WinFactor Privacy & Cookie Notice

This Privacy & Cookie Notice explains how Ignaz Software B.V. (Ignaz, we, us, or our) processes personal data when you visit our website, use WinFactor, contact us, sign up for an account, book a call, receive marketing from us, or interact with a configurator or quotation request flow created by one of our business customers.

We are established in Zundert, the Netherlands.

This notice is intended to cover our website and WinFactor product for users in the European Economic Area (EEA), the United Kingdom (UK), the United States, and other regions where we operate.

1. Who we are

Controller: Ignaz Software B.V. Registered office: Zundert, the Netherlands Email: [email protected] Website: https://winfactor.app

If you have questions about this notice or our use of personal data, you can contact us using the details above.

1.1 Data Protection Officer

We have appointed a Data Protection Officer (DPO) who acts as a point of contact for data subjects and supervisory authorities on matters relating to the processing of personal data.

DPO contact: [email protected]

You may contact our DPO directly using the email address above for any questions about how we process personal data, or to exercise your privacy rights under Section 9.

2. How this notice works

Depending on how you interact with us, we may act either:

• as an independent controller, where we decide why and how personal data is processed; or
• as a processor (or sub-processor), where we process personal data on behalf of one of our business customers.

2.1 When we act as controller

We generally act as controller for personal data relating to:

• website visitors;
• prospective customers and leads;
• people who contact us by email, form, or phone;
• account holders and billing contacts for WinFactor customers;
• users who create accounts with us directly;
• support contacts;
• newsletter or marketing recipients; and
• analytics, security, and service administration data we collect for our own business purposes.

2.2 When we act as processor

We generally act as processor when our business customers use WinFactor to collect, store, organize, or otherwise process personal data in their own accounts, including data relating to:

• their employees and users;
• their business contacts;
• their prospects and customers; and
• end customers who submit quotation requests or otherwise interact with a configurator made available by our customer.

If we process your personal data on behalf of one of our customers, that customer is responsible for the relevant processing and should provide you with its own privacy information. Our processor role, obligations, and data protection commitments to customers are set out in Schedule 1 (Data Processing Terms) of our Website SaaS Terms.

3. What personal data we collect

The personal data we collect depends on how you interact with us and with WinFactor.

3.1 Data you provide directly

We may collect:

• name;
• company name;
• email address;
• phone number;
• address details;
• account credentials or authentication-related details;
• billing and payment-related information;
• communications you send us;
• support requests and related attachments or messages;
• information submitted through forms, lead generation pages, or booked-call flows; and
• any other personal data you choose to provide.

3.2 Data collected through your use of our website or Services

We may collect:

• device and browser information;
• IP address;
• approximate location derived from IP address;
• log data;
• pages viewed and interactions with our website or Services;
• timestamps and session-related data;
• referral URLs;
• cookie identifiers and similar online identifiers; and
• diagnostic, performance, and security-related information.

3.3 Data processed in customer accounts

When our customers use WinFactor, we may process personal data stored in their account environments, including:

• names and contact details;
• company information;
• quotation request data;
• product configuration selections;
• pricing, quote, and invoice-related information;
• communications and notes; and
• other personal data our customers or their users choose to store or collect using WinFactor.

3.4 Sensitive data

WinFactor is not intended for the routine processing of special categories of personal data or other highly sensitive personal data. Please do not submit such data to our website or Services unless we have expressly agreed otherwise in writing.

3.5 Data we obtain from third parties

In addition to data you provide directly, we may obtain personal data from the following third-party sources, primarily for the purposes of business development, marketing, lead research, and enriching existing contact data:

• professional networking platforms such as LinkedIn and equivalent services, for publicly available business contact information;
• business data enrichment providers, for company and professional contact information associated with a business email address or organization;
• public business registries, including the Dutch Kamer van Koophandel (KVK) and equivalent registries, for company registration data;
• public websites, for publicly available business contact information; and
• referrals and introductions, from partners, existing customers, or mutual contacts.

Categories of personal data we may obtain from these sources typically include: name, job title, business email address, business phone number, company name, company address, company size, industry, LinkedIn profile URL, and similar publicly available professional information. We do not knowingly acquire special category personal data from these sources.

Where we obtain your personal data from a third party, our legal basis is generally our legitimate interest in conducting B2B business development and marketing (see Section 4.5). Where required by applicable law, we will provide you with the additional information required under Article 14 of the GDPR, including the source of the data, within a reasonable period and no later than one month after obtaining the data, or at the latest at the time of our first communication with you.

You can object to our processing of your personal data obtained from third parties at any time by contacting us at [email protected].

4. How we use personal data and our legal bases

Where we act as controller and the GDPR or UK GDPR applies, we rely on one or more of the following legal bases under Article 6 of the GDPR: performance of a contract (Art. 6(1)(b)), legitimate interests (Art. 6(1)(f)), consent (Art. 6(1)(a)), and legal obligations (Art. 6(1)(c)).

Where we rely on legitimate interests, we have assessed that those interests are not overridden by your rights and freedoms. You can object to processing based on legitimate interests at any time — see Section 9.

4.1 To provide our website, accounts, and Services

We use personal data to:

• create and manage accounts;
• authenticate users;
• provide the WinFactor platform and related features;
• facilitate self-onboarding;
• provide customer support; and
• communicate with users about the service.

Legal basis: performance of a contract with the account holder. Where the individual is not the account holder (for example, an Authorized User acting on behalf of the Customer), our legal basis is our legitimate interest in operating our Services and maintaining our commercial relationship with the Customer.

4.2 To process payments and manage subscriptions

We use personal data to:

• process subscriptions and renewals;
• manage invoices and payment records;
• detect and prevent payment fraud; and
• administer free and paid plans.

Legal basis: performance of a contract with the Customer, legal obligation (for invoice retention, VAT, and tax-record keeping under Dutch law), and legitimate interest in preventing payment fraud and maintaining accurate financial records.

4.3 To operate, secure, and improve our website and Services

We use personal data to:

• monitor uptime, errors, and technical performance;
• protect against unauthorized access, fraud, abuse, and misuse;
• troubleshoot and debug issues;
• perform backups and restore functions;
• measure usage and engagement;
• improve features, design, usability, and reliability; and
• maintain internal records and operational controls.

Legal basis: legitimate interest in operating a secure, reliable, and continually improving Service, and legal obligation (for security and breach-response obligations under the GDPR and other applicable laws). For non-essential analytics and similar technologies on our website, we rely on consent where required (see Sections 10–12).

4.4 To respond to enquiries and book calls

We use personal data to:

• respond to contact requests;
• provide demos or sales information;
• schedule and manage booked calls; and
• follow up on enquiries.

Legal basis: taking steps at your request prior to entering into a contract (pre-contractual measures, Art. 6(1)(b)), or our legitimate interest in responding to business enquiries and developing our customer base.

4.5 To send product, service, and marketing communications

We may use personal data to send:

• onboarding and administrative messages;
• service announcements and product updates;
• newsletters and industry content;
• event invitations; and
• marketing communications about WinFactor and related products or services.

Legal basis:

• Performance of a contract, for administrative and service-related messages to account holders.
• Legitimate interest in promoting our products to business contacts, where we direct marketing to a business email address at an organization we have reasonably identified as a potential customer of a B2B sales configurator (for example, window dealers and related businesses), consistent with applicable direct-marketing rules including the Dutch Telecommunications Act (Telecommunicatiewet) Article 11.7 and equivalent rules in other jurisdictions.
• Consent, where required by applicable law (for example, for marketing emails to individuals who are not business contacts, or in jurisdictions that require opt-in consent for B2B marketing).

Every marketing email we send includes a clear opt-out (unsubscribe) link. You can opt out of marketing communications at any time by using the unsubscribe link, by contacting us at [email protected], or by replying to the email asking us to stop. Opting out of marketing does not affect service-related or transactional messages that are necessary to operate your account.

4.6 To comply with legal obligations and protect our rights

We may use personal data to:

• comply with tax, accounting, and legal requirements;
• respond to lawful requests from authorities;
• enforce our agreements;
• establish, exercise, or defend legal claims; and
• protect our rights, users, systems, and business.

Legal basis: legal obligation (for tax, accounting, and compliance requirements), and legitimate interest in protecting our business and enforcing our rights.

4.7 No automated decision-making with legal or similarly significant effects

We do not use personal data to make decisions based solely on automated processing that produce legal effects or similarly significantly affect you, within the meaning of Article 22 of the GDPR.

The WinFactor Services may generate product configurations, quotes, price estimates, and similar outputs through algorithmic rules configured by our customers (the window dealers who use WinFactor). These outputs are non-binding estimates presented to support a human decision by our customer. Our customer remains responsible for reviewing outputs, confirming quotations, accepting orders, and issuing invoices, and no purchase, invoice, or binding commitment is created without an affirmative, manual action by our customer.

If you have questions about how automated processing is used within WinFactor in a specific context, you can contact us at [email protected].

5. When we process personal data on behalf of customers

Our customers may use WinFactor to collect and manage personal data relating to their own employees, contacts, prospects, and end customers. In those cases:

• our customer is generally the controller;
• we process the data on the customer's behalf under our Website SaaS Terms and embedded data processing terms; and
• the customer is responsible for providing notices and obtaining consents where required.

If you are an end customer or contact of one of our customers and want to exercise your privacy rights relating to data in that customer's account, you should normally contact that customer first.

6. Who we share personal data with

We may share personal data with:

• hosting and infrastructure providers;
• authentication and identity providers;
• payment processors;
• analytics providers;
• marketing, CRM, and communications providers;
• support and productivity tools;
• professional advisers such as lawyers, accountants, auditors, and insurers;
• corporate affiliates or successors in the event of a merger, acquisition, financing, reorganization, or sale of assets; and
• regulators, courts, law enforcement, or other authorities where required by law or necessary to protect rights or safety.

6.1 Current core providers

Our current core providers include:

• Hetzner Online GmbH (Germany) for hosting and infrastructure;
• Clerk, Inc. for authentication and account management; and
• Stripe, Inc. for payment processing.

We may also use additional analytics, communications, CRM, scheduling, or support tools from time to time.

6.2 Sub-processor list for customer account data

When we act as a processor on behalf of our customers (see Section 2.2 and Section 5), we maintain a current list of sub-processors that process personal data on behalf of customers. The list is made available through the Services, on our website, or by another means reasonably accessible to customers, and is kept up to date in accordance with Schedule 1 (Data Processing Terms) of our Website SaaS Terms.

6.3 No sale or sharing of personal data for cross-context behavioral advertising

We do not sell personal data, and we do not share personal data for cross-context behavioral advertising, as those terms are defined under the California Consumer Privacy Act (CCPA/CPRA) and equivalent U.S. state privacy laws. We have not sold or shared personal data for those purposes in the preceding twelve (12) months.

We also do not knowingly sell or share personal data of minors under 16 years of age.

7. International data transfers

We are based in the Netherlands, and we may process personal data in the EEA, the UK, the United States, and other countries where we or our service providers operate.

Where required by applicable law, and where personal data is transferred to a country that is not subject to an adequacy decision or adequacy regulation, we use appropriate safeguards such as:

• the European Commission's Standard Contractual Clauses;
• the UK International Data Transfer Addendum to the SCCs; or
• another valid transfer mechanism recognized under applicable law.

You can contact us if you would like more information about the safeguards we rely on for international transfers.

8. Data retention

We retain personal data only for as long as reasonably necessary for the purposes described in this notice, including to provide the Services, maintain our business records, comply with legal obligations, resolve disputes, and enforce agreements.

The retention periods below are general guidelines. Actual retention may be shorter where the data is no longer needed, or longer where required by law or needed to exercise or defend legal claims.

8.1 Account and subscription data

• Active accounts: for the duration of the account.
• After account closure or subscription termination: generally retained for up to two (2) years after account closure to manage winding-down, handle disputes, and respond to enquiries, after which the data is deleted or anonymized.

8.2 Billing, invoice, and tax records

• Retained for seven (7) years after the end of the relevant financial year, as required by Dutch tax law (Article 52 of the Dutch General State Taxes Act / Algemene Wet inzake Rijksbelastingen), and for equivalent periods in other jurisdictions where applicable.

8.3 Customer account data processed on behalf of customers

• Processed in accordance with the customer's instructions and our Website SaaS Terms, including Schedule 1 (Data Processing Terms).
• On termination or expiry of a paid subscription, customer account data is made available for export for thirty (30) days. After the export window, we delete customer data from active production systems within ninety (90) days, and from routine backups no later than one hundred eighty (180) days after the end of the export window, except to the extent retention is required by law, reasonably necessary to investigate or defend claims, or reasonably necessary to protect the security and integrity of the Services.

8.4 Support and communication records

• Support tickets, email correspondence, and related communications are retained for three (3) years after the matter is closed, to maintain business records and handle follow-up issues or disputes.

8.5 Prospect, lead, and marketing contact data

• Contacts obtained from third-party sources (see Section 3.5) or through enquiries are retained for two (2) years after the last meaningful interaction, unless the individual objects to processing or requests deletion sooner.
• Records demonstrating marketing consent (or opt-out) are retained for three (3) years after the consent or opt-out was given, to demonstrate compliance with applicable direct-marketing rules.

8.6 Website analytics, logs, and security data

• Website analytics (non-aggregated): retained for up to twenty-six (26) months, consistent with standard analytics-tool defaults.
• Cookie-consent records: retained for up to twelve (12) months, after which consent may be re-requested.
• Application and security logs: retained for up to twelve (12) months for security monitoring, incident investigation, and troubleshooting purposes.

8.7 Legal and enforcement records

• Where we process personal data to establish, exercise, or defend legal claims, we retain the relevant data for the duration of the applicable limitation period under Dutch or other applicable law, and for a reasonable period thereafter.

8.8 Aggregated and anonymized data

• We may retain aggregated or anonymized data indefinitely, provided that the data is anonymized such that no natural person is identifiable from it (see our Website SaaS Terms, Section 9.4).

9. Your privacy rights

Depending on where you are located and subject to applicable law, you may have rights such as the right to:

• access your personal data;
• correct inaccurate or incomplete personal data;
• request deletion of your personal data;
• restrict or object to certain processing, including processing based on legitimate interests and processing for direct marketing;
• withdraw consent where processing is based on consent (withdrawal does not affect the lawfulness of processing before the withdrawal);
• request portability of your personal data in a structured, commonly used, machine-readable format; and
• lodge a complaint with a supervisory authority.

9.1 EEA and UK users (GDPR / UK GDPR)

If the GDPR or UK GDPR applies to you, you have the rights listed above, and in particular the right to object to processing based on legitimate interests (including direct marketing). You also have the right to lodge a complaint with your local supervisory authority.

In the Netherlands, you can complain to the Autoriteit Persoonsgegevens (AP), Bezuidenhoutseweg 30, 2594 AV Den Haag. In the United Kingdom, you can complain to the Information Commissioner's Office (ICO).

9.2 United States users

Depending on your state of residence, U.S. state privacy laws (including the California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA), and equivalent laws in Colorado, Connecticut, Virginia, Utah, Texas, and other states as they come into effect) may provide you with additional rights. Because WinFactor is primarily a B2B service, some state privacy laws may apply only in limited contexts (for example, to employment or consumer-facing interactions rather than purely business-to-business communications), and some exemptions may apply.

9.2.1 Categories of personal information we collect (California notice-at-collection)

In the preceding twelve (12) months, we have collected the following categories of personal information, as defined by the CCPA/CPRA:

• Identifiers (for example, name, email address, phone number, postal address, account identifiers, IP address);
• Customer records (for example, billing address, payment-related information);
• Commercial information (for example, subscription details, transaction history);
• Internet or network activity information (for example, browsing and interaction data on our website and Services, log data);
• Geolocation data (approximate, from IP address);
• Professional or employment-related information (for example, job title, company, business contact details obtained from third-party sources as described in Section 3.5);
• Inferences drawn from the above, where used for analytics and service improvement.

We do not knowingly collect sensitive personal information (as defined by the CCPA/CPRA) for the purpose of inferring characteristics about consumers, and we do not use or disclose sensitive personal information except for purposes permitted without the right to limit under the CCPA/CPRA.

9.2.2 Sources and purposes

The sources and purposes of the personal information we collect are described in Sections 3, 3.5, and 4 above.

9.2.3 No sale or sharing

As stated in Section 6.3, we do not sell personal information and we do not share personal information for cross-context behavioral advertising. We have not sold or shared personal information in the preceding twelve (12) months.

9.2.4 Your U.S. privacy rights

Subject to applicable law and to applicable B2B exemptions, you may have the following rights:

• Right to know / access the personal information we have collected about you, including categories, sources, purposes, and recipients;
• Right to delete personal information we have collected from you;
• Right to correct inaccurate personal information;
• Right to opt out of sale or sharing (not applicable, because we do not sell or share — see Section 6.3);
• Right to limit the use and disclosure of sensitive personal information (not applicable in the manner triggering this right, because we do not use sensitive personal information for purposes beyond those expressly permitted by the CCPA/CPRA);
• Right to non-discrimination — we will not discriminate against you for exercising any of these rights;
• Right to appeal a decision regarding a rights request, where required by applicable state law; and
• Right to use an authorized agent to submit a request on your behalf, subject to verification.

9.2.5 How to submit a U.S. privacy request

You can submit a request by contacting us at [email protected]. We may need to verify your identity before responding, and for authorized-agent requests we may require documentation demonstrating that the agent is authorized to act on your behalf.

9.3 How to exercise your rights

You can exercise your rights by contacting us at [email protected]. We may need to verify your identity before responding, and we may ask you for information sufficient to confirm that the request relates to your personal data.

We will respond to rights requests within thirty (30) days of receipt (or within forty-five (45) days for requests under the CCPA/CPRA). Where a request is particularly complex or where we have received a large number of requests, we may extend the response period by up to an additional sixty (60) days (GDPR) or forty-five (45) days (CCPA/CPRA), and we will inform you of the extension and the reasons for it.

There is no fee to exercise your rights, except where permitted by law for manifestly unfounded or excessive requests.

If we process your personal data on behalf of one of our customers (see Section 2.2 and Section 5), we may direct your request to that customer or ask you to contact them directly, and we will provide reasonable assistance to that customer in responding to your request.

10. Cookies and similar technologies

We use cookies and similar technologies such as scripts, tags, local storage, and pixels on our website and, where relevant, within our Services.

These technologies help us:

• keep the website and Services working;
• remember preferences and settings;
• secure accounts and sessions;
• understand how people use our website and Services;
• improve performance and usability; and
• measure and support marketing activities where permitted.

11. Categories of cookies and similar technologies we use

11.1 Strictly necessary cookies

These are required for the operation, security, and core functionality of the website or Services. They may include cookies or similar technologies used for:

• authentication;
• login sessions;
• load balancing;
• fraud prevention;
• security controls; and
• remembering privacy choices.

Because these technologies are necessary for the website or Services to function properly, they cannot be turned off through our cookie settings tool.

11.2 Functional cookies

These help remember preferences, improve usability, and provide enhanced but non-essential features.

11.3 Analytics cookies

These help us understand how visitors and users interact with our website and Services, such as which pages are visited, how features are used, where errors occur, and how performance can be improved.

In the EEA, the United Kingdom, and other jurisdictions that require consent for non-essential cookies, we obtain your consent before placing analytics cookies or using similar analytics technologies.

11.4 Marketing cookies

These may be used to measure campaign effectiveness, personalize marketing, or track interactions across websites or services.

In the EEA, the United Kingdom, and other jurisdictions that require consent for non-essential cookies, we obtain your consent before placing marketing cookies or using similar technologies.

12. Cookie choices and consent

In the EEA, the United Kingdom, and other jurisdictions that require prior consent for non-essential cookies and similar technologies (under the ePrivacy Directive, the Dutch Telecommunications Act (Telecommunicatiewet), the UK Privacy and Electronic Communications Regulations, and equivalent rules), we obtain your prior consent before placing or using non-essential cookies or similar technologies.

You can manage your preferences by:

• using our cookie banner or consent manager when it appears;
• changing your cookie preferences at any time via the cookie settings link on our website;
• changing your browser settings; or
• clearing stored cookies from your device.

You can withdraw your consent at any time, and withdrawal will take effect going forward (it does not affect the lawfulness of processing before the withdrawal).

If you reject or disable certain cookies, some optional features may not work properly.

13. Browser controls and do-not-track

Most browsers let you control cookies through their settings. You can usually delete cookies, block certain cookies, or configure alerts when cookies are placed.

Because there is no uniform standard for browser-based Do Not Track signals, our website may not respond to such signals unless and until a recognized legal or technical standard applies.

14. Third-party websites and services

Our website or Services may contain links to third-party websites, plug-ins, or services. We are not responsible for the privacy practices of those third parties. We encourage you to review their privacy notices before sharing personal data with them.

15. Children's data

Our website and Services are not directed to children, and we do not knowingly collect personal data directly from children.

For the purposes of this notice, a "child" means a person under the age of sixteen (16) in the Netherlands and the European Economic Area (consistent with Article 8 of the GDPR as implemented in the Netherlands), under the age of thirteen (13) in the United States (consistent with the Children's Online Privacy Protection Act, COPPA), and as otherwise defined by applicable local law.

However, our customers may use WinFactor in ways that allow consumers to submit quotation requests or contact details to them. If personal data relating to a child is submitted through a customer's use of WinFactor, our role will usually be limited to processing that data on behalf of the customer, and the customer is responsible for any required age verification and parental consent.

If you believe that personal data relating to a child has been provided to us inappropriately, please contact us at [email protected] and we will take reasonable steps to delete the data.

16. Security

We use reasonable technical and organizational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or unauthorized access, taking into account the state of the art, the costs of implementation, the nature of the processing, and the risks to individuals.

These measures may include:

• encryption in transit (for example, TLS for data transmitted between your device and our Services);
• encryption at rest where appropriate;
• access controls and role-based permissions, so that personnel have access only to the data they need;
• multi-factor authentication for administrative access;
• logging and monitoring of access to and changes within our systems;
• regular backups and tested restore procedures;
• secure hosting — our primary infrastructure is provided by Hetzner Online GmbH in Germany (EEA);
• security governance, including internal policies, personnel confidentiality obligations, and incident response procedures; and
• contractual safeguards with sub-processors, including obligations that are no less protective than those we accept toward our customers.

In the event of a personal data breach, we will notify the relevant supervisory authority and affected individuals to the extent required by applicable law.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

17. Changes to this notice

We may update this Privacy & Cookie Notice from time to time to reflect changes in our practices, in applicable law, or in the Services.

When we make changes, we will update the effective date at the top of this notice and post the updated version on our website. If we make material changes — for example, changes to the categories of personal data we collect, the purposes for which we use it, the legal bases we rely on, or the categories of recipients — we will provide additional notice before the changes take effect, such as by:

• sending an email to account holders and registered contacts;
• displaying a prominent notice on our website or within the Services; or
• another means reasonably designed to reach affected individuals.

Where required by applicable law, we will provide the notice period required by law, and we will request renewed consent where required (for example, for cookies or other consent-based processing).

You can access historical versions of this notice by contacting us at [email protected].

18. Contact us

If you have questions, requests, or complaints about this Privacy & Cookie Notice or our handling of personal data, contact us at:

Ignaz Software B.V. Zundert, the Netherlands Privacy email: [email protected] Data Protection Officer: [email protected] Website: https://winfactor.app

If you are located in the Netherlands, you also have the right to lodge a complaint with the Autoriteit Persoonsgegevens (AP). If you are located in another EEA country, you may complain to your local data protection authority. If you are located in the UK, you may complain to the Information Commissioner's Office (ICO). If you are located in a U.S. state with applicable privacy law, you may contact your state attorney general or the relevant privacy agency (for example, the California Privacy Protection Agency).

---

Annex A – Cookie List

This annex lists the cookies and similar technologies currently used on our website and within our Services. We may update this list from time to time as we add, remove, or change tools.

You can manage your cookie preferences at any time using the cookie settings link on our website. In the EEA, the UK, and other jurisdictions that require prior consent for non-essential cookies, non-essential cookies are only placed after you give consent through our consent banner.

A.1 Strictly necessary cookies

These cookies are required for the operation, security, and core functionality of the website and Services. They cannot be turned off through our cookie settings tool.

Cookie	Provider	Purpose	Duration
__session	Clerk, Inc.	Authenticated session token (JWT) used to keep you signed in	Short-lived (approximately 60 seconds); seamlessly refreshed while you are signed in
__refresh_<id>	Clerk, Inc.	Refresh token used to renew your session	Duration of your authenticated session
__client_uat	Clerk, Inc.	Client authentication timestamp used for session management	Duration of your authenticated session
__client_uat_<id>	Clerk, Inc.	Instance-specific client authentication timestamp	Duration of your authenticated session
__stripe_mid	Stripe, Inc.	Merchant identifier used for payment fraud prevention	1 year

A.2 Functional cookies

These cookies help us remember your preferences and provide a better experience. Depending on the jurisdiction, they may require consent.

Cookie	Provider	Purpose	Duration
NEXT_LOCALE	Ignaz Software B.V. (set by our website)	Remembers your selected language preference	1 year

A.3 Analytics cookies (consent required in the EEA and UK)

These cookies help us understand how visitors interact with our website and Services.

Cookie	Provider	Purpose	Duration
_ga	Google LLC (Google Analytics 4)	Distinguishes unique users	2 years
_ga_<container-id> (for example, _ga_7CGK1Q8F26)	Google LLC (Google Analytics 4)	Persists session state for Google Analytics 4	2 years

Google Analytics data is transferred to the United States. See Section 7 for information about international data transfers.

Our Google Analytics configuration includes the following privacy-enhancing measures:

• IP anonymization — IP addresses are anonymized and are not stored in full or processed in identifiable form;
• Google Consent Mode v2 — analytics tags only collect data after you have given consent through our consent management platform, and consent signals are passed to Google so that Google Analytics behaves in accordance with your choices; and
• Standard Contractual Clauses and Google's Data Processing Amendment — for the transfer of analytics data to Google in the United States.

A.4 Integration cookies

Cookie	Provider	Purpose	Duration
pscd	Set in connection with our ActivePieces workflow-automation integration	Attribution or integration-state data relating to our ActivePieces integration	Subject to the integration's configuration; typically up to 90 days

Depending on the nature of your interaction with our website and the ActivePieces integration, this cookie may be categorized as functional or marketing. Where consent is required under applicable law, it is only placed after you give consent through our consent management platform.

A.5 Marketing cookies

We do not currently place marketing cookies on our website, other than any cookies set in connection with integrations as described in Section A.4. If we introduce additional marketing cookies in the future, we will update this annex and obtain your consent where required.

A.6 Consent management

We use a consent management platform on our website to obtain, record, and manage your cookie preferences where consent is required under applicable law. The consent management platform stores a cookie or similar record on your device to remember your choices and to apply them on subsequent visits.

You can change or withdraw your consent at any time through the cookie settings link available on our website.