The basics, in plain language.
Cookies are small text files stored on your device by your browser when you visit a website. They're widely used to make websites work, work better, and provide reporting information. We use both first-party cookies (set by aisyndicate.com) and a small number of third-party cookies (set by services we use, such as our authentication and hosting providers).
"Similar technologies" includes local storage, session storage, pixels, and SDK identifiers. For simplicity, we use the word "cookies" throughout this notice to refer to all of these.
Every cookie we set falls into one of these four categories.
1. Strictly necessary
Required. Cannot be switched off. These are essential — keeping you signed in, preserving CSRF tokens, remembering your cookie consent.
2. Functional
Used to remember choices (sidebar collapsed, theme preference, dismissed banners). Improve your experience but the site works without them.
3. Analytics
We use Google Analytics 4, loaded through Google Tag Manager, to understand aggregate site usage, and Microsoft Clarity for heatmaps and session replays of our public pages (text you type is masked; it never runs on the dashboard or sign-in pages). The Tag Manager container itself sets no cookies; the GA4 and Clarity cookies are set only when the Analytics category is on (see "Defaults by region" below). Separately, our hosting provider's cookieless Web Analytics and Speed Insights count page views and measure page speed for everyone — they store nothing on your device and don't follow you across sites.
4. Advertising
We use the Meta Pixel (Facebook & Instagram) and the OpenAI conversion pixel (ChatGPT Ads) to measure and target our ad campaigns, including remarketing to past visitors. The pixels record a "Lead" event when you request a GEO score; when you book a call we also send matching events from our servers to Meta's Conversions API and OpenAI's conversion API, deduplicated by a shared event ID and only if this category was on when you booked. Whether it starts on or off depends on your region (see "Defaults by region" below). Switch it off anytime via Privacy preferences.
The actual cookies and tokens we set.
If we add new cookies, we'll update this table. The actual list on your device may vary slightly depending on the features you use.
Services that may set cookies when you use AI Syndicate.
Supabase (auth)
Sets session cookies on auth.aisyndicate.com required to keep you signed in. See: supabase.com/privacy.
Vercel (hosting)
Runs our cookieless Web Analytics and Speed Insights, and may set short-lived cookies for routing and deployment protection. See: vercel.com/legal/privacy-policy.
Cloudflare (security & CDN)
Sets __cf_bm to mitigate bots and DDoS attacks. See: cloudflare.com/privacypolicy.
Stripe (billing only)
When you reach checkout or the customer portal — and only after you initiate a payment action — Stripe sets cookies for payment processing and fraud prevention (e.g., __stripe_mid, __stripe_sid). These are defensible as strictly necessary to complete the transaction you requested.
Google (sign-in & analytics)
If you sign in with Google, Google may set cookies on its own domains during OAuth — we don't control those. Separately, with your Analytics consent, Google Analytics 4 (loaded via Google Tag Manager) sets the _ga cookies listed above. See Google's privacy policy.
Microsoft Clarity (analytics)
While Analytics is on, Clarity records heatmaps and session replays of our public pages so we can see where pages confuse people. Text you type is masked, it never runs on the dashboard or sign-in pages, and we keep it off Microsoft Advertising. See Microsoft's privacy statement.
Meta (Facebook & Instagram ads)
While Marketing is on, the Meta Pixel loads to measure and target our Facebook and Instagram campaigns, and a matching Lead event is sent to Meta's Conversions API when you book a call (with your email hashed). In California we turn on Meta's Limited Data Use setting. See Meta's privacy policy. Switch off anytime via Privacy preferences.
OpenAI (ChatGPT ads)
While Marketing is on, the OpenAI conversion pixel loads to measure our ChatGPT Ads campaigns, and a matching conversion event is sent to OpenAI's conversion API when you book a call. See OpenAI's privacy policy. Switch off anytime via Privacy preferences.
Google Ads (not switched on)
The page you land on after buying a plan is set up so we can measure Google Ads purchase conversions through Google Tag Manager. No Google Ads tag is running today. If we switch one on, it follows your Marketing setting through Google Consent Mode, and we'll add its cookies to the table above.
What we don't load
No Google Ads remarketing, TikTok pixels, LinkedIn Insight tags, or other advertising trackers beyond the ad measurement described above.
Whether analytics and ads start on or off depends on where you are.
Outside the US, California and New York, or unknown
Analytics and Marketing & advertising stay off until you opt in on our banner. This includes any US visitor whose state we can't tell.
Other US states
Their privacy laws use an opt-out model, so both are on by default. Our banner says so on your first visit, and you can switch them off anytime under Privacy preferences.
Global Privacy Control
A GPC signal turns both off automatically, in every region, before anything loads.
We pick the region from the approximate country and US state our hosting provider derives from your connection. We don't store your IP address to do it.
How to control cookies on your device.
Browser settings
You can set your browser to block or delete cookies. Doing so may break features that depend on strictly-necessary cookies. Browser-specific instructions:
Global Privacy Control (GPC)
Some browsers and extensions send a Global Privacy Control signal indicating your preference to opt out of the sale or sharing of personal information. We honor GPC signals as a valid opt-out request, consistent with California Attorney General guidance. When we detect GPC, we automatically keep the Marketing & advertising category (including the Meta and OpenAI pixels and their conversion events) turned off, so no advertising cookies load and no conversion events fire.
Your privacy choices
To opt out of the Meta and OpenAI pixels and other marketing cookies — California's "Do Not Sell or Share My Personal Information" right — open and turn off Marketing & advertising. They're off until you opt in outside the US and in California and New York; in other US states they're on by default.
Do Not Track
We don't respond to legacy "Do Not Track" headers, which lack a common standard. To opt out of advertising cookies, use GPC or the Marketing toggle in our consent banner.
Clearing in-product storage
To clear functional preferences stored in localStorage, sign out from the dashboard and clear your browser's site data for aisyndicate.com.
Withdrawing consent
You can withdraw or change your consent for non-essential cookies (Analytics, Marketing & advertising) at any time via the Privacy preferences control in the bottom-left of any page, or by clearing your browser's site data for aisyndicate.com — clearing removes our stored consent record and you'll be re-prompted on your next visit. Withdrawing consent is as easy as giving it. We re-request consent at least every 12 months in line with EDPB guidance.
How we update this notice.
We may update this Cookie Notice from time to time. The effective date at the top reflects the latest version. For material changes (e.g. introducing a new category), we'll provide more prominent notice — typically a banner or email to registered users.
Questions about cookies.
Email privacy@aisyndicate.com with any cookie question, complaint, or request. We respond within 30 days.
Want to know exactly what we collect?
Our Privacy Policy covers the full set of personal information we process, why, and how to exercise your data rights.