What we use
Arbling uses a small set of cookies and similar technologies, strictly to run the product:
- Session cookie — keeps you signed in after Google sign-in. Essential; expires after 7 days or when you sign out.
- Anonymous scan cookie — links a free catalog scan you run before signing up to your account once you do, so your report isn't lost. Expires after one year.
- Storefront continuity cookie (
__Host-arb_w2_v1) — set in a shopper's browser when you add the Arbling widget to your storefront, so the widget can recognise one visit across pages of your store. It is set only after your store's consent signal grants both analytics and attribution — without that, no cookie is written. It is partitioned to your store: the browser keeps a separate copy per site, so it cannot follow anyone from one merchant to another. It is not readable by page scripts, expires 24 hours after it is first issued and is never renewed — a returning shopper does not extend it — and it is deleted at once if the shopper's browser reports that storage is denied, withheld, unknown or revoked. - Preferences — your language and light/dark theme choice, stored in your browser's local storage.
- Analytics — we use Google Analytics and PostHog to understand which parts of the product are used (page views, clicked actions). Neither one loads until you agree to it, and neither is used for advertising. After you accept analytics, PostHog also records where on the page visitors click and scroll, as aggregate heatmaps that do not identify you. If you arrive from a link in an email we sent you, we keep that link's reference in a first-party cookie (arb_lead, one year) so we can connect your visit to that email; it holds no other data. After you accept analytics, HubSpot also sets its visitor cookies (hubspotutk and __hstc, six months; __hssc, thirty minutes; __hssrc, for the session) so that the pages you view can be linked to your email address if you later give it to us; without an email address they identify only your browser.
- Our own page count — counts every page view on arbling.com, whether or not you accept analytics. It sets no cookie and stores nothing on your device. We keep the page, the time, the website that sent you (its name only), which AI assistant sent you if one did, and a random visit code that changes each day, for 180 days. Your IP address is not stored by Arbling: inside the request it forms one-way codes for counting visits and limiting requests, and the keys to those codes are deleted at midnight UTC. Our hosting provider keeps request logs, with addresses, for 30 days.
- AI visit link (local storage,
__arbling_ati_seed__) — only after you accept analytics, and only when you arrive from an AI assistant such as ChatGPT or Perplexity. Our own tool stores a random code in your browser's local storage, so that a later step on this site, such as a demo request, can be linked to that visit. Only a scrambled form of the code is sent to us; it holds no other data and is not used for advertising. It is deleted when you decline analytics; otherwise it stays until you clear your browser's storage. We keep that visit, and the later steps linked to it, for 180 days. - Opt-out marker (local storage,
arbling_ati_opt_out) — if you choose "opt out" in the notice at the foot of the page, we store this so our tool stops linking your visits from AI assistants to what you do next, in this browser. The page count above still runs, and it notes when an AI assistant sent the visit.
Contact
Questions: privacy@arbling.com.
