Cookie Policy

Last updated 31 October 2026

Version 2.9

How we measure this site

We use five measurement tools, and here is exactly what each one does:

Google Analytics helps us understand how people use the site — which pages are visited and how visitors arrive. IP addresses are anonymised and we never send Google your name or email address; events carry an account number, not who you are. In Australia, and in other countries outside the EEA, the United Kingdom and Switzerland, Google Analytics runs in your browser until you turn off Product analytics in Privacy choices. In the EEA, the United Kingdom and Switzerland, and when we cannot tell where you are, it stays off in your browser until you turn it on. Some events our servers record about your account, such as sign-ups, sign-ins, purchases and emails you open, reach Google Analytics whatever you choose.
Meta Pixel and Conversions API tell us when an ad on Facebook or Instagram led someone here, so we can measure whether our advertising works. In Australia, and in other countries outside the EEA, the United Kingdom and Switzerland, this runs until you turn off advertising measurement in Privacy choices. In the EEA, the United Kingdom and Switzerland, and when we cannot tell where you are, it stays off until you turn it on. Whenever your browser sends a Global Privacy Control signal, it stays off. If you have an account and Meta audience matching is on, our server may also send a hash of your confirmed email with the sign-ups and other steps it reports, so Meta can match them to the ad.
TikTok Pixel and Events API tell us when an ad on TikTok led someone here, so we can measure whether our advertising works. In Australia, and in other countries outside the EEA, the United Kingdom and Switzerland, this runs until you turn off advertising measurement in Privacy choices. In the EEA, the United Kingdom and Switzerland, and when we cannot tell where you are, it stays off until you turn it on. Whenever your browser sends a Global Privacy Control signal, it stays off.
Reddit Pixel and Conversions API tell us when an ad on Reddit led someone here, so we can measure whether our advertising works. In Australia, and in other countries outside the EEA, the United Kingdom and Switzerland, this runs until you turn off advertising measurement in Privacy choices. In the EEA, the United Kingdom and Switzerland, and when we cannot tell where you are, it stays off until you turn it on. Whenever your browser sends a Global Privacy Control signal, it stays off.
PostHog is our product analytics tool. It records how features are used and can replay anonymised sessions with all typed input masked, so we can find and fix what is confusing or broken. If you create an account, your activity is linked to it so the product can work and we can support you. In Australia, and in other countries outside the EEA, the United Kingdom and Switzerland, PostHog runs in your browser until you turn off Product analytics in Privacy choices. In the EEA, the United Kingdom and Switzerland, and when we cannot tell where you are, it stays off in your browser until you turn it on. Some events our servers record about your account, such as sign-ups, tasks you complete, purchases and emails you open, reach PostHog whatever you choose.

You can turn analytics and advertising measurement off at any time under Privacy choices (also on our Cookies page), and we honour the Global Privacy Control signal automatically. The full detail — what is collected, how long it is kept, and who processes it — is in our Privacy Policy.

Cookies and device storage, by purpose

Category	Service	Purpose	Your control
Authentication and security	ServiceVirtual Buyers Agent and Supabase	PurposeKeep you signed in, protect sessions, and deliver requested account features.	Your controlNecessary while you use signed-in features; signing out ends the active session.
Privacy choice	ServiceVirtual Buyers Agent	PurposeThe vba:client-consent:v1 local-storage record remembers your analytics and advertising choices, its version, and when it was updated on this device. A matching first-party cookie, vba_consent, holds only those two choices, so our servers can honour them when a page loads. It lasts up to 400 days.	Your controlChange it at any time in Privacy choices, linked in the footer of every page on this site and in Settings > Preferences when you are signed in.
Product analytics	ServicePostHog and Google Analytics 4	PurposeUnderstand page and feature use, product journeys, and technical faults without collecting raw property-evidence text.	Your controlControlled by Product analytics in Privacy choices. Availability before a saved choice depends on the regional policy described below.
Advertising measurement	ServiceVirtual Buyers Agent (first-visit record), Meta, TikTok, Reddit, and Google Analytics 4 for the consent signal only	PurposeMeasure whether VBA advertising contributed to visits, sign-ups, or purchases. When this category is allowed, a first-party cookie called vba_first_touch records the campaign details in the link you arrived from (UTM tags and Meta, Google, TikTok or Reddit click identifiers) and the website that referred you, for up to 90 days, so a later sign-up can be credited to the right campaign. A copy of that record, and the sign-up channel worked out from it (vba_acquisition_channel), is kept in your browser’s storage. The Meta, TikTok and Reddit pixels also set their own first-party cookies on our site (such as _fbp, _fbc, _ttp, ttclid, _rdt_uuid and _rdt_cid) to recognise this browser and the ad you clicked. Withdrawing the choice stops the pixels loading and stops us reading these cookies, but they stay in your browser until they expire or you clear them.	Your controlControlled by Advertising measurement in Privacy choices. Availability before a saved choice depends on the regional policy described below. A Global Privacy Control signal keeps it off. Withdrawing the choice, or a Global Privacy Control signal, removes the first-visit record and the sign-up channel.
Payments	ServiceStripe	PurposePrevent fraud and process a checkout you start.	Your controlUsed only when needed for the requested payment flow.
Product state on this device	ServiceVirtual Buyers Agent	PurposeRemember drafts, wide and narrow view preferences, the board you were looking at (its filters, sort, search, column choices and scroll position, for your account in the current tab only), dismissed guidance, a short note that you have just signed up, used to finish setting up your account, a first-party cookie noting the partner link you arrived through, if any (vba_partner_link, kept for up to 90 days and removed once your account has it), and short-lived cached account or property data when those features are used.	Your controlClear the site data in your browser to remove device-held state; doing so may sign you out or remove unfinished drafts.

Privacy choices

1. What This Policy Covers

Cookies are small files stored by a website or service in your browser. Browser local storage and session storage are related device-storage mechanisms. This policy explains the purposes for which Virtual Buyers Agent and the services it uses may store or read that data. Provider-controlled names, contents and expiry periods can vary by provider configuration, SDK version and browser, so the table on this page describes verified categories rather than claiming an exhaustive list of provider keys.

2. Your Privacy Choices

Necessary services support sign-in, security, requested product features and payment flows and are not switched off by the optional-data control. For a known country outside the EEA, United Kingdom and Switzerland, product analytics and advertising measurement are both on by default until you opt out. For detected EEA, UK and Swiss users, and when the country cannot be determined, both categories stay off until you choose them. Each category is saved as a separate choice, so turning one off never changes the other, and an enabled Global Privacy Control signal keeps advertising measurement off regardless of the regional default. The product remains usable when you reject optional categories. Use Privacy choices, linked in the footer of every page on this site and in Settings > Preferences when you are signed in, to review or change the decision saved on this device.

3. Product Analytics

When Product analytics is enabled, VBA uses PostHog and Google Analytics 4 to understand page and feature use and improve the service. PostHog may also support session replay and redacted technical diagnostics. Analytics events must not include raw property-evidence text. Turning Product analytics off prevents further optional client analytics capture from the refreshed page; it does not claim to erase information a provider received before the change. Limited server-generated operational and transactional events are a separate processing path and do not read this device record.

4. Advertising Measurement

Advertising measurement uses Meta, TikTok and Reddit and is separate from product analytics. Google Analytics 4 also receives your Advertising measurement choice as a consent signal covering advertising storage and advertising use of your data. Ad personalisation is always declined on your behalf and Google Signals stays switched off, so allowing the category does not produce personalised advertising through Google. It follows the regional default described in clause 2, and each category is saved separately, so a Product analytics choice never changes Advertising measurement. When allowed, VBA may load the Meta, TikTok and Reddit pixels to measure whether an advertising visit led to a sign-up, and our servers may tell those platforms when you sign up, take key steps in the product (such as opening your first Insight), or make a one-time purchase, and may tell Meta if that purchase is later refunded. A checkout may carry Meta, TikTok and Reddit browser and click identifiers, your request IP address and browser user agent and, when Product analytics is also allowed, your Google Analytics client identifier, so a resulting purchase can be matched to the advertising visit; it does not add your name, email address or phone number to that attribution metadata. Separately, when this category is allowed and Meta audience matching is on, our server sends Meta a SHA-256 hash of your confirmed email address with the sign-up, investor profile, saved property and subscription events we report. When you sign up by email with this category allowed, we also keep the Meta click and browser identifiers read at sign-up with your account, so those events can be matched to the ad you followed. The Privacy Policy explains both.

5. Necessary Services and Payments

Supabase authentication storage keeps a signed-in session working. Stripe may use cookies or similar technology for fraud prevention and payment processing when you start a checkout. Blocking or clearing necessary site data may sign you out, remove an unfinished draft, or prevent a requested payment flow from working.

6. Managing Device Data

Use “Privacy choices” in VBA to change optional analytics and advertising measurement. You can also inspect, block or clear cookies and site data in your browser settings. Clearing site data removes the VBA privacy-choice record and other browser-held state, after which VBA applies the regional default again until you make another choice. A saved choice is device-specific and is not currently described as an account-wide preference.

7. Third-Party Services

The services named in this policy operate under their own privacy and storage terms. Their technology may use identifiers or storage names that change independently of VBA. The links below provide the providers’ current privacy information.

8. Browser Privacy Signals

VBA treats an enabled Global Privacy Control (GPC) browser signal as an advertising opt-out, so advertising measurement remains off, including checkout attribution, even if an older saved device choice allowed it. Do Not Track (DNT) does not currently create an additional setting beyond the controls described in this policy.

9. Updates to This Policy

We may update this policy when our product, providers or legal obligations change. The “Last updated” date identifies the latest operative revision.

10. Review Status

This policy is written to match how the service works, and it is not a claim that one control satisfies every law in every location. Where applicable law provides stronger rights or requires different handling, those obligations continue to apply.

Third-party policies

The services named in this policy publish their own cookie and privacy information. Those terms govern what each service does with what reaches it, and we cannot vary them on your behalf.

Supabase privacy policy Stripe privacy policy PostHog privacy policy Google privacy policy Meta privacy policy TikTok privacy policy Reddit privacy policy Mapbox privacy policy

Related policies

Questions?

If you have questions about cookies, device storage, or your privacy choices, please contact us.

info@virtualbuyersagent.com.au