Cookie notice
What we store in your browser, why, and what we deliberately don’t.
Autograff, Inc. · Version 2.4 · Last updated October 27, 2026
This Cookie Notice explains how Autograff, Inc. (“Autograff,” “we,” “us”) uses cookies and similar storage technologies on autograff.ai. It reflects the website as currently built and operated, and should be read together with our Privacy Policy.
1. What cookies are
Cookies are small text files placed on your device when you visit a website. Similar technologies — such as browser local storage — perform comparable functions. We refer to all of these as “cookies” in this Notice.
2. What we actually use
The cookies and browser storage used on autograff.ai are listed below. Most are required for the site and application to work, or record a choice you made. The last groups are marketing technologies — one used to recognise business visitors, and advertising cookies used to measure and target our ads — which operate differently depending on your location — see Section 3.
| Technology | Purpose | Type |
|---|---|---|
| sb-<project>-auth-token (browser localStorage, set by Supabase Auth) | Keeps you signed in to Autograff and refreshes your session securely. Authentication would not work without it. | Strictly necessary |
| sidebar:state (first-party cookie) | Remembers whether the application sidebar is expanded or collapsed. Relevant only inside signed-in application views, not on public pages. | Functional preference |
| c15t (first-party cookie and browser localStorage) | Records your cookie choices and when you made them, so we can honour them and not ask again on every page. Set only where the consent banner is shown. | Strictly necessary |
| _ga and _ga_<id> (first-party cookies, set by Google Analytics 4) | Measure how the website is used: which pages are visited, how visitors arrived, and whether they go on to request a demo. Set only if you accept measurement cookies, and removed if you later withdraw that consent. Our confidential deck pages (autograff.ai/d/…) are excluded entirely. | Analytics — consent required |
| RB2B (a Retention.com service) — first-party cookies (all prefixed _reb2b), plus device identifiers and IP address. Individual cookies listed below. | Identify the business, and in the United States the business contact, behind a visit so we can follow up with relevant business-to-business communications. In the United States this may identify you individually; outside the United States it is limited to the company associated with the visit. Whether it runs by default or only after consent depends on your location — see Sections 3 and 4. Our confidential deck pages (autograff.ai/d/…) are excluded entirely. | Marketing — opt-out (US) / consent (EEA, UK and other consent regions) |
| _fbp (first-party cookie, set by the Meta Pixel; expires after 90 days) | Lets Meta recognize the browser across visits so we can measure which of our ads lead to visits and demo requests, and show our ads to people who have visited our site. Records page visits and form submissions, not the contents of any form. Not used on our confidential deck and video pages (autograff.ai/d/… and autograff.ai/v/…). | Marketing — opt-out (US) / consent (EEA, UK and other consent regions) |
| fr (third-party cookie, set by Meta on its own domain; expires after 90 days) | Used by Meta to deliver, measure and improve the relevance of ads, including ours. Present only if your browser already holds it from Meta and the Meta Pixel runs on our site. | Marketing — opt-out (US) / consent (EEA, UK and other consent regions) |
| _gcl_au (first-party cookie, set by the Google Ads tag; expires after 90 days) | Lets Google Ads measure whether a visit that came from one of our Google ads went on to request a call from us. Set only on our ad landing pages (autograff.ai/lp/…). Records the ad click and that a form was submitted, not the contents of any form. | Marketing — opt-out (US) / consent (EEA, UK and other consent regions) |
| Google advertising cookies on Google’s own domains (for example google.com and doubleclick.net) | Used by Google to measure, deliver and improve the relevance of ads, including ours. Present only if your browser already holds them from Google and the Google Ads tag runs on our ad landing pages. | Marketing — opt-out (US) / consent (EEA, UK and other consent regions) |
| _uetsid and _uetvid (first-party cookies, set by the Microsoft Advertising UET tag; expire after 1 day and 13 months), and _uetmsclkid (first-party cookie; expires after 90 days) | Let Microsoft Advertising measure whether a visit that came from one of our Microsoft (Bing) ads went on to request a call from us. Set only on our ad landing pages (autograff.ai/lp/…). Record the ad click, page visits and that a form was submitted, not the contents of any form. | Marketing — opt-out (US) / consent (EEA, UK and other consent regions) |
| Microsoft advertising cookies on Microsoft’s own domains (for example MUID on bing.com) | Used by Microsoft to measure, deliver and improve the relevance of ads, including ours. Present only if your browser already holds them from Microsoft and the UET tag runs on our ad landing pages. | Marketing — opt-out (US) / consent (EEA, UK and other consent regions) |
RB2B first-party cookies:
| Cookie name | Expiration | Purpose |
|---|---|---|
| _reb2buid | 360 days | Persistent visitor identification |
| _reb2butk | 1 year | Long-term cross-session identification |
| _reb2bgeo | 20 days | Coarse region derived from IP address, used to apply the correct regional handling. No precise location is collected. |
| _reb2bref | 15 days | Visit attribution (referring URL) |
| _reb2bfxf | 1 month | Internal identification framework |
| _reb2btd | 1 month | Identity resolution |
| _reb2bli | 1 month | Session-to-identity linking |
| _reb2bresolve | 2 days | Temporary identity resolution buffer |
| _reb2bsessionID | 30 minutes | Active session management |
| _reb2bloaded | 1 second | Prevents duplicate script loads |
These are first-party cookies set on our own domain, and they hold opaque identifiers rather than your name or email directly. The longest cookie life is one year, which is separate from the 24-month limit on retaining the contact record itself (see the Privacy Policy). When a visitor opts out, or arrives with a Global Privacy Control signal, these cookies are deleted from the device.
We also count page views using Vercel Web Analytics, provided by our hosting provider. It sets no cookie and stores nothing in your browser: visitors are counted using a temporary identifier derived from the incoming request and discarded within 24 hours, which cannot identify you or follow you across other websites. Our confidential deck pages (autograff.ai/d/…) are excluded entirely.
3. How consent works, and what we don’t use
How we handle non-essential cookies and similar technologies depends on where you are:
- EEA, UK, and other regions where consent is required: we ask first. Our consent banner appears, and the analytics and marketing technologies described in Section 2 stay off until you accept them. Declining leaves the site fully usable — only the measurement and business identification stop.
- United States: we do not show a consent banner. The technologies described in Section 2 may operate by default, and you can opt out at any time (see Section 4).
Wherever you are, if your browser sends a Global Privacy Control (GPC) signal, we treat it as an opt-out of the business visitor-identification and the advertising technologies described in Section 2, and they do not run.
We and our advertising partners may use cookies, pixels and similar technologies to measure how our ads perform and to show relevant ads, including on other websites and apps. These run only with your consent where consent is required, stop when you opt out or send a GPC signal, and never run on our confidential deck and video pages. Each advertising partner and the cookies it sets are listed in Section 2 before it is used.
We use the visitor-identification and advertising technologies described in Section 2 to reach businesses that visit our site and to measure and target our own ads. This may qualify as a “sale” or “share” under US state privacy laws, which define those terms broadly. We treat it as such, and honour opt-out rights as described in Section 4, including a recognised Global Privacy Control (GPC) signal.
4. Managing your choices
In the United States we do not ask for consent before the technologies described in Section 2 run. You can turn them off at any time, in any of the following ways:
- Use the “Your Privacy Choices” link in our footer. This stops further identification and advertising tracking on this website, and deletes the _reb2b, _fbp, _gcl_au, _uetsid, _uetvid and _uetmsclkid identifiers already set on your device.
- Send a Global Privacy Control (GPC) signal from your browser. We treat this exactly as we treat the link above, so you do not need to do anything else.
- Opt out directly with the provider at https://app.retention.com/optout. This stops RB2B identifying you through their service generally. It operates at the provider’s end and does not by itself change anything stored on your device by this website.
None of these options delete information we have already collected. To request deletion, see the Privacy Policy at autograff.ai/privacy.
In the EEA, the UK, and other regions where consent is required, use the “Your Privacy Choices” link in the footer to change or withdraw your consent at any time. Withdrawing takes effect immediately: the relevant analytics and marketing scripts stop and are removed from the page, and the marketing identifiers we set (_reb2b, _fbp, _gcl_au, _uetsid, _uetvid and _uetmsclkid) are deleted from your device. The fr cookie is set by Meta on its own domain, so we cannot delete it; you can clear it in your browser or manage ad preferences in your Meta account. The same applies to Google’s advertising cookies on its own domains; you can manage them in your Google account’s ad settings. Likewise for Microsoft’s advertising cookies on its own domains; you can manage them in your Microsoft account’s ad settings. It does not undo processing that already took place before you withdrew. If your browser sends a Global Privacy Control signal, we treat it as an opt-out of the business visitor-identification and advertising technologies described in Section 2 and they stay off. You can also opt out under the GDPR directly with the provider at https://www.rb2b.com/rb2b-gdpr-opt-out.
You can also clear your browser’s cookies and local storage at any time through your browser settings; doing so will sign you out of Autograff. Blocking strictly necessary storage may prevent parts of the site or application from working.
5. Third-party services
Authentication and backend services for the Platform are provided by our infrastructure subprocessor, Supabase. Our website is hosted by Vercel, which also provides the cookieless analytics described in Section 2. Where you accept measurement cookies, website usage statistics are processed by Google Analytics 4, provided by Google. Business visitor-identification is provided by RB2B (a Retention.com service), on the basis described in Sections 2 and 3. Advertising measurement and ad targeting are provided by Meta Platforms, Inc. through the Meta Pixel, on the same basis. Measurement of our Google ads is provided by Google through the Google Ads tag, on our ad landing pages only and on the same basis. Measurement of our Microsoft (Bing) ads is provided by Microsoft through the Microsoft Advertising UET tag, on our ad landing pages only and on the same basis. RB2B, Meta, Google (for Google Ads) and Microsoft (for Microsoft Advertising) are advertising and marketing partners for this website only: they have no access to the Platform or to Customer Data, and are not Platform subprocessors. Aside from RB2B, Meta, the Google Ads tag and the UET tag, none of these places advertising cookies or cross-site tracking cookies on autograff.ai on our behalf. The subprocessors we use to provide the Platform are described in our Subprocessor List.
6. Changes to this Notice
We will update this Cookie Notice if our use of cookies changes. The “Last updated” date at the top of the page shows when it was last revised.
7. Contact
Questions about this Cookie Notice can be sent to contact@autograff.ai.
Privacy and data-protection contact: contact@autograff.ai · Autograff, Inc., 131 Continental Dr, Suite 305, Newark, New Castle County, Delaware 19713, USA.
End of Cookie Notice
Questions about this Notice: contact@autograff.ai