Legal

Cookie Policy.

This website sets no cookies. It writes one strictly necessary entry to sessionStorage during our private pre-launch period, and nothing else in your browser. That is why you are not reading this over a consent banner. The partner portal sets two strictly necessary cookies, and this page says exactly what they are.

Document

Version 1.2
Published 4 September 2026
Covers: this website,
the partner portal

Read first

This website

This website sets no cookies, and stores one thing.

No cookies at all. Nothing in localStorage and nothing in IndexedDB. No analytics, no tag manager, no A/B testing, no advertising or conversion pixels, no session recording, no fingerprinting. The pages are static files and the whole site ships one small JavaScript bundle, containing two things: the pricing calculator, which computes in memory and writes nothing anywhere, and the pre-launch access gate described below.

Browser storage is not a cookie, sessionStorage and localStorage are different mechanisms, and the ePrivacy rules on storing or accessing information on your device cover them just the same. So we account for the one entry we write rather than answering a narrower question than you asked. There is no consent banner on this site, not as a stance, but because a strictly necessary entry you asked for by entering a password is exempt from the consent requirement, and there is nothing else to ask you about.

heatrail.gate: A single sessionStorage entry with the literal value open. It carries no identifier, no timestamp and nothing derived from you or from the password.; When: only while Heatrail is in its private pre-launch period, and only after you have entered the access password. If you never see the password screen, nothing is written.; Purpose: remembering, for the current browser tab, that this tab has already been unlocked, so moving between pages does not ask again. Strictly necessary for a service you have explicitly requested, and exempt from consent under Article 5(3) of the ePrivacy Directive on that basis.; Lifetime: the browser tab. sessionStorage is cleared when the tab closes, and nothing survives it. It is first-party, never read by anyone else, and never sent to a server. When the pre-launch period ends and the gate is removed, this entry stops being written and this row leaves the page.

Serving the pages still means the hosting provider processes the request itself, your IP address, user agent, and the URL, as any web server does. That is covered in the Privacy Policy.

No third party at all

This site contacts nobody but this site. Until 4 September 2026 the typefaces came from Google’s font service, which disclosed your IP address and user agent to Google on every page load. The font files are now served from this domain, and the site’s content security policy allows scripts, styles and fonts from this origin only, so a request to anyone else would be blocked by your browser rather than merely discouraged by us.

The portal

The partner portal: two strictly necessary cookies.

The portal is a separate application, at a separate address, where partners register, accept the agreements, manage billing and download the integration. It sets both cookies below from your first visit, before you sign in, because the sign-in form itself needs cross-site request forgery protection.

Session cookie: Named after the application, ending in -session. Holds an opaque session identifier and nothing else. The session data itself lives in the portal’s database. HttpOnly, so page scripts cannot read it, SameSite=Lax, and marked Secure over HTTPS. It expires after 120 minutes of inactivity, and signing out invalidates it.; Purpose: keeping you signed in across requests. Strictly necessary for a service you have asked for.
CSRF cookie: XSRF-TOKEN. Carries the anti-forgery token for the current session. It is deliberately readable by the portal’s own scripts, which is how the token is attached to a request, and it is SameSite=Lax with the same lifetime as the session.; Purpose: preventing another site from submitting a form in your name. Strictly necessary, and a security measure rather than a convenience.

Both are first-party, both fall within the “strictly necessary” exemption from the consent requirement in Article 5(3) of the ePrivacy Directive as implemented in Estonia, and neither is used for analytics, profiling or advertising. The portal sets no other cookie. If you block them, you cannot sign in. There is no way around that, and no reason to pretend otherwise.

Stripe. Payment and subscription management happen on Stripe’s own pages. When you follow the checkout or billing link you leave Heatrail, and Stripe sets its own cookies under its own policy. We do not set or read them.

In a shop

What the integration does in a shop’s checkout.

The Heatrail plugin and SDK set no cookie of their own. They run on the shop’s server, hash the identifiers there, and send a check. There is no Heatrail script in a shopper’s browser and no Heatrail cookie in a shopper’s browser.

Where a shop chooses to send a first-party persistent identifier, a random value that lets the shop recognise a returning browser, that value is stored by the shop, in the shop’s own cookie, under the shop’s control, and belongs in the shop’s own cookie notice. Heatrail receives it already generated and matches it only within that same shop. The optional device-characteristics layer, where a shop enables it, reads properties the browser exposes and stores nothing on the device.

What all of this means for a shopper is set out in plain language, without legalese, on the customer disclosure page. That page is deliberately self-contained, no scripts, no external assets, no cookies, so it renders even when everything else is down.

Changes

Changes and contact.

If we add anything that stores or reads information on your device, this page changes first, with a new version number and date, and the summary at the top changes with it rather than being quietly qualified further down. That is the rule that produced version 1.1: version 1.0 said this site stored nothing at all, and the pre-launch access gate’s sessionStorage entry made that sentence wrong, so the sentence changed. And that is the rule that produced version 1.2, of 4 September 2026: version 1.1 said this site contacts nobody but this site, while the typefaces were still fetched from Google’s font service, so on 4 September 2026 the font files moved to this domain and the paragraph above was rewritten to record both the old behaviour and its removal. Material changes are notified as described in the Privacy Policy.

Questions: privacy@heatrail.eu. Version 1.2, published 4 September 2026.

The rest of the section.

The Terms of Service and the Data Processing Agreement are what you accept at registration. The Privacy Policy covers Heatrail’s own processing and where to exercise your rights.