# Cookie and Storage Notice

Last updated: 2026-09-16

This notice describes the production inventory of cookies, local storage and comparable browser technologies used by savien as of 30 July 2026.

The provider and contractual partner is Davis Gabriels Kalnozols, trading under the business name “savien”, Meierberger Str. 14, 31737 Rinteln, Germany (“savien”). Privacy requests may be sent to privacy@savien.io.

## 1. Choice and Legal Bases

Strictly necessary storage is used to provide the website or application requested by the user. The legal basis for terminal-device access is Section 25(2) No. 2 TDDDG. Subsequent processing relies, depending on its purpose, in particular on Art. 6(1)(b), (c) or (f) GDPR.

Vercel Analytics and Vercel Speed Insights load only after the optional “analytics” category has been expressly allowed. The legal bases are Section 25(1) TDDDG and Art. 6(1)(a) GDPR. “Essential only” and “Allow analytics” are offered with equal prominence; no non-essential category is preselected.

The choice can be changed at any time through the permanently available “Privacy settings” button. Withdrawal takes effect immediately for the future; the page reloads so that previously loaded analytics scripts cannot send further events.

## 2. Production Inventory

| Name / Technology | Domain / Path | Provider | Purpose and Data | Duration | Category | Section 25 TDDDG | GDPR | Recipients / Third Country |
| --- | --- | --- | --- | --- | --- | --- | --- | --- |
| `savien_consent` (version `v1`) | current savien domain / `/` | savien | Stores only `v1:essential` or `v1:analytics` so the choice can be applied and reopened. | 180 days | Essential | Section 25(2) No. 2 | Art. 6(1)(c) and (f) | savien; no transfer caused by this cookie alone |
| `NEXT_LOCALE` | current savien domain / `/` | savien / next-intl | Selected `de` or `en` language and locale-correct routing. | 1 year | Essential / functional | Section 25(2) No. 2 | Art. 6(1)(b) and (f) | savien; no transfer caused by this cookie alone |
| `sb-<project-ref>-auth-token`, including technically necessary chunk cookies | current savien domain / `/` | savien / Supabase | Login, session renewal and protected access; contains authentication and session information. | Technical maximum of 400 days; renewed during an active session and removed on sign-out or invalid session. | Essential | Section 25(2) No. 2 | Art. 6(1)(b) and (f) | savien and Supabase; possible processing outside the EU/EEA under the stated safeguards |
| `sb-<project-ref>-auth-token-code-verifier` or equivalent Supabase PKCE key | current savien domain / `/` | savien / Supabase | Secures confirmation, magic-link and other authentication flows; contains a technical verifier. | Until the authentication flow completes; technical maximum of 400 days if abandoned. | Essential | Section 25(2) No. 2 | Art. 6(1)(b) and (f) | savien and Supabase; possible processing outside the EU/EEA under the stated safeguards |
| `savien:remember-login-until` in local storage | current savien origin | savien | Used only after the user actively selects “keep me signed in”; stores an expiry timestamp, not credentials. | 30 days or until sign-out/browser-data deletion | User-requested convenience function | Section 25(2) No. 2 | Art. 6(1)(b) | savien; remains in the browser |
| Vercel Analytics and Vercel Speed Insights | no dedicated persistent savien storage entry | Vercel | After consent: page path of an allowlisted public route and technical device, browser and performance values. Query strings and URL fragments are removed. | No persistent browser identifier; server-side retention follows the current Vercel configuration. | Analytics | Section 25(1) | Art. 6(1)(a) | Vercel; possible processing outside the EU/EEA under the stated safeguards |

The `<project-ref>` pattern is replaced by the Supabase project identifier in use. Auth cookies may be split into numbered chunks due to their size.

## 3. Analytics Boundaries

Analytics components load only after consent and only for an explicit allowlist of public pages: home, pricing, contact, public legal documents and public documentation.

Dashboard, admin, authentication, setup, API and invitation routes are not directly measured. Email addresses, tokens, user, order, invitation or reference numbers, query strings and URL fragments are not passed to the analytics components. The former internal logged-in page-view tracker is not active in the frontend.

## 4. Browser Technologies Not in Use

The code and configuration scan of 30 July 2026 found no production use of session storage, IndexedDB, advertising pixels, remarketing, heatmaps or session replay. If any such technology is introduced later, this inventory will be updated before use and prior consent will be obtained where required.

## 5. Server-Side Usage Statistics

Views of dashboard routes are counted on the server. **No** information is stored on or read from your terminal equipment. This processing is therefore not a browser technology within the meaning of this notice and Section 25 TDDDG does not apply; it accordingly does not appear in the table above.

Only the route shape is stored, without identifiers and without query strings, and it is deleted after 90 days. Purpose, legal basis and right to object are set out in the "Internal Usage Statistics" section of the [Privacy Policy](/en/privacy).

## 6. Further Information

- [Privacy Policy](/en/privacy)
- [Subprocessor List](/en/subprocessors)
- Privacy contact: privacy@savien.io