Cookie Policy

Last updated: 5 October 2026

This page lists the cookies and local storage actually used by the SeebawayhGPT marketing site. We do not name a cookie or service that is not in the code. Cookie management is designed to support Saudi PDPL privacy requirements; legal review is still required.

1. What cookies are

A cookie is a small text file stored by your browser. Some are needed for the page to work. Optional cookies run only after you agree.

2. How you manage your choice

On a first visit you see a banner with three equal actions:

  • Accept All
  • Reject Optional
  • Manage Preferences

You can reopen preferences at any time from Cookie preferences in the footer. Withdrawing consent stops later optional technologies. Withdrawal is not harder than giving consent.

Categories:

  • Necessary: always on, because they run the site or remember this choice
  • Preferences: off until you turn them on
  • Analytics: off until you turn them on
  • Marketing: off until you turn them on

Analytics and marketing tools do not load before consent for that category. Today the only analytics tool is Google Analytics 4, and it loads only after you accept the Analytics category. No marketing pixel is active.

3. The browser consent record

We store your choice in a first-party cookie named sb_consent. It contains only:

  • consent record version (1.0)
  • policy version (1.0)
  • that necessary cookies are on
  • yes/no for preferences, analytics, and marketing
  • the time of the choice as an ISO-8601 timestamp

It does not contain email, name, IP address, precise location, a device fingerprint, a user-agent, or browsing history. It stays in the browser for 365 days. LEGAL REVIEW REQUIRED if the law requires a different period.

If cookie categories or the policy version change in a material way, the previous record is ignored and we ask again.

We do not store an anonymous visitor's consent in a database. The marketing site has no visitor login.

4. Actual inventory

  • sb_consent: first-party cookie, necessary, 365 days. Remembers consent categories.
  • NEXT_LOCALE: first-party cookie, necessary / functional, set when you switch language. Remembers Arabic or English after you choose it. Not an advertising tracker.
  • theme: browser localStorage, necessary / functional, until you clear site data. Remembers light or dark mode after you use the theme control.
  • _ga: first-party cookie set by Google Analytics 4, analytics, up to 2 years. Distinguishes visitors to count visits, pages and approximate country/city. Set only after you accept the Analytics category.
  • _ga_VB75QFBZB0: first-party cookie set by Google Analytics 4, analytics, up to 2 years. Keeps session state for this site's measurement. Set only after you accept the Analytics category.

We do not invent other cookies. There are no marketing cookies in the current code.

5. Third-party connections during a visit

These are not cookies we set, but the browser may contact them:

  • Google Fonts (fonts.googleapis.com and fonts.gstatic.com): load Figtree, Passion One, and Tajawal. Your IP address may reach Google. LEGAL REVIEW / improvement: host the fonts locally to reduce cross-border transfer.

  • Hosting (for example Railway): serves the site and may keep short-lived technical request logs.

  • Brevo and Resend: receive email only if you submit the contact or subscribe form. They are not browse-time cookies.

  • Rate limiting: the server keeps an IP address briefly in memory to stop abuse, then drops it. It is not a cookie.

  • Google Analytics 4 (www.googletagmanager.com, google-analytics.com): measures visitor numbers, pages and approximate country/city, only after you accept the Analytics category. Google signals and ad personalization are disabled (Consent Mode v2 with all advertising signals denied). Approximate location is derived from the IP address; the IP itself is not stored in reports. If you withdraw consent, measurement stops and the _ga cookies are deleted. LEGAL REVIEW: cross-border transfer to Google.

There is no Tag Manager, Meta Pixel, Clarity, Hotjar, or ad pixel.

Other analytics providers in the repo (Plausible, Umami, PostHog, Mixpanel, Pirsch, Vercel) are unused templates. The live provider is Google, and it stays blocked until analytics consent is given.

6. What we do not do

We do not use canvas, browser, or device fingerprinting, or hidden identifiers for cross-site tracking.

7. Your rights

See the Privacy Policy to ask for access, correction, deletion, withdrawal, or a complaint to SDAIA. Contact: hello@seebawayhgpt.io.