Privacy

Cookie Policy

Last updated: 8 September 2026

We keep this simple: InvesTTable uses the cookies needed to keep your session secure and your preferences intact, plus optional analytics and marketing cookies that we set only after you opt in. No advertising networks, no data brokers.

Strictly necessary cookies

These cookies are essential for the platform to function. They maintain your authenticated session via Supabase and remember whether you chose to stay logged in. If you choose "Stay signed in" at login, your session remains active for up to 30 days and is extended automatically while you keep using the platform. They cannot be disabled.

Always active

Secure sign-in session

Keeps you securely signed in through Supabase. If you choose "Stay signed in", it lasts up to 30 days and renews automatically while you keep using the platform.

Stored as sb-[ref]-auth-token

"Stay signed in" choice

Remembers whether you asked to stay logged in. Expires after 1 year or when you sign out.

Stored as inv_remember

One active session per account

Limits investor accounts to a single active login at a time. Expires after 30 days of inactivity or when a newer login replaces it.

Stored as x-inv-sid

Security and bot protection

On the sign-in, sign-up and password-reset pages we load Cloudflare Turnstile, a human-verification widget that checks your request comes from a real browser before your credentials are submitted. It reads technical request data (IP address, browser signature, and the page requested), carries no account information, builds no profile about you, and is never used to track you across other websites. It sets no cookie. Denial-of-service protection and edge filtering for the platform itself come from Vercel, our hosting provider. Because these protect the service you asked for, they run without consent and cannot be switched off.

Always active

Local storage & preferences

These browser local storage entries (not cookies) remember your UI preferences. They are stored client-side only, never transmitted to our servers, and are cleared when you clear your browser data.

Optional

Dark or light mode

Remembers your appearance preference. Stored only in your browser.

Stored as investtable-theme

Feedback survey (last sent)

Remembers when you last submitted feedback, so we do not ask you again too soon.

Stored as nps_last_submitted

Feedback survey (last dismissed)

Remembers when you last dismissed the feedback survey.

Stored as nps_last_dismissed

Product analytics cookies

When you opt in, we load PostHog (EU region) to understand how the platform is used: which pages are visited, which features are clicked, and where errors occur. We also enable Vercel Web Analytics, which counts page views without setting any cookies. Nothing loads until you enable this category in cookie settings, and turning it off clears PostHog's cookie again. Separately, we do depend on Google Search Console, Google's own analytics service for search performance, to see which search queries lead people to InvesTTable and how our pages rank. Google reports this to us as aggregated statistics that we cannot trace back to an individual visitor, and it sets no cookies on this site, which is why it sits outside this consent choice. We run no advertising or retargeting pixels.

Optional

Distinguish visitors and sessions

PostHog stores a random visitor ID and session state in your browser so repeat visits can be told apart. Set only after you opt in; removed when you turn analytics off. Expires after about 12 months.

Stored as ph_*_posthog

Marketing & CRM cookies

When you opt in, we load HubSpot (EU region), which sets cookies to recognise you across visits and link your page views to your contact record in our CRM. We use this for lead follow-up and product communication, never for third-party advertising. Nothing loads until you enable it in cookie settings, and turning it off again clears these cookies.

Optional, off by default

Recognise returning visitors

HubSpot uses these to recognise you across visits and link your page views to your CRM contact. Expires after about 6 months.

Stored as __hstc / hubspotutk

Current visit

HubSpot tracks your current session. Expires after 30 minutes.

Stored as __hssc

New session detection

HubSpot uses this to detect the start of a new session. Cleared when you close your browser.

Stored as __hssrc

Your rights under GDPR

As an EU resident, you have the right to access, correct, and delete your personal data at any time. You can change or withdraw your cookie consent at any time in the cookie settings, and withdrawing is as easy as giving it. For data-related requests (right of access, erasure, or portability), contact us at privacy@invest-table.com.

Change your cookie choices

Analytics and marketing cookies are off until you switch them on, and you can switch them back off at any time. Your current choice, and the date you made it, is shown on the cookie settings page.

Change your cookie choices

Third-party services

InvesTTable uses Supabase (authentication and database, EU region), Stripe (payment processing), Vercel (hosting and edge delivery), Cloudflare (domain registrar and DNS, plus the human-verification widget on the sign-in and password-reset forms), HubSpot (CRM and marketing, EU region, loaded only after you opt in via cookie settings), PostHog (product analytics, EU region, loaded only after you opt in via cookie settings), and Google (Search Console for search performance, plus YouTube for pitch video embeds). YouTube videos use a click-to-play facade: no connection to Google servers is established until you actively click the video. Playback uses YouTube's privacy-enhanced mode (youtube-nocookie.com). The full list of services, with locations and transfer safeguards, is maintained at invest-table.com/subprocessors.