Cookie Policy

1.What cookies are

Cookies are small files stored on your device. Similar technologies (browser local storage, software SDKs) perform comparable functions. We group them by purpose, since the lawful basis depends on what they do rather than who serves them.

2.The categories we use

2.1Strictly necessary (always on — no consent required)

These are essential to deliver the Service you request — the Service will not function without them, so they are always active. The principal one is authentication / session management provided by Clerk (keeping you securely logged in, protecting against CSRF, and maintaining your workspace context). We also use short-lived first-party cookies and local storage for security, load balancing, and remembering your interface preferences (such as light/dark theme).

Lawful basis: strictly necessary — exempt from prior consent under the ePrivacy Directive.

2.2Analytics (consent required in the EU/EEA)

We use PostHog (hosted in the EU — Frankfurt region) to understand product usage and improve the Service. Events are pseudonymous and we set no advertising or cross-site tracking cookies. Analytics run only after you opt in via our cookie banner; you can change or withdraw your choice at any time from Cookie settings in the footer, or through your browser.

The same consent covers masked session replay. A replay records the shape of your session — layout, cursor, clicks, scrolling, which dialogs opened, timing — and no readable text: every text element and every form field is masked in your browser before the recording is sent, and request bodies and console output are never recorded. Withdrawing consent stops a replay that is already running. Full detail is in §2.1a of the Privacy Policy.

Lawful basis: consent (Art. 6(1)(a) GDPR) for non-essential analytics storage/access.

2.3Error monitoring / diagnostics

We use Sentry for application error monitoring and stability. Sentry primarily processes diagnostic data (stack traces, scrubbed request metadata with PII redaction) and is not used for advertising. Its browser SDK is treated as non-essential and is loaded only after you consent to diagnostics via our cookie banner.

Lawful basis: legitimate interests for server-side error capture; consent where client-side non-essential storage is used.

2.4Performance measurement (no cookies — marketing site only)

On our public marketing site — not in the logged-in application — we use Vercel Speed Insights to measure how quickly pages actually load and settle for real visitors (Core Web Vitals). It sets no cookies, writes nothing to your device's storage, and creates no identifier for you: the measurements are not tied to an individual visitor or IP address, and cannot be linked together to reconstruct your browsing across pages.

Each measurement records the page route and address, the performance metric and the page element it relates to, your approximate connection speed, browser, device type and operating system, your country as a two-letter code (not a precise location, and not your IP address), and the time it was received.

Because this neither stores nor reads information on your device, it is outside the ePrivacy consent requirement and therefore runs on all visits to the marketing site rather than waiting for a banner choice. You can still block it with a browser content blocker.

Lawful basis: legitimate interests (Art. 6(1)(f) GDPR) — maintaining and improving the performance of our own website.

3.What we do not use

• No advertising, retargeting, or cross-site tracking cookies.
• No data brokers or ad-network pixels.
• No advertising or cross-site tracking cookies in the outbound emails/messages you send through the Service. Email open/click tracking (a tracking image and redirected links) is off by default and is added to campaign emails only when a workspace admin turns it on for that workspace — see the Privacy Policy for what it records.

4.Consent and how to manage cookies

4.1 On your first visit (and when our cookie set materially changes), we present a consent banner that lets you Accept all, Reject non-essential, or open Preferences to choose by category. Strictly-necessary cookies are always active. We do not pre-tick consent boxes, and rejecting is as easy as accepting.

4.2 You can change or withdraw your choice at any time via the Cookie settings link in our footer (it re-opens the preferences panel), or through your browser settings. Withdrawal does not affect processing already carried out.

4.3 You can also control cookies through your browser settings (block/delete). Disabling strictly-necessary cookies will break sign-in and core functionality.

4.4 We honor the Global Privacy Control (GPC) signal. If your browser or an extension sends GPC, we treat it as an opt-out: optional analytics and diagnostics stay off while the signal is active, regardless of any earlier on-site choice.

5.International transfers

Some providers (e.g. Clerk, Sentry) are established in the United States. PostHog is configured for the EU region. Where any cookie-related data is transferred outside the EEA, we rely on Standard Contractual Clauses or an adequacy decision, as described in our Privacy Policy.

6.Changes

We will update this Policy and re-prompt for consent where required when our cookie usage changes. The version and effective date above indicate the current revision.

7.Contact

Questions about this Cookie Policy: privacy@sequenz.ai.