Legal
Effective Date: August 26, 2026 · Inventory reconciled against production on the same date
Effective Date: August 26, 2026
This policy lists every cookie, local-storage item and tracker that theaicmo.com and The AI CMO application use, what each is for, how long it lasts and who receives the data. It is maintained by ROGA AI LIMITED (Gibraltar, Company No. 125994) and reconciled against what the site actually sets; the date of the last reconciliation is at the top. How we handle personal data more broadly is in the Privacy Policy.
It does not cover websites of our customers where our SDK is installed: there the customer's own cookie policy and consent banner apply, and our SDK stays silent until that banner reports consent (Privacy Policy, Section 12.3).
On your first visit a banner asks you to choose. Strictly necessary items need no consent. Analytics and Marketing are off by default: nothing from those groups loads, and no cookie from them is set, until you turn them on – "Accept all" and "Reject non-essential" sit side by side, one click each, and "Choose per category" lets you decide each group separately.
You can change or withdraw your choice at any time through Cookie settings in the footer of every page; withdrawing switches the trackers off and removes the cookies and storage they set. We ask again after twelve months, and sooner if this policy changes in substance.
Inside the application. After you sign in no banner is shown: the application needs its strictly necessary storage to work at all. Our own first-party measurement of how the application is used, and Vercel's cookieless page-view analytics, run under our legitimate interest in running the Services (object at privacy@theaicmo.com). Google Analytics, Google Ads, PostHog and our website SDK are never switched on by signing in – only by a choice made in the banner on our public pages.
The record of your choice. Your choice is stored in your browser with the categories, the time, the version of this policy you saw and a random consent identifier. Each grant, change and withdrawal is also recorded on our side with the same details, so we can show that consent was given – without your IP address.
Strictly necessary
No consent asked – the site and the application cannot work without them.
| Name | Purpose | Duration | Recipient |
|---|---|---|---|
| sb-drntwsnqfqvhmrnortna-auth-tokenlocal storage | Keeps you signed in (session and refresh tokens) | Until you sign out or the session expires | Supabase (EU) – our authentication provider |
| theaicmo_cookie_consentlocal storage | Your cookie choice: categories, time, policy version, consent id | 12 months, then asked again | The AI CMO only |
| aicmo_consent_lpo_…local storage | The same choice as read by our website SDK, so it stays silent when you said no | Until cleared | The AI CMO only |
| __ph_opt_in_out_…local storage | PostHog's own record that you opted out, so it stays off after a withdrawal | Until cleared | The AI CMO only (read by the PostHog library in your browser) |
| __stripe_mid, __stripe_sidcookie | Fraud prevention during checkout and on billing pages, set by Stripe.js where it loads | 1 year / 30 minutes | Stripe |
| __cf_bm (on our API domain, supabase.co)cookie | Cloudflare bot management protecting our database and sign-in API; set on the API's own domain, so browsers that block third-party cookies refuse it without any effect on the site | 30 minutes | Cloudflare, on behalf of Supabase (EU) |
| aicmo_brand_sel_…, activeClient_…, ai_cmo_ui_preferences, toolcoach:…local storage | Application preferences: the brand you are working on, collapsed panels, dismissed tips | Until cleared | The AI CMO only |
| ai_cmo_clipboard, ai_cmo_common_data, ai_cmo_field_historylocal storage | The application's clipboard and recently used field values, so forms in the tools can be refilled | Until cleared | The AI CMO only |
Analytics
Off until you accept analytics. Nothing in this group loads or is set before that; withdrawing removes the cookies and storage below. Inside the application, aicmo_sid and Vercel analytics also run for signed-in customers under legitimate interest.
| Name | Purpose | Duration | Recipient |
|---|---|---|---|
| _ga, _ga_PEDZ2F5REKcookie | Google Analytics 4: distinguishes visitors and sessions to measure how the site is used | Up to 2 years (13 months in browsers that cap cookie lifetime) | Google Ireland Ltd / Google LLC (United States) |
| ph_aicmo_ph, ph_aicmo_ph__flagslocal storage | PostHog behavioural analytics through our website SDK: a pseudonymous visitor identifier and cached settings | Until cleared | PostHog Inc. (United States) |
| aicmo_visitor_lpo_…, aicmo_touch_lpo_…local storage | Our own website SDK: a random 12-character visitor identifier and the first/last campaign touch, for attribution of sign-ups to campaigns | Until cleared | The AI CMO only |
| aicmo_sidlocal storage | Our own funnel measurement: a session identifier for the pages and steps of one visit | 30 minutes of inactivity | The AI CMO only (stored in our EU database, no personal identifiers) |
| Vercel Web Analyticscookie | Page views and web vitals – sets no cookie; uses a daily hash that cannot identify you across days | No storage | Vercel Inc. (United States) |
Marketing
Off until you accept marketing. Nothing in this group loads or is set before that; withdrawing removes the cookies below.
| Name | Purpose | Duration | Recipient |
|---|---|---|---|
| _gcl_aucookie | Google Ads conversion linker: attributes a sign-up or purchase to a Google Ads click | 90 days | Google Ireland Ltd / Google LLC (United States) |
| _gcl_lslocal storage | Google Ads: the same attribution information kept in local storage | 90 days | Google Ireland Ltd / Google LLC (United States) |
| test_cookie (on doubleclick.net)cookie | Google Ads checks whether the browser accepts third-party cookies; only once marketing is on | 15 minutes | Google Ireland Ltd / Google LLC (United States) |
Google Analytics and Google Ads run under Google's Consent Mode with every storage type denied until you choose; the Google script is not loaded at all before that. Our own SDK and PostHog start in consent mode and record nothing until analytics is on. Data sent to recipients in the United States is transferred under Standard Contractual Clauses or the EU–US Data Privacy Framework, as described in the Privacy Policy, Section 8.
Your browser can also block or delete cookies and site data; every major browser explains how in its help pages. Doing so does not replace the banner – it is the banner, and Cookie settings, that switch our trackers off – but it clears anything already stored. Blocking strictly necessary storage will sign you out and break the application.
We reconcile this inventory against the live site whenever the site changes and at least quarterly, and update it here; each version is dated and archived. Questions: privacy@theaicmo.com.