Cookie Policy

We use cookies for several purposes:

• Authentication: to keep you logged in
• Preferences: to remember your settings (theme, language, etc.)
• Security: to prevent fraud and unauthorized access
• Performance: to monitor and improve how the Service works
• Analytics: to understand how users interact with the Service
• Marketing: to measure advertising effectiveness and personalize content

We use four categories of cookies. Only the first category is set without your consent.

Strictly Necessary Cookies

Essential for the Service to function; they cannot be disabled. They include authentication and session cookies, security and anti-abuse cookies, and cookies that remember your cookie choices.

Functional Cookies

Enable enhanced functionality and personalisation: remembering language, theme, timezone and UI state. Set only with your consent, except where strictly necessary to deliver a feature you requested.

Performance and Analytics Cookies

Help us understand how the Service is used (pages visited, feature usage, errors). We use Google Analytics for this. Analytics data is collected only after you consent to the Analytics category; we do not describe this as anonymous or "privacy-focused", because Google Analytics processes online identifiers that can relate to you.

Marketing and Advertising Cookies

Used for advertising, remarketing and conversion measurement, and set only after you consent to the Marketing category:

• Meta (Facebook) Pixel — measures conversions from our Meta ads and builds remarketing and lookalike audiences on Facebook and Instagram
• Google Ads / remarketing tags — measures conversions from Google ads and shows you our ads across Google Search, YouTube and the Google Display Network
• Google Analytics advertising features — where enabled, links usage data with Google advertising audiences

These partners may combine this data with information they already hold about you. This is cross-context behavioural advertising; we rely on your consent for it and you can withdraw that consent at any time.

First-party cookies and local storage (set by BeMetrix)

• sb-<project-ref>-auth-token — authentication session issued by our cloud authentication provider; keeps you signed in. Strictly necessary. Duration: until sign-out or token expiry (up to 1 year).
• sb-<project-ref>-auth-token-code-verifier — short-lived value used to complete a secure sign-in flow. Strictly necessary. Duration: minutes.
• bm_cookie_consent — stores your cookie choices per category so we do not ask again. Strictly necessary. Duration: 6 months.
• bm_lang — remembers your interface language. Functional. Duration: 1 year.
• bm_theme — remembers light/dark theme. Functional. Duration: 1 year.
• Local storage entries — UI state such as collapsed menus, selected period filters and dismissed notices. Functional. Duration: until you clear browser storage.

Names of authentication cookies are generated by our infrastructure provider and include a project identifier; the exact suffix is visible in your browser's cookie inspector.

Third-party cookies

Cookies below are set by third parties. Payment and security cookies are set only when you actually reach a payment or protected form and are strictly necessary; analytics and advertising cookies require your consent.

• Payment provider cookies (card checkout, fraud prevention) — strictly necessary, set only on payment pages. Duration: session to 1 year.
• Bot-protection cookies (sign-up and sign-in protection) — strictly necessary. Duration: session to 30 days.
• Google Analytics — _ga — distinguishes users. Analytics, consent required. Duration: 2 years.
• Google Analytics — _ga_<container-id> — maintains session state. Analytics, consent required. Duration: 2 years.
• Google Ads — _gcl_au — conversion attribution for Google Ads. Marketing, consent required. Duration: 90 days.
• Google Ads — IDE / test_cookie (doubleclick.net) — remarketing and ad measurement. Marketing, consent required. Duration: up to 13 months (IDE) / 15 minutes (test_cookie).
• Meta Pixel — _fbp — identifies browsers for Meta advertising and conversion measurement. Marketing, consent required. Duration: 90 days.
• Meta — fr (facebook.com) — ad delivery and measurement on Meta platforms. Marketing, consent required. Duration: 90 days.

We may add or change third-party cookies as we evolve. Material changes will be reflected in this policy and in the cookie banner, and we will ask for consent again where required.

Cookie Banner

On your first visit you will see our cookie banner. No analytics or advertising tag is loaded before you make a choice. You can:

• Accept all cookies
• Reject all non-essential cookies
• Customise your choices by category (Necessary, Functional, Analytics, Marketing)

You can change or withdraw your choices at any time via the "Cookie settings" link in the footer of every page.

Opting out with the advertising partners

• Google ad personalisation: adssettings.google.com and the browser add-on at tools.google.com/dlpage/gaoptout
• Meta (Facebook / Instagram) ad preferences: facebook.com/adpreferences/ad_settings
• Industry opt-out tools: youronlinechoices.eu (EU) and optout.aboutads.info (US)

Browser Settings

Most browsers let you block all cookies, block third-party cookies only, delete existing cookies or be notified when cookies are placed. See the help pages of Chrome, Firefox, Safari or Edge for instructions.

Important Note

Blocking strictly necessary cookies may prevent sign-in and other core functions from working.

How We Obtain Consent

In line with the GDPR and the ePrivacy Directive, functional, analytics and marketing cookies are only set after you give affirmative consent through our cookie banner. Until then, only strictly necessary cookies are used, and no analytics or advertising script is loaded. Continuing to browse, scrolling or closing the banner is not treated as consent.

Withdrawing Consent

You can withdraw consent at any time:

• Through the "Cookie settings" link in our footer
• By clearing cookies in your browser
• By contacting privacy@bemetrix.com

Withdrawal takes effect immediately for future processing: the relevant tags are no longer loaded. It does not affect the lawfulness of processing carried out before withdrawal.

Implementation requirement

Blocking of analytics and advertising tags before consent is a mandatory requirement of our implementation: the tags are loaded exclusively by the consent manager after the corresponding category has been enabled.

Some browsers offer a "Do Not Track" (DNT) signal. DNT never became a recognised standard and there is no consensus on how sites should respond, so we do not rely on it.

We do honour the Global Privacy Control (GPC) signal. If your browser or extension sends GPC, the Analytics and Marketing categories are switched off by default and no advertising or analytics tag is loaded, unless you explicitly enable them afterwards in cookie settings. For California residents, GPC is treated as a valid opt-out of sale and sharing under the CPRA.

Our cookie banner and the "Cookie settings" link remain the primary way to record your preferences.