done.

The salary, VAT, NIPT and fiscalisation calculators send us nothing at all and store nothing on your device.

Analytics (optional, only with your consent)

Google Analytics 4, provided by Google. Tells us in aggregate how the Site is used: which pages are visited, how many visitors arrive, which routes through the Site people take. If, and only if, you enable Analytics, Google sets cookies such as "_ga" and "_ga_<id>" to tell visitors apart. Until then Consent Mode holds analytics storage at "denied" and no analytics cookie is written.

Microsoft Clarity, provided by Microsoft. Records clicks, mouse movement, scrolling and a replay of your interaction with the page, so we can find things that are broken, such as a control that does not respond when clicked. It sets cookies such as "_clck" and "_clsk". It is not merely told about your choice: the script is not requested from Microsoft at all unless you enable Analytics, so nothing is recorded before you do. The contact form and the job application form are masked in full, so the text you type, your name, your email address, your telephone number and any file you attach are never recorded. We do not use it to identify you.

"sq_attribution" (session storage, set by us). Records how you first reached the Site: the first page you saw, the site that referred you, and any campaign parameters in the address. If you send us an enquiry we attach it, so we know which channels actually produce work. It is written only if you enable Analytics, it is emptied when you close the tab, and if you do not enable Analytics nothing is written and the information is simply lost.

Advertising (optional, only with your consent)

We advertise our own services through Google Ads. If you enable Advertising, Google may store advertising identifiers on your device so we can measure which advertisement led to an enquiry and, where applicable, show you our advertisements on other sites.

If you leave Advertising off, no advertising storage is used, advertising click identifiers are stripped from the requests we send (Google’s "ads data redaction"), and we receive only aggregate, modelled figures instead. Advertising can be refused on its own, without refusing analytics.

How the consent gate works (Consent Mode v2)

Before any Google script can store anything, all four signals default to "denied": analytics storage, advertising storage, advertising user data and advertising personalisation. Each is raised to "granted" only for the categories you actually enable, so accepting analytics does not enable advertising and the reverse is equally true. While advertising consent is denied we also apply ads data redaction.

Microsoft Clarity is not part of Consent Mode and cannot be gated by a signal, so it is gated by absence instead: the script is never loaded until consent exists. Withdrawing consent stops it from loading on your next page view, because a script already running in the current page cannot be unloaded.

Measurement that uses no cookies at all

Separately from everything above, we count page views and a short fixed list of interactions on our own servers, for every visitor. This measurement uses no cookies, writes nothing to your device and reads nothing from it, which is why it is not in the banner and is unaffected by your choices there.

It also cannot identify you. No identifier of any kind is created, not even a temporary or hashed one, and your IP address is never read or stored: the country comes from a header our infrastructure provider adds before the request reaches us. What we keep is a daily total per page, per event, per country, per language and per referring website. Because these are counts and never records of individual visits, they cannot be traced back to you or your device. If your browser sends a Global Privacy Control or Do Not Track signal, we do not count the visit at all.

Giving, changing and withdrawing your consent

On your first visit a banner lets you enable Analytics and Advertising independently, or choose "Accept all" or "Reject non-essential" in one click. Rejecting is one click, exactly like accepting.

You can change or withdraw your choice at any time by selecting "Cookie settings" in the footer of any page, which reopens the banner showing the settings currently in force. Withdrawing is as easy as consenting, which the law requires, and it takes effect immediately for anything not already loaded on the page you are looking at.

The Square Tender Alerts subscriber panel (square.al/paneli) uses this same banner and this same stored choice, so a choice made on the Site applies in the panel too and you are not asked again, and a choice made in the panel applies on the Site. "Cilësimet e cookie-ve" (Cookie settings) in the panel reopens it. If you have enabled Analytics, the panel may load Microsoft Clarity, which sets "_clck" and "_clsk" as described above; everything shown or typed in the panel is masked, and Clarity is not loaded on a panel page whose address contains a search or a one-time code. The panel uses no Google Analytics and no advertising storage, so your Advertising choice has no effect there. The cookieless counting described above covers the panel too.

You can also control cookies through your browser: most browsers let you block or delete cookies and clear local storage. Clearing storage removes our record of your choice too, so the banner will ask again on your next visit.

The third parties involved

Analytics and advertising are provided by Google, session analytics by Microsoft. Both process data under their own privacy terms as well as our contract with them: see Google’s Privacy Policy and its page on how Google uses information from sites that use its services, and the Microsoft Privacy Statement. Our Privacy Policy names every recipient of personal data, where each is located, and the safeguards that apply to any transfer.

Changes to this policy

We update this page whenever the storage the Site uses changes, and the date at the top tells you when it last did. If a change adds a new purpose, we ask for consent again rather than relying on a choice you made about a narrower set of categories.