savien Legal
Cookie Policy
Information on cookies, local storage and similar technologies.
- Document ID
- cookies/en
- Version / Updated
- 2026-09-16
- Effective from
- 16 September 2026
- Contact
- privacy@savien.io
- SHA-256
- e67ecc3aafbdda4c3a93af9734ce38e0933b6562eb970be5964c5f6c4b317278
Last updated: 2026-09-16
This notice describes the production inventory of cookies, local storage and comparable browser technologies used by savien as of 30 July 2026.
The provider and contractual partner is Davis Gabriels Kalnozols, trading under the business name “savien”, Meierberger Str. 14, 31737 Rinteln, Germany (“savien”). Privacy requests may be sent to privacy@savien.io.
1. Choice and Legal Bases
Strictly necessary storage is used to provide the website or application requested by the user. The legal basis for terminal-device access is Section 25(2) No. 2 TDDDG. Subsequent processing relies, depending on its purpose, in particular on Art. 6(1)(b), (c) or (f) GDPR.
Vercel Analytics and Vercel Speed Insights load only after the optional “analytics” category has been expressly allowed. The legal bases are Section 25(1) TDDDG and Art. 6(1)(a) GDPR. “Essential only” and “Allow analytics” are offered with equal prominence; no non-essential category is preselected.
The choice can be changed at any time through the permanently available “Privacy settings” button. Withdrawal takes effect immediately for the future; the page reloads so that previously loaded analytics scripts cannot send further events.
2. Production Inventory
| Name / Technology | Domain / Path | Provider | Purpose and Data | Duration | Category | Section 25 TDDDG | GDPR | Recipients / Third Country |
|---|---|---|---|---|---|---|---|---|
savien_consent (version v1) | current savien domain / / | savien | Stores only v1:essential or v1:analytics so the choice can be applied and reopened. | 180 days | Essential | Section 25(2) No. 2 | Art. 6(1)(c) and (f) | savien; no transfer caused by this cookie alone |
NEXT_LOCALE | current savien domain / / | savien / next-intl | Selected de or en language and locale-correct routing. | 1 year | Essential / functional | Section 25(2) No. 2 | Art. 6(1)(b) and (f) | savien; no transfer caused by this cookie alone |
sb-<project-ref>-auth-token, including technically necessary chunk cookies | current savien domain / / | savien / Supabase | Login, session renewal and protected access; contains authentication and session information. | Technical maximum of 400 days; renewed during an active session and removed on sign-out or invalid session. | Essential | Section 25(2) No. 2 | Art. 6(1)(b) and (f) | savien and Supabase; possible processing outside the EU/EEA under the stated safeguards |
sb-<project-ref>-auth-token-code-verifier or equivalent Supabase PKCE key | current savien domain / / | savien / Supabase | Secures confirmation, magic-link and other authentication flows; contains a technical verifier. | Until the authentication flow completes; technical maximum of 400 days if abandoned. | Essential | Section 25(2) No. 2 | Art. 6(1)(b) and (f) | savien and Supabase; possible processing outside the EU/EEA under the stated safeguards |
savien:remember-login-until in local storage | current savien origin | savien | Used only after the user actively selects “keep me signed in”; stores an expiry timestamp, not credentials. | 30 days or until sign-out/browser-data deletion | User-requested convenience function | Section 25(2) No. 2 | Art. 6(1)(b) | savien; remains in the browser |
| Vercel Analytics and Vercel Speed Insights | no dedicated persistent savien storage entry | Vercel | After consent: page path of an allowlisted public route and technical device, browser and performance values. Query strings and URL fragments are removed. | No persistent browser identifier; server-side retention follows the current Vercel configuration. | Analytics | Section 25(1) | Art. 6(1)(a) | Vercel; possible processing outside the EU/EEA under the stated safeguards |
The <project-ref> pattern is replaced by the Supabase project identifier in use. Auth cookies may be split into numbered chunks due to their size.
3. Analytics Boundaries
Analytics components load only after consent and only for an explicit allowlist of public pages: home, pricing, contact, public legal documents and public documentation.
Dashboard, admin, authentication, setup, API and invitation routes are not directly measured. Email addresses, tokens, user, order, invitation or reference numbers, query strings and URL fragments are not passed to the analytics components. The former internal logged-in page-view tracker is not active in the frontend.
4. Browser Technologies Not in Use
The code and configuration scan of 30 July 2026 found no production use of session storage, IndexedDB, advertising pixels, remarketing, heatmaps or session replay. If any such technology is introduced later, this inventory will be updated before use and prior consent will be obtained where required.
5. Server-Side Usage Statistics
Views of dashboard routes are counted on the server. No information is stored on or read from your terminal equipment. This processing is therefore not a browser technology within the meaning of this notice and Section 25 TDDDG does not apply; it accordingly does not appear in the table above.
Only the route shape is stored, without identifiers and without query strings, and it is deleted after 90 days. Purpose, legal basis and right to object are set out in the "Internal Usage Statistics" section of the Privacy Policy.
6. Further Information
- Privacy Policy
- Subprocessor List
- Privacy contact: privacy@savien.io