Privacy PolicyTerms of ServiceSubprocessorsCookie NoticeSMS Policy

What cookies are

## The basics, in plain language.

Cookies are small text files stored on your device by your browser when you visit a website. They're widely used to make websites work, work better, and provide reporting information. We use both first-party cookies (set by aisyndicate.com) and a small number of third-party cookies (set by services we use, such as our authentication and hosting providers).

"Similar technologies" includes local storage, session storage, pixels, and SDK identifiers. For simplicity, we use the word "cookies" throughout this notice to refer to all of these.

Cookie categories

## Every cookie we set falls into one of these four categories.

### 1. Strictly necessary

**Required.** Cannot be switched off. These are essential — keeping you signed in, preserving CSRF tokens, remembering your cookie consent.

### 2. Functional

Used to remember choices (sidebar collapsed, theme preference, dismissed banners). Improve your experience but the site works without them.

### 3. Analytics

We use **Google Analytics 4**, loaded through **Google Tag Manager**, to understand aggregate site usage. The Tag Manager container itself sets no cookies; under Google Consent Mode the GA4 cookies stay off until you allow the Analytics category in our consent banner. We also derive some metrics from *server-side logs* (request paths, response codes, IPs hashed before retention) that don't store identifiers on your device.

### 4. Advertising

We use the **Meta Pixel** (Facebook & Instagram) and the **OpenAI conversion pixel** (ChatGPT Ads) to measure and target our ad campaigns, including remarketing to past visitors. With the same Marketing consent, we also send matching **"Lead" conversion events** when you submit our GEO-Score form or book a call — from your browser and server-side to Meta's Conversions API and OpenAI's conversion API, deduplicated by a shared event ID. Everything in this category is **off by default** and only activates after you turn on Marketing & advertising in our consent banner. Withdraw consent anytime via **Privacy preferences**.

Specific cookies

## The actual cookies and tokens we set.

| Name | Category | Purpose | Set by | Expiry |
| --- | --- | --- | --- | --- |
| `sb-auth-auth-token` | Strictly necessary | Authenticates your session with our auth backend so you stay signed in. | aisyndicate.com (first party, set by Supabase auth running on auth.aisyndicate.com) | Session / refresh token rotation; cleared on sign out |
| `ais.dash.*` | Functional | Remembers dashboard configuration (selected plan, onboarding, vertical). | aisyndicate.com (first party, localStorage) | Persistent until sign-out or browser storage clear |
| `ais.linking_provider` | Strictly necessary | Tracks an in-progress account linking attempt so we can show a confirmation toast after OAuth. | aisyndicate.com (first party, sessionStorage) | Session / cleared after the OAuth flow completes |
| `__cf_bm` | Strictly necessary | Cloudflare bot management — protects the site from automated abuse. | Cloudflare (third party) | 30 minutes |
| `_ga` | Analytics (consent) | Google Analytics — distinguishes unique users. Loads only after you allow Analytics. | Google (third party) | 2 years |
| `_ga_K8HMEJ77VH` | Analytics (consent) | Google Analytics — persists session state for our property. Loads only after you allow Analytics. | Google (third party) | 2 years |
| `_fbp` | Advertising (consent) | Meta Pixel — identifies the browser for Facebook & Instagram ad measurement. Loads only after you allow Marketing. | Meta (third party) | 3 months |
| `_fbc` | Advertising (consent) | Meta Pixel — stores the ad-click ID when you arrive from a Meta ad. | Meta (third party) | 3 months |
| `oaiq` | Advertising (consent) | OpenAI conversion pixel — measures ChatGPT Ads campaigns and matches conversions. Loads only after you allow Marketing. | OpenAI (third party) | Set by OpenAI |
| `_cb` (query parameter, not a cookie) | N/A | Cache-busting parameter occasionally appended to URLs during deploys. Stored only in browser history. | aisyndicate.com | Not persisted |

If we add new cookies, we'll update this table. The actual list on your device may vary slightly depending on the features you use.

Third parties

## Services that may set cookies when you use AI Syndicate.

### Supabase (auth)

Sets session cookies on `auth.aisyndicate.com` required to keep you signed in. See: [supabase.com/privacy](https://supabase.com/privacy).

### Vercel (hosting)

May set short-lived cookies for routing, deployment protection, and analytics. See: [vercel.com/legal/privacy-policy](https://vercel.com/legal/privacy-policy).

### Cloudflare (security & CDN)

Sets `__cf_bm` to mitigate bots and DDoS attacks. See: [cloudflare.com/privacypolicy](https://www.cloudflare.com/privacypolicy/).

### Stripe (billing only)

When you reach checkout or the customer portal — and only after you initiate a payment action — Stripe sets cookies for payment processing and fraud prevention (e.g., `__stripe_mid`, `__stripe_sid`). These are defensible as strictly necessary to complete the transaction you requested.

### Google (sign-in & analytics)

If you sign in with Google, Google may set cookies on its own domains during OAuth — we don't control those. Separately, with your Analytics consent, Google Analytics 4 (loaded via Google Tag Manager) sets the `_ga` cookies listed above. See [Google's privacy policy](https://policies.google.com/privacy).

### Meta (Facebook & Instagram ads)

With your consent, the Meta Pixel loads to measure and target our Facebook and Instagram campaigns, and matching Lead conversion events are sent to Meta's Conversions API when you submit a form or book a call. See [Meta's privacy policy](https://www.facebook.com/privacy/policy/). Off until you allow marketing cookies; disable anytime via Privacy preferences.

### OpenAI (ChatGPT ads)

With your consent, the OpenAI conversion pixel loads to measure our ChatGPT Ads campaigns, and matching conversion events are sent to OpenAI's conversion API when you book a call. See [OpenAI's privacy policy](https://openai.com/policies/privacy-policy/). Off until you allow marketing cookies; disable anytime via Privacy preferences.

### What we don't load

No Google Ads remarketing tags, TikTok pixels, LinkedIn Insight tags, or other advertising trackers beyond the consent-gated Meta and OpenAI ad measurement described above.

Managing cookies

## How to control cookies on your device.

### Browser settings

You can set your browser to block or delete cookies. Doing so may break features that depend on strictly-necessary cookies. Browser-specific instructions:

- [Chrome](https://support.google.com/chrome/answer/95647)
- [Firefox](https://support.mozilla.org/en-US/kb/clear-cookies-and-site-data-firefox)
- [Safari (macOS)](https://support.apple.com/guide/safari/manage-cookies-sfri11471/mac)
- [Edge](https://support.microsoft.com/en-us/microsoft-edge/delete-cookies-in-microsoft-edge-63947406-40ac-c3b8-57b9-2a946a29ae09)

### Global Privacy Control (GPC)

Some browsers and extensions send a **Global Privacy Control** signal indicating your preference to opt out of the sale or sharing of personal information. **We honor GPC signals** as a valid opt-out request, consistent with California Attorney General guidance. When we detect GPC, we automatically keep the Marketing & advertising category (including the Meta and OpenAI pixels and their conversion events) turned off, so no advertising cookies load and no conversion events fire.

### Your privacy choices

To opt out of the Meta and OpenAI pixels and other marketing cookies — California's "Do Not Sell or Share My Personal Information" right — open and turn off Marketing & advertising. These cookies are off until you opt in.

### Do Not Track

We don't respond to legacy "Do Not Track" headers, which lack a common standard. To opt out of advertising cookies, use GPC or the Marketing toggle in our consent banner.

### Clearing in-product storage

To clear functional preferences stored in localStorage, sign out from the dashboard and clear your browser's site data for `aisyndicate.com`.

### Withdrawing consent

You can withdraw or change your consent for non-essential cookies (Analytics, Marketing & advertising) at any time via the **Privacy preferences** control in the bottom-left of any page, or by clearing your browser's site data for `aisyndicate.com` — clearing removes our stored consent record and you'll be re-prompted on your next visit. Withdrawing consent is as easy as giving it. We re-request consent at least every 12 months in line with EDPB guidance.

Changes

## How we update this notice.

We may update this Cookie Notice from time to time. The effective date at the top reflects the latest version. For material changes (e.g. introducing a new category), we'll provide more prominent notice — typically a banner or email to registered users.

Contact

## Questions about cookies.

Email [privacy@aisyndicate.com](mailto:privacy@aisyndicate.com) with any cookie question, complaint, or request. We respond within 30 days.

## Want to know exactly what we collect?

Our Privacy Policy covers the full set of personal information we process, why, and how to exercise your data rights.

Read Privacy PolicyView Terms of Service