Cookies on this site

This Policy explains the cookies and similar technologies used on marketclue.com, which this Policy calls the "Site", and in the e-mails we send. It says what each of them does and how you control them. It sits alongside the MarketClue Privacy Policy, which explains what we do with the personal data these technologies generate.

"Cookies and similar technologies" means anything that stores information on your device or reads information already stored there: browser cookies, local storage, session storage, pixels and tracking beacons. It also covers tracking that travels in a link rather than in a file, such as the campaign parameters on the address you arrive through and the identifiers in the links of our e-mails. European law treats all of these the same way, so this Policy does too.

Consent before storage. The rule comes from Article 5(3) of the ePrivacy Directive, applied through the law of the EEA country where your device is located. No one may store information on your device, or read what is already stored there, unless you have first been given clear and comprehensive information and have then consented. Consent means a freely given, specific, informed and unambiguous choice, as Articles 4(11) and 7 GDPR define it. There are two exceptions: storage that only serves to transmit a communication, and storage that is strictly necessary for a service you have expressly requested.

Everything on the Site that is not strictly necessary is therefore set only after you have said yes. Closing the banner without choosing is not consent. If you do nothing, only the strictly necessary technologies run and the banner comes back on your next visit.

In practice this means:

• No analytics or advertising technology loads until you consent. Their scripts are not downloaded while the banner is on screen, so none of them can read or write anything on your device. The one third-party script that loads before you choose is the banner's own, fetched from Cookiebot: that request discloses your IP address and browser to Usercentrics A/S in Denmark.
• Rejecting is as easy as accepting. The banner has a "Reject all" control of equal prominence to "Accept all" on the first layer.
• No pre-ticked boxes. Every optional category starts switched off.
• No cookie wall. You can read the whole Site and join the waitlist while refusing every optional cookie.
• You can change or withdraw your choice at any time, as easily as you gave it, using the "Cookie settings" link in the Site footer.
• We keep a record of your choice, because Article 7(1) GDPR requires us to be able to show that you consented. The record holds a consent ID, the date and time in UTC, the categories you accepted or refused, how you made the choice, and a shortened form of your IP address, never the full one.
• The record lives in two places: in the CookieConsent cookie on your device, which lasts twelve months, and in the consent log Cookiebot keeps for us, which we keep for three years. Clearing the cookie removes your copy, which is why the banner then asks again.
• Your consent ID and its date are shown at the bottom of the preference centre, next to a version number. That number is the version of the banner wording you were shown, not the version of this Policy.

Our consent banner is built by MarketClue. It runs on Cookiebot, the consent platform of Usercentrics A/S in Denmark, which records your choice and keeps the consent record behind it. The Site's own code reads that choice and loads nothing in a consent-requiring category until it says yes. It also passes the choice to Google Tag Manager and to Google's Consent Mode, so that Google tags respect it. We use Consent Mode in its basic form. Google's tag is not loaded at all until you have consented, so no measurement request leaves your browser while the banner is open or after you refuse, not even one without cookies. The advanced form, in which Google's tags load first and send anonymous pings before any choice is made, is deliberately not used.

Outside the EEA. Most of our visitors are in the United States, where the law asks for something different. It does not require consent before storage. It requires notice at the moment of collection. It gives you a right to opt out of the sale or sharing of your personal information, and of targeted advertising. And it requires us to recognise a browser opt-out signal. Section 5.4 explains the signal we honour and section 5.5 the choices you have. The "Notice at collection" link in the banner, and the "Do Not Sell or Share My Personal Information" link in the banner and in the Site footer, are where you exercise those rights.

Analytics cookies are not exempt from consent merely because the data is used internally or reported in aggregate. Where an analytics tool identifies an individual browser or device, consent is required. Both of the analytics tools we use do so, and both are therefore consent-gated.

Two rules apply at once. Whether we may store anything on your device at all is decided by Article 5(3) of the ePrivacy Directive. That is the "Consent needed" line on each card. What we may then do with the personal data that storage produces is decided by the GDPR. For the strictly necessary category our basis is our legitimate interest in a Site that works and is not abused, under Article 6(1)(f). For the record of your consent it is our obligation to be able to prove that consent, under Article 6(1)(c). For every other category the basis is your consent, under Article 6(1)(a), and nothing else. If you refuse, or later withdraw, we do not fall back on legitimate interest to keep the processing going. The Privacy Policy, section 6, sets out every purpose, its basis and how long we keep what it produces.

What refusing does not stop. Refusing every optional category stops storage on your device and everything built on it: no analytics identifier, no recording, no advertising cookie. It does not make your visit invisible, and we would rather say so than let you assume it. Our servers log each request with your IP address, the page, the time and your browser's user agent, and keep that log for 30 days to keep the Site available and to stop abuse. If you join the waitlist, we receive the address you typed whatever your cookie choices are. The form works without a single optional cookie.

The Site uses session recording as part of its analytics. This deserves its own section because it goes further than counting page views.

What it does. When you consent to analytics, our analytics provider records your session: the pages you open, how you move your pointer, what you click, how far you scroll, and the technical characteristics of your browser and device. Played back, it looks like a screen recording of your visit.

What it does not do. Text you type into any form field is masked in your browser before the recording is transmitted. The recording never contains what you type, including the e-mail address you enter on the waitlist form. The address you submit reaches us through the form itself, as the Privacy Policy describes, never through the recording. Recording is off entirely unless you consent to analytics.

Why we use it. To see where the Site confuses people, a control nobody finds or a step where people give up, and fix it.

How long we keep it. Recordings are deleted automatically after 30 days.

Your control. Refuse analytics in the banner and no recording is ever made. Withdraw it later via "Cookie settings" and recording stops at that moment. What was recorded before then may already have reached our analytics provider.

Deleting a recording sooner. If you want a recording deleted before the 30 days are up, write to privacy@marketclue.com with the approximate time of your visit and the value of your "ph_[project-key]_posthog" cookie. Recordings are tied to that identifier, not to your name or address, so without it we cannot tell which one is yours. Take a copy of that value before you use the "Delete identifiers already stored" control in the preference centre. That control deletes the identifier and starts a new one, which cuts the link between this browser and anything already recorded.

Recordings are made and stored by PostHog, Inc. in the United States. PostHog acts only as our processor, a "service provider" in the language of US state privacy laws, under a written data processing agreement. It may use the recordings to provide the service to us and for nothing of its own. We do not sell recordings, we do not share them with advertising platforms, and we do not use them to train any AI model. Inside our company they can be watched only by named personnel. See section 10 of the Privacy Policy for the transfer safeguards that apply, and section 10.3 for the extra measures that apply to recordings.

Some technologies on the Site are set by third parties. Where that happens, that third party processes the data on its own terms as well as ours, and not always only on our instructions. Section 7 lists every such party, with a link to its own privacy notice. Which of them acts only for us and which decides for itself is set out in the Privacy Policy, section 9, and the safeguards for data that leaves the EEA in section 10.

Two analytics tools, Google Analytics and PostHog, are loaded by the Site's own code. Advertising tags are deployed through Google Tag Manager, a delivery mechanism rather than a tracker in its own right. It sets no cookie of its own. But loading the container is itself a request to Google that carries your IP address and your browser details, so we make it only after you have accepted analytics or marketing cookies. Reject both and the container is never requested. These rules apply to all of them:

• Every tag in a consent-requiring category is gated behind the choice Cookiebot records. Inside the container, each tag also carries its own consent condition, driven by the Google Consent Mode signals our code updates from that choice, in both directions.
• A tag with no consent condition is not permitted in the container. That is a rule we apply when a tag is added; the container does not enforce it by itself.
• Any tag not listed in section 7 is not authorised to run on the Site. Adding a tag to the container requires the inventory in section 7 to be updated first, and a fresh Cookiebot scan, an automated crawl of the live Site that records what it actually stores, so that the tables can be checked against it.

The tables below are our own record of what the Site can store on your device, and they are the statement we stand behind. Names and durations are the values the vendors publish, and a vendor can change one between releases. The Duration column is how long an item may sit on your device; it is not how long we keep what that item produces. Those periods are set out purpose by purpose in the Privacy Policy, section 6: 30 days for a session recording, at most 14 months for an analytics identifier, three years for the record of your consent.

Cookiebot also scans the live Site and publishes its own declaration, which appears after these tables. It is drawn by a script, so it is missing if your browser blocks it, and it is not part of the exported copy of this Policy. The tables are the list either way. The first scan runs when the Site goes live, and we re-scan and reconcile the tables after every change to the tags we run. If the two ever disagree, write to privacy@marketclue.com: the tables are what we correct, and the scan is how we find out.

We will update this Policy whenever the technologies we use change, and the version line at the top records when. Your consent covers the technologies listed at the time you gave it; a new purpose or a new third party is not covered by it. A change that does not affect what is stored on or read from your device, such as clearer wording, a corrected duration or a new address for us, does not bring the banner back.

Questions about this Policy: privacy@marketclue.com

Controller and operator of the Site, and the company behind "we" and "our" in this Policy: MarketClue LLC, 1441 Brickell Ave., Suite 1018, Miami, FL 33131, United States

Florida Document Number: L26000463790

Registered agent: Standard Rules LLC, 1441 Brickell Ave., Suite 1018, Miami, FL 33131

Representative in the European Union under Article 27 GDPR: MarketClue DevOps s. r. o., Mýtna 7643/42, 811 07 Bratislava – mestská časť Staré Mesto, Slovak Republic. If you are in the EEA, you may raise anything covered by this Policy with our representative at that address, as well as with us or instead of us.

Your rights over the personal data these technologies generate are set out in the Privacy Policy, section 12, and for residents of US states in section 13.3. They are the right to be told what we hold and to receive a copy of it, to have it corrected or deleted, to restrict or object to its processing, and to receive it in a portable form. Write to the address above to exercise any of them.

In the EEA, obligations concerning storage on your device are supervised by the authority each country designates under the ePrivacy Directive, and data protection by its data protection authority. Section 12.3 of the Privacy Policy, "Supervisory authority", says how to complain and to whom.

In the United States, change or withdraw your choices at any time with the "Cookie settings" link in the footer. To opt out of sharing for cross-context behavioural advertising, use the "Do Not Sell or Share My Personal Information" link there, or send a Global Privacy Control signal from your browser, as section 5.4 describes. If you think we have not honoured that choice, write to privacy@marketclue.com.

Last updated: 8 September 2026. Version 1.0.