Cookie Policy

1. What are cookies?

Cookies are small text files stored on your device. Similar technologies such as localStorage and pixels work in comparable ways. We use them to keep you signed in, remember your preferences, and—only with your consent—to understand usage and provide live support.

2. Strictly necessary cookies

These are required for the service to function and cannot be switched off. They include authentication and session cookies set by Supabase, security cookies, and the record of your cookie choices.

Live chat is first-party: it sets two essential cookies (listed above) and loads no third-party script, so it needs no consent.

• Authentication/session — keeps you signed in (deleted when your session ends)
• Security — protects against fraud and abuse (retained up to 30 days)
• Consent storage — remembers your cookie preferences in your browser's localStorage
• Free seating-chart tool — the chart you build without an account is auto-saved to your browser's localStorage so you do not lose your work. It stays on your device, is never sent to us, and clearing your browser data removes it.
• Live chat — remembers your support conversation on this device so you can come back to it (first-party, deleted after 30 days)
• Live chat — a second, non-identifying cookie recording only that you have an open conversation, so the widget can tell you when someone replies without checking on every page (first-party, deleted after 30 days)

3. How you found us (no consent required)

We set one first-party cookie, sp_attr, that records how you first arrived: the campaign or link you came from, the referring website, and the page you landed on. When you create an account, that record is attached to it so we can tell which channels actually bring people to SeatPlanning.

It is first-party and is never shared with anyone. It holds no name, email address or other identifier, and it is not used to build a profile of you or to follow you across other websites. We rely on our legitimate interest in understanding where our customers come from (Art. 6(1)(f) GDPR), and you can object at any time by emailing us. Sending anything to an advertising platform is a separate step that always requires your consent — see the next section.

• sp_attr — the campaign, referrer and landing page of your first visit (first-party, 90 days)
• sp_consent — records the cookie choice you made, so our servers can honour it (first-party, 1 year)

4. Analytics cookies (consent required)

These load only after you opt in. They help us measure usage and improve the product. They process limited personal data such as your IP address and on-site activity.

The advertising pixels let us tell the ad platform that a click became a signup or a purchase. We send that measurement from our servers as well, and only for people who accepted these cookies — your email address is always hashed first, never sent in the clear. OpenAI's pixel can also detect supported customer information present on the page and hash it in your browser before sending; that behaviour has no separate off switch, so declining these cookies is what prevents the pixel loading at all. If you decline, nothing about you is sent to an advertising platform.

• PostHog (EU-hosted) — product analytics and optional session replay
• ChatGPT Ads measurement pixel (OpenAI) — measures whether an ad we paid for led to a signup. Once loaded it contacts OpenAI on each page load and sets two cookies of its own, __oppref and __obref, which identify the ad click and this browser to OpenAI.
• Meta pixel (Facebook/Instagram) — the same measurement for Meta ads, when we run them

5. Cookieless analytics (no consent required)

We use Vercel's cookieless analytics to measure overall traffic and page performance. These tools set no cookies, store nothing on your device, and use no stable identifier to track you across visits, so they run for all visitors without consent.

• Vercel Web Analytics — aggregate visit and page metrics
• Vercel Speed Insights — page performance measurement

6. Third-party features you trigger yourself

Some features call a third party only at the moment you use them, because that is what makes the feature work.

When you type a venue into the event location field, Google's address autocomplete is loaded to suggest addresses. Google receives what you type in that field, along with your IP address and browser information, and may set its own cookies. If you would rather not use it, type the location and ignore the suggestions.

7. Measurement that does not use your device

We also record a small number of product events on our own servers, such as a chart being created or an export being started. These are recorded without reading or writing anything on your device, and we replace guest email addresses with an irreversible hash before they reach our analytics provider. Because no information is stored on or read from your device, these do not rely on cookie consent; we rely on our legitimate interest in understanding how the product is used.

8. Managing your choices

You can accept or reject non-essential cookies at any time using the cookie banner or the cookie-settings button. You can also control cookies through your browser settings. Rejecting non-essential cookies will not affect access to core features but will disable product analytics, session replay, advertising measurement and the live-chat widget.

9. Contact

Questions about this Cookie Policy? Email us at contact@seatplanning.com.