Cookie Policy
Effective date: 28 July 2026 · Last updated: 14 October 2026 (v0.6)
This is an English translation of the Polish original (Polityka Cookies), which is the governing version. In the event of any discrepancy between the two versions, the Polish version prevails. Questions: privacy@aideasflow.com.
1. What cookies and similar technologies are
Cookies are small files stored on your device by your browser. We also use similar technologies, such as localStorage (browser storage used, among other things, to keep you signed in) and sessionStorage (browser storage that is cleared when you close the tab). This policy covers the aideasflow.com website and the Aideasflow platform in all its versions (beta.aideasflow.ai, dev.aideasflow.ai).
2. What we use
We ourselves — on our websites and in the application — use only technologies that are necessary for the service to work. We do not set analytics or marketing cookies. The exception is the demo booking calendar embedded on aideasflow.com/demo, which is provided by HubSpot and loads only after you click — we describe it in section 3.
| Name | Provider | Purpose | Type | Duration |
|---|---|---|---|---|
sb-*-auth-token | Supabase (us) | keeping a signed-in user’s session | localStorage, necessary | until sign-out |
i18nextLng | us | remembering the selected language (PL/EN) | localStorage, necessary preference | persistent, until changed |
af_country | us (Aideasflow application) | choosing the application interface language (PL/EN) on your first visit when your browser asks for neither Polish nor English (e.g. it is set to German) — Polish for Poland, English for other countries; set only in that case; value: a two-letter country code (e.g. “DE”), no user identifier; after the first page load the chosen language is stored in i18nextLng | cookie, necessary — interface language of the service you requested | 10 minutes |
aideasflow_device_id | us (Aideasflow application) | a random device identifier for the account device registry — limiting the number of devices using an account at the same time and account security (Privacy Policy, section 2); stored only when the device registry is turned on; it is not a hardware identifier or a device “fingerprint” | localStorage, necessary — account security | persistent, until site data is cleared |
functional application keys (including those with the prefixes aideasflow, changeforge, cf_, hub:) | us (Aideasflow application) | remembering settings and the state of the interface (e.g. theme, selected role or company, open tabs, collapsed sections, notifications read), draft ideas before they are submitted, cached AI assistant hints and company chat lists and the invitation code while you join a company; this data stays on your device and is not used for tracking | localStorage and sessionStorage, necessary — features you use | sessionStorage: until the tab is closed; localStorage: persistent, until removed by the application or site data is cleared |
aideasflow.newsletterSubscribed | us (aideasflow.com website) | remembering that you have subscribed to the newsletter — so that the sign-up window is not shown again | localStorage, necessary | persistent, until site data is cleared |
aideasflow.newsletterDismissed | us (aideasflow.com website) | remembering that you have closed the newsletter sign-up window — so that it is not shown again in the same session | sessionStorage, necessary | until the tab/browser is closed |
af_lang | us (aideasflow.com website) | remembering the website language version (PL/EN) chosen with the PL/EN switcher — on later visits to the home page and aideasflow.com/demo the chosen version opens; set only when you click the switcher; value “pl” or “en” (no user identifier) | cookie, necessary — preference stored at your request | 1 year (or until you delete cookies in your browser) |
__cf_bm | Cloudflare — HubSpot’s infrastructure provider (third-party cookie on HubSpot domains) | protecting the booking calendar against automated traffic (bots); contains encrypted data needed to assess whether traffic comes from a human; not used for cross-site tracking | cookie, necessary — only on the aideasflow.com/demo page, after the calendar has loaded (section 3) | 30 minutes of inactivity |
How we determine the country (af_country). The country code is determined by our hosting provider (Vercel) from the IP address you connect to the application from, as part of handling your request. We do not store the IP address in the cookie. We do not save the country code in our database or link it to your account. The legal basis for this processing is our legitimate interest in showing the service in a language you understand (Article 6(1)(f) GDPR). The aideasflow.com website uses the country in the same way when you open the home page or the aideasflow.com/demo page — if you have not chosen a language version with the PL/EN switcher and your browser language is neither Polish nor English — but does not store it in your browser.
The marketing website (aideasflow.com) loads technical resources (fonts, icons, CSS libraries) from external servers (Google Fonts, Tailwind CDN, cdnjs — Cloudflare) — this involves passing your IP address to these providers, but they do not set cookies. The newsletter sign-up form (and the backup demo request form, if the calendar is unavailable) sends the data entered in it directly to our CRM (HubSpot, hosted in the EU) only once you submit it. Our website loads HubSpot scripts only on the aideasflow.com/demo page and only after you click the “Show calendar” button (section 3).
Necessary technologies do not require consent (Article 399(3)(2) of the Polish Electronic Communications Law — Prawo komunikacji elektronicznej — which implements the ePrivacy Directive) — without them the service cannot work.
3. Demo booking calendar (the aideasflow.com/demo page)
On aideasflow.com/demo we embed a HubSpot Meetings calendar in which you choose the time of your demo yourself. The calendar loads only when you click the “Show calendar” button below the information about HubSpot — clicking it means that you consent to loading the calendar together with the HubSpot scripts described below (Article 399(1) of the Polish Electronic Communications Law). Your consent applies to a single page view and is not stored — we will ask again on your next visit. You can withdraw it at any time by closing or reloading the page (HubSpot’s scripts then stop running); withdrawing consent does not affect the lawfulness of processing carried out before its withdrawal. If you do not consent, the calendar will not load and you can arrange a demo by email. After you click:
- our website loads HubSpot’s embed script (static.hsappstatic.net), which displays the calendar in a separate window (frame) served from meetings-eu1.hubspot.com and passes to it the page address and a one-time visit identifier (created on each visit and not stored in your browser);
- HubSpot scripts run in the calendar window, including HubSpot’s analytics code assigned to our HubSpot account and the “HubSpot” footer. These scripts read basic technical parameters from your browser (e.g. screen resolution, language, an identifier calculated from your browser’s characteristics) and send them to HubSpot together with the address of the page visited and your IP address — this is how HubSpot records the calendar view; part of this technical data goes to HubSpot’s servers in the USA;
- Cloudflare, HubSpot’s infrastructure provider, sets the
__cf_bmcookie (table in section 2) on HubSpot domains: hubspot.com, hubspot.net, hsappstatic.net, hs-scripts.com, hs-analytics.net and hs-banner.com.
In our test of 9 October 2026 (calendar displayed without making a booking), the calendar window did not store any other cookies in the browser — in particular, no HubSpot analytics cookies (__hstc, hubspotutk, __hssc).
HubSpot processes the data you provide when booking (first name, last name, email, selected time slot) on our behalf. HubSpot also uses part of the data collected in the calendar window for its own purposes, as a separate controller. We describe the roles, purposes and legal bases in detail in our Privacy Policy (sections 3 and 5). If you do not want to use the calendar, arrange a demo by emailing sales@aideasflow.com.
4. Analytics and marketing cookies
We do not use them ourselves and we do not run our own analytics or marketing tools on our websites. The exception is HubSpot’s analytics code running in the calendar window on the aideasflow.com/demo page (section 3) — it starts only after you click, and as of 9 October 2026 it does not store analytics cookies in the browser. If we introduce analytics or marketing tools in the future, we will ask for your consent before they are activated (a consent banner on which refusing is as easy as accepting), and this policy will be updated.
5. How to manage cookies
You can delete or block cookies and site data in your browser settings (Chrome, Safari, Firefox, Edge — “privacy” section). Please note that blocking necessary technologies will prevent you from signing in to the platform, clearing site data also removes draft ideas you have not submitted and blocking third-party cookies may prevent the calendar on the aideasflow.com/demo page from working.
6. Changes
The current version of this policy is available at aideasflow.com/cookies (English translation: aideasflow.com/en/cookies); the same version, marked with the same number, applies on the website and in all versions of the platform. We will announce material changes on the website.
← Back to home