Legal

Cookie Policy

Our cookie policy and how we use them

This page describes the cookies and similar technologies this site actually uses today, what each one is for, and how to change your choices. It is written from the site's own configuration rather than from a template, and the items at the end are listed as pending review instead of being filled in with a guess.

Cookies that are always on

These are needed for the site to work at all. They do not build an advertising profile, and they cannot be switched off without breaking the pages they serve.

Sign-in session — keeps you signed in as you move between pages, and is what tells us a request is yours. Set by Supabase, the platform this product runs on.
Language — a cookie named lang remembers whether you asked for English or Arabic, so the site does not switch back on every visit.
Cookie choices — a cookie named aserp_consent records the decision you made about the categories below. It holds nothing but that decision, in the form v1.a1.m0.t followed by a timestamp, and it lasts up to 180 days.
Security — where a challenge is shown on a form, Cloudflare Turnstile sets its own cookie to tell a person apart from an automated script.

Analytics — optional

Analytics tells us which pages people use and where the product confuses them. It is optional, and refusing it changes nothing about what the product does for you.

Microsoft Clarity (project wzbuv1h7mo) records how a page is used — clicks, scrolling, and the address of the page you are on — so we can see where people get stuck. It loads only if you allow analytics, and only on the public pages of this site: the home page, pricing, FAQ, contact, the blog and these policy pages. It is loaded nowhere else. It does not load on one of those pages either if the address you opened it at carries a sign-in code, an invitation token, an email address, something you typed into a search box, or any other credential-like or identifying parameter: that page never starts a recording, for as long as it is open. Clarity reads the address bar for itself, so unlike the tool below we cannot hand it a reduced address, and the only control that works is keeping it out of every page whose address could identify you. So it never runs inside your workspace, whose address contains your account name, and never on a sign-in, invitation, password or first-setup page, a shared report link, a print or PDF view, an administrative page or the content editor. Following a link from the public site into the product is a full page load, which ends the recording with the page it was on. The pages that are not public also do not pass their address on: when you leave one of them, your browser is told to send this site's name alone as the referring page, so the address you came from does not reach Clarity either. Page text is masked in Clarity's own settings for this project, so the words on your screen are not collected; that is a setting in Microsoft's console rather than something in this site's code. What Microsoft does with a recording is governed by Microsoft's own privacy statement.
Google Tag Manager (container GTM-5J7CNMQ3) loads on the same permission, and on more pages than Clarity: everywhere except report pages, print and PDF views, administrative pages, the content editor, machine-only addresses, and any address carrying a sign-in code, an invitation token, an email address, something you typed into a search box, or any other credential-like or identifying parameter. That includes pages inside your workspace, and it is safe there for the reason Clarity cannot match: we build what is sent to it, and what is sent is a generic route template — /home/[account]/aeo/reports, with your account name removed — together with a page address assembled from that same template and a referring address reduced the same way. Tag Manager can in turn load Google Analytics 4; which tags it loads is set in Google's own console rather than in this site's code, and no Google measurement has been switched on there yet.
If you move to a page these tools may not measure — a shared report link, a print or PDF view, an administrative page, or any address carrying a code or a search term — Google is sent an instruction withdrawing every optional permission, and Clarity, on the public pages where it is running at all, is told to stop; returning to a permitted page starts both again. One further thing, stated plainly rather than glossed over: page-view messages are held in a queue inside your browser, and Tag Manager reads that queue from the beginning when it loads, so measurements recorded before it loaded still reach it. Every message in that queue is the reduced kind described above — a route template, never the address as your browser shows it.

Marketing — optional, and unused

We run no advertising, remarketing or social network pixels on this site, and none is loaded today.

The preference exists anyway, because the value of recording a choice is that it is already recorded and already honoured on the day a marketing tag is first considered — not asked for afterwards.

How to change your choices

You can accept or reject analytics and marketing in the notice shown on your first visit, from the cookie preferences link in the site footer, or on your personal settings page, and you can change your mind at any time; withdrawing a permission takes effect immediately, on the click, without reloading the page.

Your choice is stored in the aserp_consent cookie for up to 180 days. Deleting that cookie clears the choice and you will be asked again. Anything we cannot read, cannot understand, or cannot trust — a missing value, a damaged one, one older than 180 days, or one dated in the future — is treated as a refusal. Nothing is ever read as permission by accident.

You can also block or delete cookies in your browser's settings, and Microsoft publishes its own opt-out for Clarity. Blocking the always-on cookies will sign you out and break parts of the site.

When this page changes

We update this page when a tool is added, switched on, or removed. What you are reading describes the site as it is configured now, not as it is planned to be.

Pending owner and legal review

The following are missing deliberately rather than by oversight. Publishing an invented retention period or an invented legal basis would be worse than publishing nothing, so each one is named here until it has been confirmed.