Only with your consent. Nothing sneaky.

Small text files a site stores in your browser. Some are strictly necessary for the site to work, some help us understand aggregate usage or measure which ads bring in visitors. On the marketing site we set non-essential cookies only after you accept them via the cookie notice; decline or ignore it, and they are not set. AIR-Tools runs across two domains: the marketing site (air-tools.nl) and the product (app.air-tools.nl). The list below covers both.

On the marketing site (air-tools.nl): no strictly-necessary application cookies are set. The locale (English or Dutch) is encoded in the URL path, not in a cookie. Analytics and advertising cookies are non-essential and are covered in the sections below. On the product (app.air-tools.nl): Supabase Auth session cookies (sb-* family, access token and refresh token, HTTP-only, SameSite=Lax, refreshed on activity), without these you cannot stay logged in. Both domains receive a small set of routing cookies set by the underlying hosting platform (Vercel). Strictly-necessary cookies do not require consent under ePrivacy.

We do not currently set any non-essential functional cookies. If we add any (for example, a UI-preference cookie like a remembered side-panel state, or a locale cookie for cross-session preference), we will list them here and add a consent prompt where required.

We use Vercel Web Analytics on the marketing site for aggregate traffic statistics. It is cookieless and always on: it stores nothing on your device and collects no cross-site identifiers. We also use Google Analytics 4 to understand how visitors use the site. Google Analytics sets cookies (the _ga and _ga_* family) and runs only after you accept analytics cookies. If you decline, Google Consent Mode keeps it in a cookieless mode that stores no identifiers on your device. The product (app.air-tools.nl) runs no analytics product of its own. Vercel infrastructure logs anonymised request metadata (IP, user agent, response code) to operate the platform; this is processing necessary for service delivery, not behavioural analytics.

We measure which ads bring in visitors using Google Ads. After you consent to advertising cookies, the Google tag sets advertising cookies (including the _gcl_* family) to connect an ad click to a demo request. If you decline, these cookies are not set and Google Consent Mode keeps measurement cookieless. Where a visit arrives from one of our ads, we also read the click identifier from the URL (gclid, not a cookie) and send it with your explicit opt-in on the form, so we can attribute a request to a campaign. The demo-request form on /contact submits to our own server, which forwards the lead to HubSpot (our CRM); no HubSpot script runs in your browser and no HubSpot cookie is set.

The marketing site loads Google Tag Manager, which manages Google Analytics 4 and Google Ads; these set cookies as described above and only after you accept them. Stripe Checkout (loaded only on the product when you reach the billing page) sets fraud-prevention cookies (m, __stripe_mid, __stripe_sid) for the duration of the checkout flow; the marketing site embeds no Stripe scripts. Sentry's session-replay cookie is currently disabled. The demo-request form posts to our own server, which relays the lead to HubSpot's API (HubSpot runs in its EU data region, eu1, for us), and cookieless traffic statistics use Vercel Web Analytics.

The cookie notice lets you choose whether we may set analytics and advertising cookies. You can change that choice at any time by clearing this site's cookies in your browser, which brings the notice back. Browser settings also let you delete or block cookies per site. Blocking strictly-necessary cookies on the product will log you out; the marketing site continues to work either way. Because we keep non-essential cookies off by default until you accept them, we set nothing without your consent.

Questions: privacy@air-tools.nl.