Cookie & Tracking Notice
Which cookies and similar tracking we use, and how to manage them.
Service: RivalLens (rivallenslabs.com) Version: 1.0 Effective date: 2026-10-23 Last updated: 2026-10-24
Authoritative language: English. Translations are for convenience; the English version prevails.
1. Summary
This Notice explains the cookies and similar technologies used on RivalLens. It complements our Privacy Policy (rivallenslabs.com/legal/privacy).
We use two kinds of cookies:
- Strictly necessary cookies — needed to run the site and keep you signed in. These are set without consent, because the Service cannot work without them.
- Analytics cookies set by Google Analytics 4, and a note of your first visit kept by RivalLens — these are set only if you accept them, and never before.
We set no advertising cookies, we run no remarketing or advertising audiences, and we do not sell or share your personal data with advertisers.
2. Cookies we use
2.1 Strictly necessary (no consent required)
These are required for the Service to function and are exempt from consent under the ePrivacy Directive (Art. 5(3)) / Spanish LSSI (Art. 22).
Before you make a choice, RivalLens sets no cookies at all. The items below are stored in your browser's local storage rather than as cookies, which means they are never transmitted to any server with your requests. They stay on your device.
| Item | Purpose | Set by | Duration |
|---|---|---|---|
| Authentication / session | Keeps you signed in (signed-in users only) | Supabase (auth) | Until you sign out |
| Cookie-consent record | Remembers your cookie choice so we do not ask again | RivalLens | 6 months |
| Consent identifier | A random value that pairs your choice with our consent record (see §2.3). Identifies a browser, not a person | RivalLens | Until you clear your browser storage |
| Interface language | Shows the site in the language you chose | RivalLens | Until you clear your browser storage |
| Theme (light / dark) | Remembers your display preference | RivalLens | Until you clear your browser storage |
The cookie-consent record is itself strictly necessary: without it we could not honour your decision and would have to ask on every page.
2.2 Analytics — consent required
We use Google Analytics 4 (GA4) to measure how the site is used: which pages are visited, where visitors arrive from, and where they leave. GA4 sets non-essential cookies and sends data to Google, a sub-processor located in the United States (see the sub-processor list for the transfer safeguards).
| Cookie | Purpose | Set by | Duration | Consent |
|---|---|---|---|---|
_ga, _ga_* |
Analytics / usage measurement | Google (GA4) | up to 13 months | Required |
rl_first_touch (local storage) |
Remembers the link that first brought you here — campaign tags, Google Ads click identifiers, the name of the site you came from and the first page you opened — until you sign up, so the right campaign is credited | RivalLens | While your analytics consent lasts (up to 6 months); deleted at once if you decline or withdraw | Required |
Purchases. If you accepted and then buy a report, our server reports the purchase to GA4 using the analytics identifiers your browser already had: the net amount, VAT, currency, what was bought and a scrambled order reference — never your name, your email or the subject of your report. If you declined, the server sends nothing.
Under the ePrivacy Directive (Art. 5(3)) / Spanish LSSI (Art. 22) and the GDPR, these cookies may be placed only after your prior, specific and informed consent. In practice:
- A consent banner is shown on your first visit. No GA4 cookie is set before you accept — the analytics script is not loaded at all until then.
- "Reject" is exactly as easy as "Accept" — one click, equal prominence. Rejecting costs you nothing: the Service behaves identically.
- You can change your choice at any time through the cookie-settings control in the site footer. If you withdraw consent, the GA4 cookies already on your device are deleted and analytics stops immediately — you do not have to clear them yourself.
- We do not use Google Consent Mode. Consent Mode loads Google's script before you answer and transmits data in a reduced form; we load nothing at all until you accept, which is stricter.
- If your browser sends a Global Privacy Control signal, we treat it as a refusal and do not ask.
- Google signals are disabled on our property: your visit is never linked to your Google account, and we receive no age, gender, interest or cross-device data.
- Analytics data is not used to show you advertising, to profile you, or for automated decisions about you. Learning which of our own campaigns bring customers is measurement, not targeting.
2.3 Record of your choice
To be able to demonstrate that you were asked and what you answered, we store one record on our servers each time you accept or decline: a random identifier (also kept in your browser), the decision, the version of this Notice you were shown, the language you read it in, and the date.
The record contains no personal data — no email address, no IP address, no browser fingerprint, and nothing derived from you. We record declines as well as acceptances, because a record containing only acceptances could not show that a person who was never tracked had in fact been asked.
Retention: 2 years, after which the record is deleted automatically.
3. Managing cookies
You can manage or delete cookies in your browser settings, and you can withdraw or change your analytics consent at any time through the on-site cookie settings. Blocking strictly-necessary cookies may break parts of the Service.
4. Changes
We will update this Notice before introducing any new non-essential tracking, and we will not enable such tracking without the required consent.
5. Contact
Questions: privacy@rivallenslabs.com.