Effective 25 May 2026
Cookie Policy
What cookies CRM Brain sets, why we set them, and how to manage your preferences.
This policy explains how CRM Brain (operated by Roveva Solutions) uses cookies and similar storage technologies when you visit crm-brain.com or use the CRM Brain application. CRM Brain is a B2B service used by recruiting agencies; it is not directed at consumers.
1. What Cookies Are
A cookie is a small text file that a website places on your device when you visit. Cookies serve different purposes: some are strictly necessary for the site to function, others remember your preferences, and others collect aggregate data about how visitors use the site. Similar technologies include local storage (data stored in your browser without an expiry date) and session storage (data cleared when you close the tab).
Under §25 TTDSG (German Telecommunications Telemedia Data Protection Act), we must obtain your consent before storing or accessing cookies on your device unless the cookie is strictly necessary for a service you have explicitly requested. Strictly necessary cookies are exempt from the consent requirement.
2. Cookie Categories
| Category | Purpose | Legal basis | Consent required | Retention |
|---|---|---|---|---|
| Strictly necessary | Session management and user authentication. Without these cookies the application cannot function. | §25(2)(2) TTDSG: strictly necessary for a service explicitly requested by the user | No | Session to 30 days (refresh token) |
| Functional | Remembering your cookie consent choice and application preferences (language, display settings). | §25(1) TTDSG: consent | Yes | 12 months |
| Analytics | Usage analytics and session recordings via PostHog. Tracks feature usage, error rates, and records anonymised replays of in-app sessions to diagnose UX issues. Recordings capture mouse movement, clicks, and page state but exclude passwords and payment fields. Data is never sold or shared for advertising. | §25(1) TTDSG: consent | Yes | 13 months |
| Marketing | Conversion tracking (e.g., recording that a visitor signed up after viewing a campaign page). Only activated if conversion tracking is deployed. | §25(1) TTDSG: consent | Yes | 90 days |
3. Specific Cookies We Set
| Cookie name | Category | Purpose | Retention |
|---|---|---|---|
sb-access-token | Strictly necessary | Supabase JWT access token. Authenticates your session with the CRM Brain API. Stored as an httpOnly secure cookie. | 1 hour (auto-refreshed) |
sb-refresh-token | Strictly necessary | Supabase refresh token. Used to obtain a new access token without requiring you to log in again. Stored as an httpOnly secure cookie. | 30 days |
crmbrain.cookie-consent | Functional | Stores your cookie consent choice so we do not ask again on every visit. | 12 months |
ph_phc_* (localStorage) | Analytics | PostHog session identity. Stores an anonymous device ID, distinct ID, and session data to stitch page views, events, and session recordings into a single user session. Only written after you accept analytics cookies. | 1 year |
4. Managing Your Consent
When you first visit crm-brain.com, a cookie consent banner will appear allowing you to accept or decline non-essential cookies by category. You can review or withdraw your consent at any time by clicking the Cookie settings link in the footer of any page.
Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal. Strictly necessary cookies cannot be disabled because the service cannot function without them.
You can also control cookies through your browser settings. Most browsers allow you to view, block, or delete cookies. Note that blocking strictly necessary cookies will prevent you from logging into CRM Brain. For guidance on browser cookie settings, visit your browser's help documentation.
5. Third-Party Storage
CRM Brain does not permit third-party advertising networks to set cookies on your device. PostHog, our analytics and session recording provider, writes data to your browser's localStorage under the analytics category when you accept analytics cookies. PostHog processes and stores this data on EU servers (Frankfurt, AWS eu-central-1). PostHog does not set third-party advertising cookies.
6. Changes to This Policy
We will update this policy if we add new cookie categories or change how existing cookies work. Material changes will be notified via the cookie consent banner so you can review and re-confirm your preferences. The effective date at the top of this page reflects the most recent version.
7. Contact
Questions about this policy or our use of cookies: hello@crm-brain.com
Roveva Solutions, Sandstücken 9, 25421 Pinneberg, Germany