Cookie notice
What we store in your browser, why, and what we deliberately don’t.
Autograff, Inc. · Version 2.1 · Last updated August 13, 2026
This Cookie Notice explains how Autograff, Inc. (“Autograff,” “we,” “us”) uses cookies and similar storage technologies on autograff.ai. It reflects the website as currently built and operated, and should be read together with our Privacy Policy.
1. What cookies are
Cookies are small text files placed on your device when you visit a website. Similar technologies — such as browser local storage — perform comparable functions. We refer to all of these as “cookies” in this Notice.
2. What we actually use
The cookies and browser storage used on autograff.ai are listed below. Most are required for the site and application to work, or record a choice you made. The last group is a marketing technology used to recognise business visitors, which operates differently depending on your location — see Section 3.
| Technology | Purpose | Type |
|---|---|---|
| sb-<project>-auth-token (browser localStorage, set by Supabase Auth) | Keeps you signed in to Autograff and refreshes your session securely. Authentication would not work without it. | Strictly necessary |
| sidebar:state (first-party cookie) | Remembers whether the application sidebar is expanded or collapsed. Relevant only inside signed-in application views, not on public pages. | Functional preference |
| c15t (first-party cookie and browser localStorage) | Records your cookie choices and when you made them, so we can honour them and not ask again on every page. Set only where the consent banner is shown. | Strictly necessary |
| _ga and _ga_<id> (first-party cookies, set by Google Analytics 4) | Measure how the website is used: which pages are visited, how visitors arrived, and whether they go on to request a demo. Set only if you accept measurement cookies, and removed if you later withdraw that consent. Our confidential deck pages (autograff.ai/d/…) are excluded entirely. | Analytics — consent required |
| RB2B (a Retention.com service) — first-party cookies (all prefixed _reb2b), plus device identifiers and IP address. Individual cookies listed below. | Identify the business, and in the United States the business contact, behind a visit so we can follow up with relevant business-to-business communications. In the United States this may identify you individually; outside the United States it is limited to the company associated with the visit. Whether it runs by default or only after consent depends on your location — see Sections 3 and 4. Our confidential deck pages (autograff.ai/d/…) are excluded entirely. | Marketing — opt-out (US) / consent (EEA, UK and other consent regions) |
RB2B first-party cookies:
| Cookie name | Expiration | Purpose |
|---|---|---|
| _reb2buid | 360 days | Persistent visitor identification |
| _reb2butk | 1 year | Long-term cross-session identification |
| _reb2bgeo | 20 days | Coarse region derived from IP address, used to apply the correct regional handling. No precise location is collected. |
| _reb2bref | 15 days | Visit attribution (referring URL) |
| _reb2bfxf | 1 month | Internal identification framework |
| _reb2btd | 1 month | Identity resolution |
| _reb2bli | 1 month | Session-to-identity linking |
| _reb2bresolve | 2 days | Temporary identity resolution buffer |
| _reb2bsessionID | 30 minutes | Active session management |
| _reb2bloaded | 1 second | Prevents duplicate script loads |
These are first-party cookies set on our own domain, and they hold opaque identifiers rather than your name or email directly. The longest cookie life is one year, which is separate from the 24-month limit on retaining the contact record itself (see the Privacy Policy). When a visitor opts out, or arrives with a Global Privacy Control signal, these cookies are deleted from the device.
We also count page views using Vercel Web Analytics, provided by our hosting provider. It sets no cookie and stores nothing in your browser: visitors are counted using a temporary identifier derived from the incoming request and discarded within 24 hours, which cannot identify you or follow you across other websites. Our confidential deck pages (autograff.ai/d/…) are excluded entirely.
3. How consent works, and what we don’t use
How we handle non-essential cookies and similar technologies depends on where you are:
- EEA, UK, and other regions where consent is required: we ask first. Our consent banner appears, and the analytics and marketing technologies described in Section 2 stay off until you accept them. Declining leaves the site fully usable — only the measurement and business identification stop.
- United States: we do not show a consent banner. The technologies described in Section 2 may operate by default, and you can opt out at any time (see Section 4).
Wherever you are, if your browser sends a Global Privacy Control (GPC) signal, we treat it as an opt-out of the business visitor-identification described in Section 2, and it does not run.
In all locations, autograff.ai does not set social-media tracking pixels, or third-party advertising cookies used to show you ads on other websites.
We use the visitor-identification described in Section 2 to reach businesses that visit our site, not to show you targeted advertising elsewhere. This may qualify as a “sale” or “share” under US state privacy laws, which define those terms broadly. We treat it as such, and honour opt-out rights as described in Section 4, including a recognised Global Privacy Control (GPC) signal.
4. Managing your choices
In the United States we do not ask for consent before the technologies described in Section 2 run. You can turn them off at any time, in any of the following ways:
- Use the “Your Privacy Choices” link in our footer. This stops further identification on this website, and deletes the _reb2b identifiers already set on your device.
- Send a Global Privacy Control (GPC) signal from your browser. We treat this exactly as we treat the link above, so you do not need to do anything else.
- Opt out directly with the provider at https://app.retention.com/optout. This stops RB2B identifying you through their service generally. It operates at the provider’s end and does not by itself change anything stored on your device by this website.
None of these options delete information we have already collected. To request deletion, see the Privacy Policy at autograff.ai/privacy.
In the EEA, the UK, and other regions where consent is required, use the “Your Privacy Choices” link in the footer to change or withdraw your consent at any time. Withdrawing takes effect immediately: the relevant analytics and marketing scripts stop and are removed from the page, and the marketing identifiers are deleted from your device. It does not undo processing that already took place before you withdrew. If your browser sends a Global Privacy Control signal, we treat it as an opt-out of the business visitor-identification described in Section 2 and it stays off. You can also opt out under the GDPR directly with the provider at https://www.rb2b.com/rb2b-gdpr-opt-out.
You can also clear your browser’s cookies and local storage at any time through your browser settings; doing so will sign you out of Autograff. Blocking strictly necessary storage may prevent parts of the site or application from working.
5. Third-party services
Authentication and backend services for the Platform are provided by our infrastructure subprocessor, Supabase. Our website is hosted by Vercel, which also provides the cookieless analytics described in Section 2. Where you accept measurement cookies, website usage statistics are processed by Google Analytics 4, provided by Google. Business visitor-identification is provided by RB2B (a Retention.com service), on the basis described in Sections 2 and 3. RB2B is a marketing vendor for this website only: it has no access to the Platform or to Customer Data, and is not a Platform subprocessor. Aside from RB2B’s business identification, none of these places advertising cookies or cross-site tracking cookies on autograff.ai on our behalf. The subprocessors we use to provide the Platform are described in our Subprocessor List.
6. Changes to this Notice
We will update this Cookie Notice if our use of cookies changes. The “Last updated” date at the top of the page shows when it was last revised.
7. Contact
Questions about this Cookie Notice can be sent to contact@autograff.ai.
Privacy and data-protection contact: contact@autograff.ai · Autograff, Inc., 131 Continental Dr, Suite 305, Newark, New Castle County, Delaware 19713, USA.
End of Cookie Notice
Questions about this Notice: contact@autograff.ai