Cookie Policy

Cookies store information in your browser. Session storage and similar browser facilities can also remember preferences or associate activity with a session. Identifiers used for attribution or matching are not necessarily anonymous. Network requests can expose IP address and browser information even without a cookie.

• Authentication: Supabase session cookies (commonly named sb-*) support sign-in. Blocking these can prevent authenticated features from working.
• Website preferences: _omesta_site_privacy remembers a versioned optional-analytics choice for up to 180 days. Change or withdraw it using Cookie settings. Essential storage is separate from optional analytics.
• Interface and support state: enabled screens can use local or session storage for theme preferences, dismissed notices, a draft transferred between tools, or a support-chat email you supply. Authorized support sessions can also keep their selected account and mode in session storage. These functions are distinct from optional advertising or analytics consent; clearing browser storage does not delete server-side chats, campaign records or account data.
• Customer-site preferences: _omesta_consent stores analytics and marketing choices read by customer-installed tracking. Customers must supply their own consent interface and connect it to the script. A consent-cookie reader is not itself a consent banner.
• Customer tracking: _omesta_cid stores attribution identifiers and _omesta_sid is used in session storage. Configured tracking can capture page/referrer URLs, click and campaign parameters, events and matching information.
• Our ad landing pages: on /check pages, _omesta_ad_choice remembers your ad-cookie choice for up to 180 days. Only after you choose Allow does the Meta Pixel load, and it can then set _fbp and _fbc. Session storage also notes which screens a tab has already counted, so a refresh isn't counted twice; that note stays in your browser.
• Omesta account advertising: _omesta_marketing_v1 remembers your separate, optional permission for public-page and account-lifecycle advertising measurement for up to 180 days. After sign-in, we also save this choice and eligible ad identifiers to your account. Missing, expired or rejected permission does not authorize this measurement.
• Vercel Analytics and Speed Insights: after you allow analytics, these services measure public-page visits and browser performance. We do not configure advertising cookies or user identification through them. The analytics choice itself is stored in the preference cookie described above.
• Google Analytics: the _ga family of cookies can identify browser/session activity for website analytics. Actual storage depends on browser and provider behavior.

Vercel Analytics and Speed Insights load on eligible public pages only after a current affirmative analytics choice. They measure page visits, browser and device characteristics, referral information and loading or interaction performance. Query strings, URL fragments, private account pages and tokenized links are excluded from this measurement. Missing, expired or invalid choices do not enable it, and Global Privacy Control takes precedence over a saved approval. Google Analytics has a separate deployment setting and, when enabled, requires the same current choice. A previous Google-only approval is not reused for the addition of Vercel measurement; previous rejections remain in effect.

With your separate advertising permission, the Meta Pixel measures visits on selected public Omesta pages, and our server reports completed new registrations, actual trial starts and first paid subscriptions. Server matching uses a hashed email and available Meta browser or click identifiers; the paid-subscription event also includes its amount and currency. Hashing does not make these identifiers anonymous. Dashboard content, connected advertising-account data and agent conversations are not sent by this measurement. No event is inferred simply from logging in or visiting a success page. Renewals are not counted as new subscriptions.

On our own ad landing pages (/check), the Meta Pixel loads only after you choose Allow; No thanks or Global Privacy Control keeps it off. When you submit a form on one of those pages, our server sends Meta a Lead event with hashed contact details, the page address and any ad click identifier so we can measure our advertising. It is not sent if you chose No thanks, used Opt out on the form, or your browser sends Global Privacy Control.

Those pages also count page and step views in aggregate, without cookies or identifiers, to see where visitors drop off. Each count records only the page, the screen, the day and whether the visit came from a Meta ad; no IP address, device details, click identifier, answer or contact detail is stored, and nothing is sent to Meta. Because nothing identifies you, this counting runs whatever your ad-cookie choice.

The separate script customers install on their own sites has a configurable strict opt-in mode (requireConsent: true). Without that setting it can track without a recorded choice. In the current customer script, a saved marketing choice is read before Global Privacy Control; unlike our website analytics control, that script does not give the browser signal unconditional priority. Customers must connect a suitable consent manager and verify the required consent and opt-out behavior before using tracking. Installing the script is not consent.

Server events, CRM connections, booking webhooks and Eventbrite registration/attendance forwarding are separate from browser cookies. A browser preference does not automatically stop those sources or erase past transfers. See the Integration Data Disclosure.

Using dashboard AI tools or an enabled creative workflow can send feature-specific context to a provider independently of website analytics. Rejecting analytics does not itself disable a feature you request or remove its server records. A new dashboard layout does not provide blanket permission for new tracking, storage or AI uses; applicable disclosure, consent and opt-out requirements still apply.

Browser settings can block or remove cookies and storage; blocking cookies alone may not prevent analytics requests. For Google Analytics browser controls, see Google’s opt-out browser add-on. These browser controls do not cover independent server-side processing.

Use the Cookie settings button to review or withdraw your optional website analytics choice. Withdrawal stops new Vercel measurement and disables configured Google measurement, with an attempt to expire accessible Google Analytics cookies; it does not erase past provider records. If your browser blocks preference storage, the interface reports that it cannot save the choice. Contact support@omestasystems.com or the relevant business for applicable opt-out, objection or deletion requests. See Privacy requests.

Use Advertising settings on this page or account settings to change the new account-advertising choice. Sign in to synchronize withdrawal to your account and stop pending server events. Global Privacy Control overrides Allow and synchronizes a rejection when signed in. A browser rejection disables the Pixel immediately; a failed account sync is reported for retry. Clearing cookies while signed out does not automatically identify your account or withdraw a previously saved server choice. Attribution identifiers expire with the choice; minimal event receipts remain for deduplication. Withdrawal does not erase past transfers to Meta.

Describing these limitations does not waive consent or opt-out requirements. Deployments subject to such requirements need working controls before the relevant tracking takes place.

We will identify changes to this notice and provide additional notice or obtain consent where required. An updated description does not retrospectively override earlier privacy commitments or authorize a new purpose.