Cookie Policy

Cookies store information in your browser. Session storage and similar browser facilities can also remember preferences or associate activity with a session. Identifiers used for attribution or matching are not necessarily anonymous. Network requests can expose IP address and browser information even without a cookie.

• Authentication: Supabase session cookies (commonly named sb-*) support sign-in. Blocking these can prevent authenticated features from working.
• Website preferences: _omesta_site_privacy remembers a versioned optional-analytics choice for up to 180 days. Change or withdraw it using Cookie settings. Essential storage is separate from optional analytics.
• Interface and support state: enabled screens can use local or session storage for theme preferences, dismissed notices, a draft transferred between tools, or a support-chat email you supply. Authorized support sessions can also keep their selected account and mode in session storage. These functions are distinct from optional advertising or analytics consent; clearing browser storage does not delete server-side chats, campaign records or account data.
• Customer-site preferences: _omesta_consent stores analytics and marketing choices read by customer-installed tracking. Customers must supply their own consent interface and connect it to the script. A consent-cookie reader is not itself a consent banner.
• Customer tracking: _omesta_cid stores attribution identifiers and _omesta_sid is used in session storage. Configured tracking can capture page/referrer URLs, click and campaign parameters, events and matching information.
• Google Analytics: the _ga family of cookies can identify browser/session activity for website analytics. Actual storage depends on browser and provider behavior.

Optional website analytics is paused by default pending review. When enabled, Google Analytics loads only after a current affirmative analytics choice. Missing, expired or invalid choices do not enable it. Global Privacy Control takes precedence over a saved approval. Optional Vercel Analytics and Speed Insights are not mounted by this implementation.

The separate script customers install on their own sites has a configurable strict opt-in mode (requireConsent: true). Without that setting it can track without a recorded choice. In the current customer script, a saved marketing choice is read before Global Privacy Control; unlike our website analytics control, that script does not give the browser signal unconditional priority. Customers must connect a suitable consent manager and verify the required consent and opt-out behavior before using tracking. Installing the script is not consent.

Server events, CRM connections, booking webhooks and Eventbrite registration/attendance forwarding are separate from browser cookies. A browser preference does not automatically stop those sources or erase past transfers. See the Integration Data Disclosure.

Using dashboard AI tools or an enabled creative workflow can send feature-specific context to a provider independently of website analytics. Rejecting analytics does not itself disable a feature you request or remove its server records. A new dashboard layout does not provide blanket permission for new tracking, storage or AI uses; applicable disclosure, consent and opt-out requirements still apply.

Browser settings can block or remove cookies and storage; blocking cookies alone may not prevent analytics requests. For Google Analytics browser controls, see Google’s opt-out browser add-on. These browser controls do not cover independent server-side processing.

Use the Cookie settings button to review or withdraw your optional website analytics choice. Withdrawal disables the configured Google measurement and attempts to expire accessible Google Analytics cookies; it does not erase past provider records. If your browser blocks preference storage, the interface reports that it cannot save the choice. Contact support@omestasystems.com or the relevant business for applicable opt-out, objection or deletion requests. See Privacy requests.

Describing these limitations does not waive consent or opt-out requirements. Deployments subject to such requirements need working controls before the relevant tracking takes place.

We will identify changes to this notice and provide additional notice or obtain consent where required. An updated description does not retrospectively override earlier privacy commitments or authorize a new purpose.