Legal
Cookie policy
1. What are cookies
Cookies and similar tracking technologies (web beacons, pixels, local storage) store small amounts of data in your browser or device. We use them as described below.
2. Categories we use
2.1 Strictly Necessary. Required for the Service to function (authentication session cookies, security tokens, load-balancing). These cannot be disabled without losing access.
2.2 Functional. Remember preferences (language, recently used items).
2.3 Analytics. We use Vercel Web Analytics for aggregate usage data (e.g., page load times, feature usage). It sets no cookies.
2.4 Advertising. We do not currently run targeted online advertising or place advertising cookies. If we do in the future, this Policy will be updated and a consent mechanism added.
3. Specific cookies / trackers
| Cookie | Provider | Category | Purpose | Set when |
|---|---|---|---|---|
sb-<project>-auth-token | Supabase | Strictly necessary | Signed-in session. httpOnly. | After sign-in |
aio-role | ScaleAxis | Strictly necessary | Caches the account's role so routing does not re-query on every request. httpOnly. | After sign-in |
aio-has-org | ScaleAxis | Strictly necessary | Records that the account belongs to a workspace. httpOnly. | After sign-in |
aio-platform-admin | ScaleAxis | Strictly necessary | Short-lived platform-administrator check. httpOnly. | Platform administrators only |
__stripe_mid, __stripe_sid | Stripe | Strictly necessary | Payment fraud prevention. | Only on pages that load Stripe |
| Turnstile challenge cookies | Cloudflare | Strictly necessary | Bot protection on the sign-in and sign-up forms. | Sign-in and sign-up pages |
No cookies are set on the marketing pages before sign-in.
4. User controls
4.1 Browser controls. Most browsers allow you to refuse or delete cookies. Doing so may impair the Service.
4.2 Global Privacy Control. We honor the Global Privacy Control browser signal as a valid opt-out preference signal, consistent with California's January 2026 regulations and the laws of the additional U.S. states that recognize universal opt-out mechanisms (Colorado, Connecticut, Delaware, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, and Texas, as of Jan. 1, 2026).
4.3 "Do Not Sell or Share." Requests may be sent by email to privacy@scaleaxis.ai, even though no sale or share currently occurs.
5. Updates
We may update this Policy as we add cookies/trackers. Material changes will be noticed at least thirty (30) days in advance.