Cookies

Information about cookies and trackers used on the CalisForm landing. Items marked “TO VALIDATE” still need confirmation. This text does not claim guaranteed compliance.

8. Cookies and trackers

We distinguish: (a) Essential — required for the site to work (theme and language preferences, remembering your cookie choice, technical security / session). They are not used for advertising. (b) Statistics — only after your “Statistics” consent; provider: PostHog (EU region, eu.i.posthog.com). They help us understand landing traffic and confirmed signups (event without email). (c) Experience improvement — only after the matching consent; provider: Microsoft Clarity. They enable heatmaps and browsing recordings on the landing; entered fields (including email) are masked in the current setup. You can accept, reject, or customize via the banner, and change your choice via “Cookies” in the footer. Withdrawal stops loading non-essential tools and reasonably clears related trackers. No persistent affiliate identifier is stored in the browser for a later visit. Provider cookie lifetimes: TO CONFIRM in PostHog and Microsoft Clarity policies.

9. Statistics and browsing recordings

PostHog loads only after “Statistics” consent, on allowed production hosts. PostHog Session Replay is disabled. Typical data: URL, language, aggregated events (page view, confirmed waitlist signup), optionally the public ?ref= code if present in the URL — never the email in PostHog. Microsoft Clarity loads only after “Experience improvement” consent; recordings / heatmaps cover the landing; no analysis videos, Luna chats, or authenticated pages in this setup. Localhost and Vercel previews are excluded from tracking unless a technical debug mode is on. These tools do not replace the source of truth for signups: Supabase.

7. Service providers

Technical providers identified in the current implementation: Supabase (database / authentication); Resend (emails and waitlist contacts); Vercel (hosting and infrastructure headers, including approximate country code when applicable); PostHog EU Cloud (landing statistics, after “Statistics” consent); Microsoft Clarity (landing recordings / heatmaps, after “Experience improvement” consent); Whop (payments) when applicable for the app. Exact roles (controller / processor), DPAs, and precise processing locations: TO VALIDATE.

10. International transfers

PostHog is configured toward EU hosting (eu.i.posthog.com). Microsoft Clarity is a Microsoft service that may involve processing outside the EU / EEA. Resend, Supabase, Vercel, and other providers may also process data according to their infrastructure. Applicable contractual safeguards (standard contractual clauses / SCCs, adequacy decisions, signed DPAs): TO VALIDATE with counsel and provider contracts. No transfer compliance is asserted here.

11. Your rights and contact

Under the GDPR, you may request access, rectification, erasure, restriction, portability where applicable, and object to certain processing, or withdraw cookie consent without affecting the lawfulness of prior processing. For the waitlist (no account), contact hello@calisform.app. If you have an account, you may also use Profile features (download my data / delete account) when available. You may lodge a complaint with the competent supervisory authority (in Belgium: the Data Protection Authority — TO CONFIRM based on the controller’s country). Appointment of a Data Protection Officer (DPO): not presented as mandatory by default at the current scale; any obligation is TO VALIDATE under GDPR Article 37 (public authority, large-scale regular and systematic monitoring, or large-scale special categories).

You can change or withdraw your consent to non-essential cookies at any time.