Legal
Cookie Policy
How NHM LLC uses essential cookies, local storage, and privacy-first analytics across nhmohio.com and DomainGuard — and the choices you have.
Effective Date: September 3, 2026
Effective Date: September 3, 2026
This Cookie Policy explains how NHM LLC ("we," "us," or "our") uses cookies and similar technologies on our website at nhmohio.com and on web dashboard pages opened inside DomainGuard. Native DomainGuard features use the iOS Keychain for secure storage instead of browser cookies. When the app opens an embedded nhmohio.com dashboard page, the WebKit layer uses the same first-party cookies and browser storage described below. See our Privacy Policy for the full picture, and our Do Not Sell or Share My Personal Information page to record a California opt-out.
1. What Are Cookies and Local Storage?
Cookies are small text files stored on your device when you visit a website. Browsers also offer local storage (persists until you clear it) and session storage (cleared when you close the tab). Together we call these "cookies" in this policy. We use them to keep the site working and to remember your choices. Only after you consent do we use them to measure how the site is used.
2. Cookies and Storage We Use
We group everything into four categories. Strictly necessary cookies are always on because the site cannot work without them. Everything in the other three categories that sets a cookie or stores data loads only after you accept it in our cookie banner; the one exception is Ahrefs Web Analytics, which is cookie-less and listed under Analytics for completeness.
Strictly necessary cookies
These cookies and storage entries are required for the site and the dashboard to work. We use them to keep you signed in, remember your consent choice, and keep the dashboard's own state. They cannot be switched off in our systems.
| Name | Purpose | Provider |
|---|---|---|
| Sign-in cookies (auth_token, auth_present, refresh_token) | auth_token holds your session while you are signed in to the dashboard and refresh_token renews it; both are HttpOnly, Secure and SameSite=Strict, so page scripts cannot read them. auth_present is a readable flag that tells the dashboard a session exists. All three are cleared when you sign out or delete your account. When the DomainGuard app opens a dashboard page, it may also place its own token in that page's local storage. | NHM LLC (first-party) |
| apple_web_flow | Carries the state of a Sign in with Apple round trip for the few minutes it takes to complete. Cleared when sign-in finishes. | NHM LLC (first-party) |
| Admin support session (same cookies as above) | When an NHM administrator opens your account to help with a support request, they use a short-lived session issued in the same cookies, marked so the action is audit-logged. There is no separate cookie. | NHM LLC (first-party) |
| Consent and opt-out flags (local storage) | nhmohio_cookie_consent records the choice you make in the cookie banner. nhmohio_dnsmpi_optout records a California Do Not Sell or Share opt-out made on this browser. | NHM LLC (first-party) |
| Dashboard UI state (local storage) | The signed-in dashboard keeps its own working state in your browser: the console mode you picked, your finding and remediation queues, SEO workspace state, and similar. It is how the dashboard functions, holds no third-party identifiers, and is only written on dashboard pages. | NHM LLC (first-party) |
| Cloudflare security cookies | Cloudflare, which serves the site, may set its own security cookies (such as __cf_bm) to distinguish humans from bots and protect forms from automated abuse. They are set at the network edge, not by our code. | Cloudflare (cloudflare.com) |
Analytics cookies and tags
Ahrefs Web Analytics is cookie-less and runs without consent. Google Analytics 4 and Microsoft Clarity set cookies and load only after you turn Analytics on in the cookie banner; before that, nothing is sent to either.
| Name | Purpose | Provider |
|---|---|---|
| Ahrefs Web Analytics | Aggregate website measurements (page views, top pages, referrers). Ahrefs states it sets no cookies and keeps no persistent identifiers, which is why it is not gated behind consent. We use it to see which content helps visitors. | Ahrefs (ahrefs.com) |
| Google Analytics 4 (_ga, _ga_*) | Count visits, approximate geographic region (country and city), pages viewed, and referrer. Google Analytics 4 does not log or store IP addresses. We have configured Google Consent Mode v2 so all advertising features stay disabled. If you decline, or later withdraw, we deny analytics storage and expire the _ga cookies on our domain. | Google LLC (policies.google.com/privacy) |
| Microsoft Clarity (_clck, _clsk) | Session-replay and heatmaps so we can see how visitors move through the site. Clarity loads only after you accept analytics. If you decline, or later withdraw, we tell Clarity to stop recording and expire the _clck and _clsk cookies it set on our domain. Clarity may also set cookies on Microsoft's own domains (CLID, MUID, SM); those are Microsoft's, and no website can delete another domain's cookies, so use the Microsoft privacy dashboard for them. | Microsoft Corporation (clarity.microsoft.com) |
Preference cookies and storage
Two things live here: our live chat widget, and campaign attribution for the contact form. Both are off until you turn Preferences on in the cookie banner (Accept turns everything on).
| Name | Purpose | Provider |
|---|---|---|
| LeadConnector chat widget | Runs the live chat bubble on the marketing pages and remembers a conversation across page loads. It loads only after you allow Preferences. If you decline, or if you have not answered the banner yet, the widget is never loaded; if you allow it and later change your mind, we remove it and expire the cookies it set on our domain. Anything it stored on leadconnectorhq.com is under that company's control. | LeadConnector / HighLevel (leadconnectorhq.com) |
| Lead attribution in session storage | When you arrive from a campaign or referral, we keep the campaign tags, advertising click identifier (for example gclid or fbclid), landing page, and referring page in your browser session, and attach them to a contact form, registration or checkup you submit so we know which ad or referral produced it. That context is stored with the inquiry and sent to our CRM. Nothing is recorded unless Preferences is on, and withdrawing consent clears it. We do not use this for cross-site tracking. | NHM LLC (first-party) |
Marketing and advertising cookies
We do not currently run ads on this site, and we do not set third-party marketing or retargeting cookies. This category is listed for completeness and stays off by default.
| Name | Purpose | Provider |
|---|---|---|
| (none at this time) | If we ever enable remarketing or conversion pixels (Meta, LinkedIn, Google Ads, etc.), we will update this page and ask for consent before loading them. | n/a |
3. Your Choices and How to Manage Cookies
3.1 Our Cookie Banner
The first time you visit nhmohio.com you see a cookie banner with three options: Accept, Reject, or Manage preferences. Your choice is stored in your browser's local storage with the key nhmohio_cookie_consent. You can change or withdraw your choice at any time from the "Cookie settings" link in the site footer, which reopens the banner with your current choices. Clearing the site's data also brings the banner back.
3.2 Global Privacy Control (GPC)
We honor Global Privacy Control. If your browser sends a GPC signal (or the older Do Not Track signal) and you have not yet made a choice in our banner, we record a reject-all choice for you automatically: no analytics, no chat widget, no campaign attribution. The banner still appears so you can see what was recorded and change it if you want to. A choice you make yourself in the banner is kept, GPC or not; we do not override an explicit decision either way. We do not sell or share personal information, so there is nothing further for the signal to switch off on our servers. See globalprivacycontrol.org for browser extensions that send the signal.
3.3 Browser Controls
Every modern browser lets you block or delete cookies. Use your browser's privacy settings to view what is stored, block third-party cookies, block cookies from specific sites, or delete all cookies when you close the browser. Blocking strictly necessary cookies will break sign-in and protected forms.
3.4 Third-Party Opt-Outs
- Google Analytics: install the Google Analytics Opt-out Browser Add-on.
- Microsoft Clarity: use the Microsoft privacy dashboard to manage Clarity data.
4. Legal Basis for Processing (EEA/UK Visitors)
If you are in the European Economic Area (EEA), the United Kingdom, or Switzerland, the legal bases we rely on for processing personal data collected through cookies are:
- Strictly necessary cookies: our legitimate interest in operating a secure, functional website (Article 6(1)(f) GDPR). Consent is not required for these.
- Analytics, preferences, and marketing cookies: your explicit consent, which we obtain through the cookie banner (Article 6(1)(a) GDPR). You can withdraw consent at any time.
We do not engage in automated decision-making that produces legal or similarly significant effects on you.
5. Your Rights Under GDPR (EEA/UK)
If you are in the EEA or UK, you have the right to:
- Access the personal data we hold about you (Article 15 GDPR).
- Rectification of inaccurate or incomplete data (Article 16 GDPR).
- Erasure ("right to be forgotten") of your data, subject to legal exceptions (Article 17 GDPR).
- Restriction of processing while we verify a complaint or comply with a legal obligation (Article 18 GDPR).
- Data portability — receive your data in a structured, commonly used, machine-readable format and transmit it to another controller (Article 20 GDPR).
- Object to processing based on our legitimate interest (Article 21 GDPR).
- Withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal (Article 7(3) GDPR).
- Lodge a complaint with your local data protection authority. A list is available at edpb.europa.eu (EEA) or the UK Information Commissioner's Office.
To exercise any of these rights, contact us at the address in Section 8 below. We respond within 30 days.
6. Your Rights Under CCPA/CPRA (California)
If you are a California resident, the CCPA and CPRA give you the following rights:
- Right to Know what personal information we collect, the categories of sources, the business purposes, and the categories of third parties with whom we share it.
- Right to Delete personal information we have collected from you, subject to legal exceptions.
- Right to Correct inaccurate personal information.
- Right to Opt Out of Sale or Sharing. We do not sell personal information. We do not share it for cross-context behavioral advertising. To record an opt-out preference, follow the Do Not Sell or Share My Personal Information link in our site footer, or send the GPC signal from your browser.
- Right to Limit Use of Sensitive Personal Information. We do not collect sensitive personal information through cookies.
- Right to Non-Discrimination for exercising any of the above rights.
Authorized agents may submit requests on your behalf using the contact information below; we will verify the authorization as required by California regulations.
7. Children's Privacy
Our services are not directed to children under 13, and we do not knowingly collect personal information from children under 13 through cookies or any other means. The Children's Online Privacy Protection Act (COPPA) requires verifiable parental consent before collecting such data; because we do not collect it, no consent flow is required. If you believe a child has provided us with information, please contact us so we can delete it.
8. Changes to This Policy
We update this Cookie Policy when we change the cookies we use or when the law requires it. The "Effective Date" at the top reflects the most recent change.
9. Contact Us
Questions about cookies, this policy, or your privacy rights? Reach out to:
- NHM LLC
- East Canton, OH 44730
- Phone: (330) 305-2750
- Email: support@nhmohio.com
- Web: nhmohio.com/contact