Legal
Cookie Policy
Cookies, local storage, providers and consent preferences.
Version 3.0 · Effective 1 October 2026
The tables in §2 and §3 list the cookies and local storage used by the website and the app, with their purposes and storage periods. Google's sign-in prompt, which loads only with your consent, is described in §5.
To change your choices, use Cookie settings in the footer of the website or in the account menu of the app. Further information about the processing of personal data is provided in the Privacy Policy.
Scope. This Cookie Policy explains which cookies and similar technologies, such as local storage, session storage and scripts, are used on manypi.com and app.manypi.com, for what purposes and on what legal basis. §12 of the Privacy Policy explains the related processing of personal data.
Consent requirement. Under § 25(1) TDDDG, storing information on your terminal equipment, or accessing information already stored there, requires your consent, given on the basis of clear and comprehensive information. This applies whether or not the information is personal data.
Exception for strictly necessary storage. Consent is not required where the storage or access is strictly necessary for us to provide a digital service that you have expressly requested (§ 25(2) no. 2 TDDDG).
Data protection law. Where the information stored or accessed is personal data, its further processing also requires a legal basis under the GDPR. This policy states that legal basis for each category.
No use before consent. We do not use any technology that requires consent before you have given that consent. This applies from the first page load and for as long as you have not made a decision.
The consent banner. Our banner offers "Accept all" and "Reject all" as equally prominent buttons at the same level. Rejecting takes one click, as accepting does. Nothing is pre-selected. "Manage preferences" lets you decide separately for each of the two consent categories: analytics (§3) and the Google sign-in prompt (§5).
One decision for both sites. Your decision is stored in the `cc_cookie` cookie on the .manypi.com domain and applies on both manypi.com and app.manypi.com.
Items stored without consent. The table at the end of this section lists the cookies and local storage items that the website and the app store without asking for consent.
Purposes. These items serve to:
- (a)keep you signed in to the app;
- (b)record your consent decision, and your PostHog opt-in or opt-out choice, so that your decision is respected and you are not asked again; and
- (c)remember the interface settings you have chosen in the app and the notices you have dismissed, and detect a change of account so that the previous user's cached preferences are cleared.
Legal basis. Storage and access for the purposes in clause 2.2 are strictly necessary to provide functions that you have expressly requested: signing in, the respecting of your consent decision and the settings you have chosen. They are based on § 25(2) no. 2 TDDDG. Where personal data is processed, the legal basis is Article 6(1)(b) GDPR (performance of the contract) for the authentication session and the interface settings, and Article 6(1)(c) GDPR in conjunction with Article 7(1) GDPR for the consent record, which we keep in order to be able to demonstrate your consent.
No option in the banner. The items in the table cannot be switched off in the consent banner. You can block or delete them in your browser (clause 7.3); blocking the authentication cookie signs you out of the app and prevents it from working.
Sign-up attribution without storage. If the link that brought you to our sign-up page carried campaign (utm) parameters, we record them, together with the page on which you landed, the referring page and the plan you selected, as sign-up attribution with your account. This information travels in the address of the sign-in redirect, not in a cookie or other storage on your device, so § 25 TDDDG does not apply to it. We use it to measure our own marketing channels on the basis of our legitimate interest (Article 6(1)(f) GDPR; see §3 of the Privacy Policy).
Strictly necessary cookies and local storage
| Name | Type and origin | Purpose | Expiry |
|---|---|---|---|
| __ph_opt_in_out_* | localStorage on each ManyPI site | Remembers your PostHog opt-in or opt-out choice; does not itself track activity | Until your choice changes or browser storage is cleared |
| cc_cookie | Cookie on .manypi.com | Records your cookie choice and when you made it, shared across manypi.com and app.manypi.com so that you are asked only once | 1 year |
| sb-*-auth-token | Cookie on app.manypi.com | Authentication session that keeps you signed in | 1 week, rolling |
| manypi:onboarding | localStorage on app.manypi.com | Saves your progress through the product tour so that you can resume it | Until browser storage is cleared |
| manypi:nav-view-mode | localStorage on app.manypi.com | Remembers whether you prefer navigation surfaces as dialogs or full pages | Until browser storage is cleared |
| manypi:editor-toolbar-placement | localStorage on app.manypi.com | Remembers whether the editor toolbar floats or sits inline | Until browser storage is cleared |
| manypi:brand-view:* | localStorage on app.manypi.com | Remembers whether each surface shows all brands or only the current one | Until browser storage is cleared |
| manypi-model-pref | localStorage on app.manypi.com | Remembers the AI model you last selected for an agent | Until browser storage is cleared |
| last-login-user-id | localStorage on app.manypi.com | Detects a change of account so that a previous user's cached preferences are cleared | Until browser storage is cleared |
| credit-alert-dismissed-* | localStorage on app.manypi.com | Remembers that you dismissed a low-credit notice, so that it is not shown again | Until browser storage is cleared |
Providers. We use TWIPLA (TWIPLA GmbH, Germany) and PostHog (PostHog, Inc., United States, with our project hosted in the EU) on manypi.com and app.manypi.com to understand how the website and the app are used and to diagnose problems. The table at the end of this section lists the cookies and storage they use.
Only after consent. Browser tracking starts only after you accept the analytics category. TWIPLA's script is loaded, and PostHog is initialised, only after consent, including on later visits.
Data collected. PostHog records page views, interactions, browser and session identifiers, device and browser information and browser errors. TWIPLA records the pages viewed, the referring page, device and browser characteristics and a truncated IP address.
Session replay. Where Session Replay is enabled, PostHog records how a page changes and how it is used. Page text, input values and element attributes are masked; images, video and canvas elements are blocked; and console logs, request headers and request bodies are not recorded. These measures reduce the exposure of content, but diagnostic details may still contain personal data.
Linking across our sites and to your account. The same PostHog project covers the website and the app, and its first-party cookie on the .manypi.com domain links your consented activity across both. In the app, that activity is associated with your account ID and, where available, your name and email address. This measurement is therefore not anonymous. It does not track you across unrelated websites.
Withdrawal. When you withdraw consent, we stop browser capture, opt you out of PostHog, remove analytics cookies and PostHog storage on the current site, and reload the page so that TWIPLA stops. PostHog's opt-out record may remain so that your choice is respected. A page cannot erase storage that belongs to another site: your decision is applied there when you next load that site, and analytics does not start; PostHog storage written there earlier remains until you clear it, but is neither read nor sent. Deleting browser storage does not delete events already sent to a provider. Retention and erasure are covered by §9 of the Privacy Policy, and your rights by §14 of the Privacy Policy.
Legal basis. § 25(1) TDDDG and Article 6(1)(a) GDPR: your consent, which you can withdraw at any time with effect for the future (§7).
Hosting and transfers. Our PostHog project is hosted in the EU, in Frankfurt. PostHog is a US company, and support or administrative access from outside the EEA may occur under its data processing and transfer terms, as described in §11 of the Privacy Policy. Provider details are listed in §1 of the Sub-processor List.
Server-side events. PostHog also receives operational events and error diagnostics from the app's servers. These events do not use storage on your device and are not controlled by the cookie banner. Their purposes and legal basis are set out in §12 of the Privacy Policy, and your right to object in §14 of the Privacy Policy.
Analytics cookies, set only with your consent
| Name | Type and origin | Purpose | Expiry |
|---|---|---|---|
| ph_*_posthog | PostHog first-party cookie on .manypi.com | Recognises a browser and links consented page views and product activity across manypi.com and app.manypi.com | Up to 1 year, renewed during use; removed when consent is withdrawn |
| ph_* | PostHog localStorage and sessionStorage on each ManyPI site | Stores analytics identity, session and replay state; each site origin keeps its own copy | localStorage: until you withdraw consent on that site or clear browser storage. sessionStorage: until the tab is closed |
| va_*, _va*, visa* | Cookies set by TWIPLA | Distinguish sessions and returning visitors so that we can see which pages are used and where people get stuck | Up to 1 year, per TWIPLA's declaration |
The prompt. On the marketing website (manypi.com) we offer Google's "One Tap" sign-in prompt, through which you can create a ManyPI account, or sign in, with your Google account without leaving the page. The prompt is provided by Google.
Only after consent. The prompt is a separate consent category in our banner ("Sign in with Google"). Nothing described in clauses 5.3 to 5.5 happens until you have accepted that category, including on later visits. If you have not accepted it, the website does not load Google's client and does not contact the app to check whether you are signed in.
Loading of Google's client. Once you have consented, the website loads Google's sign-in client from accounts.google.com. This connects your browser to Google's servers, which receive technical data such as your IP address, information about your browser and the website from which the client is loaded, and allows Google to recognise a Google account you are signed in to in your browser.
Check for an existing session. Before the prompt is shown, the website asks app.manypi.com whether you are already signed in to the app; your browser sends the app's session cookie with that request, if you have one. The answer is kept in your browser's session storage under `manypi:app-signed-in` until you close the tab, so that the check is not repeated on every page. If you are signed in, the prompt is not shown.
The g_state cookie. Google's client sets a cookie named `g_state` on manypi.com. It records the state of the prompt, in particular that you have closed or dismissed it, so that the prompt is not shown to you repeatedly. The table at the end of this section lists both items.
Signing in. Only if you choose an account in the prompt does Google send us a signed identity token containing your Google account identifier, email address, name and profile picture. We use it to create your account or sign you in, and to hand your session over to app.manypi.com (Article 6(1)(b) GDPR; see §3 of the Privacy Policy).
Legal basis. § 25(1) TDDDG and Article 6(1)(a) GDPR: your consent, which you can withdraw at any time with effect for the future (§7). When you withdraw it, the `g_state` cookie is deleted and the page is reloaded, so that Google's client is no longer loaded.
Signing up without the prompt. No other function of the website depends on the prompt. You can create an account or sign in on app.manypi.com, with Google or with an email address, without consenting to the prompt.
Google's processing. Google's own processing is governed by the Google Privacy Policy (policies.google.com/privacy).
Google sign-in prompt, only with your consent
| Name | Type and origin | Purpose | Expiry |
|---|---|---|---|
| g_state | Cookie on manypi.com, set by Google's sign-in client | Remembers that you closed or dismissed the sign-in prompt, so that it is not shown again | Up to 1 year; deleted when consent is withdrawn |
| manypi:app-signed-in | sessionStorage on manypi.com | Remembers for the current tab whether you are already signed in to the app, so that the check runs once | Until the tab is closed |
Technologies we do not use. We do not use:
- (a)Google Analytics, including its `_ga`, `_gid` and `_gat` cookies;
- (b)advertising or retargeting pixels of any kind, including those of Meta, LinkedIn, X, TikTok and Google Ads;
- (c)third-party CAPTCHA services; our CAPTCHA is self-hosted and transmits no data to a third party for verification; or
- (d)tracking across unrelated websites, brokerage of visitor data, or the sale of any of it.
Linking within ManyPI. Consented activity can be linked across ManyPI's own website and app, as explained in clause 3.5.
Microsoft Clarity. Code for Microsoft Clarity is present in our codebase but is disabled and does not load. We will not activate it without first updating this policy and including it in the analytics consent category.
On the website. Use the "Cookie settings" link in the footer. It reopens the preferences dialog, where you can give, change or withdraw consent for each category. Withdrawing consent is as easy as giving it and takes effect immediately.
In the app. Open your account menu and choose "Cookie settings". Your decision is stored on the shared .manypi.com domain, so it applies to both sites when either of them next loads.
In your browser. Every major browser lets you block or delete cookies and other site data in its privacy settings. Blocking the strictly necessary items signs you out of the app and prevents it from working; deleting the consent cookie means that we ask for your decision again.
Effect of withdrawal. Withdrawal takes effect for the future. It does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal (Article 7(3) GDPR). Clause 3.6 describes what happens technically.
Renewal of consent. Our banner carries a revision number. If we add a consent category, or a provider that requires consent, we increase the revision number and ask for your decision again.
Updates. We update this policy when the technologies we use, or their configuration, change.
New consent-based technologies. Where a change introduces a new consent category or a new third-party provider that requires consent, we increase the banner's revision number and ask for renewed consent before the new technology stores or reads any information.
Current version. The version and effective date at the top of this page identify the current policy.
Contact. Enquiries about this policy may be sent to privacy@manypi.com.
Related documents
We already know your next customer
Describe your ideal customer. ManyPI finds validated leads, reaches out, and turns emails into sales.