Cookie Policy

1. Introduction

This Cookie Policy explains how PostAgency.ai ('we', 'us', 'our', or 'PostAgency') uses cookies and similar tracking technologies when you visit our website (www.postagency.ai). We are committed to transparency about how we collect and use information, and to respecting your privacy rights under the General Data Protection Regulation (GDPR), the ePrivacy Directive, French law, and other applicable privacy regulations.

PostAgency.ai is headquartered in France and serves customers across Europe and North America. This policy is designed to comply with French law (Code civil), GDPR requirements, and CNIL (Commission Nationale de l'Informatique et des Libertés) guidelines. For Canadian customers, we also comply with Quebec Law 25 and PIPEDA. We take your privacy seriously and use cookies only when necessary to provide our services, improve your experience, or meet legitimate business needs.

Please read this policy carefully. By continuing to use our website after being informed of our cookie practices, you consent to the use of cookies as described in this policy, subject to your explicit consent for non-essential cookies via our consent banner.

2. What Are Cookies?

Cookies are small text files that are stored on your device (computer, tablet, or mobile phone) when you visit a website. They contain information such as unique identifiers, preferences, or usage data. Cookies allow websites to remember information about your visit so that you don't have to re-enter data on subsequent visits, and to understand how you use the website.

There are two main types of cookies based on who stores them. First-party cookies are set by the website you are visiting (postagency.ai in this case) and can only be accessed by that website. Third-party cookies are set by domains other than the website you are visiting—for example, when we use analytics services or payment processors—and can be shared across multiple websites.

Cookies can also be classified by how long they persist. Session cookies are temporary and are deleted when you close your browser. Persistent cookies remain on your device for a set period of time (typically days, months, or years) until they expire or you manually delete them.

Similar technologies include web beacons (tiny images that track page views), pixels, and local storage mechanisms. In this policy, 'cookies' refers to all of these technologies unless otherwise specified.

3. Why We Use Cookies

PostAgency.ai uses cookies to deliver core functionality, improve your experience, and understand how our website is being used. Some cookies are absolutely essential for the website to function (for example, to keep you logged in if you have a PostAgency account). Others help us optimize performance, remember your preferences, or measure how visitors interact with our site. We do not use cookies for marketing or behavioral advertising at this time, though we reserve the right to do so in the future with proper consent.

The cookies we use fall into four categories: (1) Strictly Necessary cookies that are essential for authentication, security, and the core functions of the website; (2) Analytics and Performance cookies that help us understand how you use our website and identify errors or bottlenecks; (3) Functional cookies that remember your preferences (such as language or theme); and (4) Marketing and Advertising cookies (currently unused, but reserved for future use). Under GDPR and ePrivacy Directive rules, strictly necessary cookies do not require your prior consent, but all other categories require your explicit consent before we can set them on your device.

4. Strictly Necessary Cookies

Strictly necessary cookies are essential for the website to function. They enable core features such as user authentication, secure communication, load balancing, and protection against security threats. These cookies do not require your prior consent under GDPR and the ePrivacy Directive because they are required to provide the services you have requested.

PostAgency uses the following strictly necessary cookies. Our authentication provider, Supabase, sets cookies with the pattern sb-[project-id]-auth-token to maintain your secure session when you log in. These cookies are first-party and expire when your session ends or after a set period of inactivity. We also set a SUPABASE_SESSION cookie to store your session state, which is a first-party, persistent cookie that expires after approximately 1 hour of inactivity. Our hosting provider, Vercel, may set cookies such as __vercel_ip (to identify your region for performance optimization) and __vercel_runtime (for session identification), which are first-party cookies that persist for short periods. Additionally, we may set a locale preference cookie to remember your language selection (English or French), which is a first-party persistent cookie lasting up to 1 year. These cookies are necessary for you to use PostAgency's services and cannot be disabled without breaking core functionality.

5. Analytics and Performance Cookies

Analytics and performance cookies help us understand how our website is used, identify technical issues, and measure the effectiveness of our content and design. These cookies collect aggregated or pseudonymized data such as page views, click patterns, and error rates. This data does not directly identify you as a person but helps us improve your experience and our services. Analytics and performance cookies require your prior explicit consent before we can set them on your device.

PostAgency may use Vercel Analytics to monitor website performance, identify slow pages, and understand traffic patterns. Vercel Analytics uses first-party cookies and collects data such as page load times, user interactions, and error rates. This data is retained for up to 90 days. We may also implement Google Analytics or similar services in the future. Google Analytics uses third-party cookies to track your visits across our site and (if you are logged into a Google account) across the internet. These cookies are persistent and typically expire after 2 years. All analytics data is treated as pseudonymous and is not linked directly to your personal information unless you explicitly provide it.

You can disable analytics cookies through our cookie consent banner. Please note that disabling analytics cookies does not affect the functionality of our website but helps protect your privacy by preventing your usage data from being tracked.

6. Functional Cookies

Functional cookies enhance your experience by remembering choices you have made during previous visits. Examples include cookies that store your language preference, theme preference (dark or light mode), or other settings that customize how you view the website. These cookies are typically first-party, persistent, and expire after 6 months to 1 year. Functional cookies do not identify you personally and are not used for marketing purposes.

PostAgency may set a theme preference cookie to remember whether you prefer dark or light mode. We may also set cookies to store your language selection (English or French) to avoid prompting you repeatedly. Some functional cookies may be considered 'strictly necessary' if they are required for the website to function correctly, while others may require your consent depending on their purpose. We will indicate in our cookie consent banner which functional cookies require consent.

You can manage functional cookies through your browser settings or through our cookie consent banner. Disabling these cookies will not break the website but may result in a less personalized experience.

7. Marketing and Advertising Cookies

Marketing and advertising cookies are used to deliver targeted advertisements, measure advertising effectiveness, and create user profiles for advertising purposes. At this time, PostAgency does not actively use marketing or advertising cookies. However, we reserve the right to implement such technologies in the future to improve our marketing efforts and provide you with more relevant content. If and when we do use marketing cookies, we will obtain your explicit prior consent.

Marketing cookies are typically third-party cookies set by advertising networks or social media platforms. They allow advertisers to recognize you across websites and deliver ads tailored to your interests. These cookies may persist for extended periods (months or years) and can track your activity across the internet.

If we implement marketing cookies in the future, we will update this policy and ensure that you are informed of any changes. You will always have the right to withdraw your consent and prevent marketing cookies from being set on your device.

8. Third-Party Providers and Data Transfers

PostAgency uses several third-party service providers that may set cookies or process data on your behalf. These providers include: (1) Supabase, our authentication and database provider, which is headquartered in the United States and subject to US data protection laws; (2) Vercel, our hosting and analytics provider, also based in the United States; (3) Stripe, our payment processor, which may set cookies for fraud detection and security; and (4) potentially Google Analytics or similar analytics services.

When you use our website, cookies or data may be transferred to servers in the United States or other countries. These transfers are necessary to provide our services. To the extent required by GDPR and French law, we rely on Standard Contractual Clauses (SCCs) or other mechanisms to ensure that data transfers to the US and other countries provide an adequate level of protection. You acknowledge that US-based servers may be subject to US law and government access requests.

Each third-party provider has its own privacy policy and cookie policy. We encourage you to review these policies to understand how your data is treated. Links to key provider policies are included in the 'Contact and Further Information' section of this policy. We are responsible for our own use of cookies but are not responsible for how third-party providers use their own cookies or data, provided we have instructed them to do so only as necessary to provide our services.

Stripe may set cookies related to payment processing and fraud prevention. If you make a payment through PostAgency, Stripe's cookies may be set on your device. Stripe's privacy and cookie policies govern those cookies. We have ensured that Stripe has signed the necessary data processing agreements to comply with GDPR and French law.

9. Consent and Opt-In/Opt-Out

PostAgency implements a cookie consent banner that is displayed when you first visit our website or when cookies are not yet configured. This banner informs you about our use of cookies and allows you to give explicit consent before non-essential cookies are set on your device.

Under GDPR and the ePrivacy Directive, strictly necessary cookies (such as authentication and security cookies) do not require your prior consent. However, all other cookies (analytics, functional cookies that are not essential, and marketing cookies) require your explicit, informed consent before we can set them. Our consent banner allows you to accept all cookies, reject non-essential cookies, or customize your cookie preferences.

If you choose to accept all cookies, we will set all cookies described in this policy (except those you choose to customize or reject). If you choose to reject non-essential cookies, we will set only strictly necessary cookies. You can customize your preferences by selecting specific categories of cookies to accept or reject.

Consent is stored as a cookie in your browser. Your consent preference will be remembered for up to 1 year, after which we will ask you to confirm your preferences again. This approach ensures that your consent remains fresh and that you have ongoing control over your data.

You can withdraw your consent at any time by visiting our cookie settings page, contacting us at privacy@postagency.ai, or using your browser's cookie management tools. Withdrawing consent does not affect the lawfulness of cookies that were set before your withdrawal.

10. Cookie Table and Detailed Descriptions

Below is a detailed description of each cookie or cookie category that PostAgency uses or may use. This table provides the cookie name (or pattern), the provider, the purpose, the type (first-party or third-party), the duration, and the consent requirement.

Authentication Cookies: Supabase sets a cookie with the pattern sb-[project-id]-auth-token to store your authentication token. This is a first-party, session-based cookie that expires when your session ends or after a period of inactivity (typically 1 hour). This cookie is strictly necessary to keep you logged in and does not require consent. We also set a SUPABASE_SESSION cookie to maintain your session state. This is a first-party, persistent cookie lasting approximately 1 hour, and is strictly necessary.

Hosting and Performance Cookies: Vercel may set cookies such as __vercel_ip to identify your geographic location for performance optimization and __vercel_runtime for session identification. These are first-party cookies with short lifespans (minutes to hours) and are strictly necessary for load balancing and performance. Vercel Analytics cookies are first-party cookies used to track page performance, error rates, and user interactions. These cookies require consent and are retained for up to 90 days.

Locale and Preference Cookies: We set a locale preference cookie (name: locale or lang) to remember whether you prefer English or French content. This is a first-party, persistent cookie lasting up to 1 year. This cookie enhances user experience and may be considered strictly necessary depending on your interaction with the site; however, we typically request consent for this category. We may also set a theme preference cookie (name: theme) to remember your dark or light mode preference. This is a first-party, persistent cookie lasting up to 1 year and is included in our consent request for functional cookies.

Analytics Cookies: If implemented, Vercel Analytics and Google Analytics both set cookies to track your visits and interactions. Vercel Analytics uses first-party cookies retained for 90 days. Google Analytics uses third-party cookies (typically _ga, _gid, and others) that persist for 2 years or more. Both require prior consent. These cookies collect pseudonymized data about page views, click-through rates, and user flows to help us understand website performance and user behavior.

Payment Processing Cookies: Stripe may set cookies related to payment security and fraud prevention if you make a payment. These are typically third-party cookies with varying durations. Stripe's own privacy policy governs these cookies, and we have ensured compliance through data processing agreements.

Consent Management Cookies: We set a cookie to store your consent choices (name: consent-preferences). This is a first-party, persistent cookie lasting up to 1 year. This cookie is strictly necessary because it allows us to honor your preferences and avoid re-prompting you repeatedly. It does not require consent to set.

Summary: You will see requests for consent for Analytics and Performance cookies (Vercel Analytics, Google Analytics), Functional cookies (theme and locale preferences if not essential), and Marketing cookies (if implemented). Strictly necessary cookies (authentication, session, security, consent management) are set without requiring prior consent, as required by law.

11. How to Control and Manage Cookies

You have several options to control and manage cookies. The primary method is through PostAgency's cookie consent banner, which appears on your first visit. You can accept all cookies, reject non-essential cookies, or customize your preferences for specific cookie categories. Your choice is saved as a consent cookie and respected by our website.

You can also manage cookies through your web browser. Most browsers allow you to view, block, or delete cookies. Instructions for managing cookies in popular browsers are available as follows: for Google Chrome, visit https://support.google.com/chrome/answer/95647; for Mozilla Firefox, visit https://support.mozilla.org/en-US/kb/cookies-information-websites-store-on-your-computer; for Safari, visit https://support.apple.com/en-us/HT201265; for Microsoft Edge, visit https://support.microsoft.com/en-us/microsoft-edge/privacy-and-cookies. You can set your browser to refuse cookies, to alert you when a cookie is being set, or to delete cookies automatically when you close your browser.

Please note that disabling strictly necessary cookies may impair or prevent you from using PostAgency's website and services. For example, disabling authentication cookies will prevent you from logging in. Disabling analytics and performance cookies will not break the website but will prevent us from understanding how to improve your experience.

You can also visit our cookie settings page at any time to review or update your preferences. Additionally, you have the right to contact us at privacy@postagency.ai to request information about cookies we have set or to ask us to delete certain cookies.

12. Your Privacy Rights Under GDPR and French Law

If you are located in France or the European Union, your use of PostAgency's website is governed by the GDPR and the ePrivacy Directive. Under the GDPR, you have the right to access, correct, delete, and port your personal data. You also have the right to object to processing and to request that we restrict how we use your data. Finally, you have the right to withdraw consent at any time without affecting the legality of processing based on consent given before withdrawal.

The ePrivacy Directive requires that we obtain your explicit consent before setting non-essential cookies on your device. This is why our consent banner asks for your permission before setting analytics, functional (in some cases), or marketing cookies. Strictly necessary cookies are exempt from this requirement because they are required to provide the service you have requested.

French law (Code civil) and CNIL guidelines establish additional requirements for data protection and cookie management. We comply with all CNIL guidance regarding cookie consent, transparency, and user control.

To exercise your rights under GDPR or French law, please contact us at privacy@postagency.ai with details of your request. We will respond to your request within the timeframe required by law (typically 30 days for GDPR requests).

You also have the right to lodge a complaint with your local privacy regulator if you believe we have violated your privacy rights. In France, the regulator is the CNIL (Commission Nationale de l'Informatique et des Libertés). Links to these authorities are provided in the 'Contact and Further Information' section below.

13. Quebec Law 25 Compliance (For Canadian Users)

For users located in Canada (Quebec), your privacy is protected by Quebec Law 25 (Bill 64), which came into effect in 2025. This law imposes requirements similar to GDPR, including the right to consent to collection and use of personal information, the right to access and correct personal information, the right to delete personal information, and the right to file a complaint with Quebec's privacy regulator.

Under Quebec Law 25, we obtain your explicit consent before setting non-essential cookies on your device. This is why our consent banner asks for your permission before setting analytics, functional (in some cases), or marketing cookies.

To exercise your rights under Quebec Law 25, please contact us at privacy@postagency.ai with details of your request. We will respond to your request within the timeframe required by law (typically 30 days).

You also have the right to lodge a complaint with the Commission d'accès à l'information (CAI) if you believe we have violated your privacy rights. Links to this authority are provided in the 'Contact and Further Information' section below.

14. CNIL Compliance and France-Specific Guidelines

PostAgency is subject to the rules and guidelines established by the CNIL, the French authority responsible for data protection and privacy. The CNIL has published specific guidance on the use of cookies and tracking technologies, which we have incorporated into our practices.

Key CNIL requirements that we follow: (1) We obtain explicit, informed consent before setting any non-essential cookies. Our consent banner clearly explains what cookies we use and why. (2) We provide easy-to-access cookie settings that allow you to manage your preferences without friction or manipulation (dark patterns are prohibited). (3) We do not set tracking cookies (such as analytics cookies) before you have given consent. (4) We respect the 'refusal button' with the same prominence as the 'accept button' so that refusing consent is as easy as accepting it. (5) We clearly identify third-party cookies and explain who operates them. (6) We ensure that our consent mechanism complies with the ePrivacy Directive requirement that consent be specific, informed, and unambiguous.

Additionally, the CNIL advises that session-based authentication cookies and strictly necessary security cookies do not require consent, which is consistent with how we implement our cookie practices. The CNIL also recommends that websites avoid setting a very long expiration date for consent cookies; we set our consent cookies to expire after 1 year, consistent with CNIL guidance.

If you have questions about how we comply with CNIL requirements, you can contact us at privacy@postagency.ai or visit the CNIL's website at www.cnil.fr.

15. Changes to This Cookie Policy

PostAgency may update this Cookie Policy from time to time to reflect changes in our practices, new technologies, or changes in applicable law. We will notify you of material changes by updating the date at the top of this policy and, if required by law, by requesting your consent again for new types of cookies or uses.

Your continued use of the PostAgency website after changes are posted constitutes your acceptance of the updated Cookie Policy, subject to any new consent requirements. We encourage you to review this policy regularly to stay informed about how we use cookies.

If you do not agree with any changes to our cookie practices, you may choose to reject new cookies or withdraw your consent entirely by contacting us at privacy@postagency.ai.

16. Contact and Further Information

If you have questions or concerns about our use of cookies, or if you wish to exercise any of your privacy rights, please contact us using the information below.

PostAgency.ai Privacy Contact: Email: privacy@postagency.ai. Mailing Address: PostAgency, France.

Third-Party Provider Links: Supabase Privacy Policy: https://supabase.com/privacy. Supabase Cookie Policy: See Supabase's privacy documentation. Vercel Privacy Policy: https://vercel.com/legal/privacy-policy. Vercel Security: https://vercel.com/security. Stripe Privacy Policy: https://stripe.com/privacy. Google Analytics Privacy Policy: https://policies.google.com/privacy. Google Analytics Consent Mode: https://support.google.com/analytics/answer/12551846.

Regulatory Authority Links: CNIL (France): www.cnil.fr. CNIL Cookie Guidelines: https://www.cnil.fr/en/publication/cookies. CAI (Quebec, Canada): www.cai.gouv.qc.ca. European Data Protection Board: https://edpb.europa.eu.

Additional Resources: GDPR Text: https://gdpr-info.eu/. ePrivacy Directive: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02002L58-20091219. Quebec Law 25: https://www.cai.gouv.qc.ca/.

Our Data Protection Officer and Privacy Team are available to answer questions about this policy and our data practices at any time.