DRAFT v0.1 — 19 August 2026 — prepared for review by qualified counsel; not yet in force.
Key points (non-binding summary — the numbered clauses prevail)
- Today https://vistason.com and the Vistason Platform set only strictly necessary cookies and local-storage items: session and authentication, CSRF protection, load-balancing and bot protection at the edge, and basic preferences.
- We do not currently use analytics, advertising or social-media cookies, and nothing tracks you across other websites.
- We plan to add product analytics ([POSTHOG]). When we do, analytics cookies will be set only after you opt in through a consent banner, and you will be able to withdraw at any time.
- You can block or delete cookies in your browser, but the Platform will not work without the strictly necessary ones (you will not be able to stay signed in).
- We will update the table in this Policy whenever the cookies we use change.
- Questions: legal@vistason.com.
1. About this Policy
1.1 This Cookie Policy explains how PostReach AI Limited ("Vistason", "we", "us") uses cookies and similar technologies on https://vistason.com, its subdomains, and the Vistason marketplace, Hangar seller console, deal rooms, Tenders and Radar services (together, the "Platform").
1.2 It should be read with our Privacy Policy, which explains how we process personal data generally, and with our Terms of Service, Data Processing Addendum and Legal Notice. Capitalised terms not defined here have the meaning given in the Terms of Service.
1.3 This Policy is written to meet the requirements of Article 5(3) of the ePrivacy Directive 2002/58/EC as implemented in [COUNTRY] (for Spain, Article 22.2 of Law 34/2002 (LSSI-CE) and the AEPD's cookie guidance [to be confirmed]), the UK Privacy and Electronic Communications Regulations 2003, and the GDPR / UK GDPR where cookies involve personal data.
1.4 The Platform is for businesses only. Even so, the people who use it are individuals, and the rules on cookies apply to their devices regardless of the business context.
2. What cookies and similar technologies are
2.1 Cookies are small text files that a website places on your device (computer, tablet or phone) when you visit. They are sent back to the website on later requests so that it can recognise your browser, keep you signed in, remember choices or measure how the site is used.
2.2 First-party cookies are set by the domain you are visiting (vistason.com). Third-party cookies are set by another domain, typically a service provider embedded in the page.
2.3 Session cookies are deleted when you close your browser. Persistent cookies stay on your device until they expire or you delete them.
2.4 Similar technologies include browser local storage and session storage (small data stores in your browser that are not sent with every request), pixels or web beacons, and device fingerprinting. In this Policy, "cookies" includes these technologies unless we say otherwise. We do not use device fingerprinting, pixels or web beacons.
3. Categories of cookies
3.1 Strictly necessary cookies are essential for the Platform to work and to provide a service you have asked for: signing in and staying signed in, protecting forms and actions against cross-site request forgery ("CSRF"), routing your requests to the right server, defending against bots and abusive traffic, and remembering that you have made a cookie choice. These cookies are exempt from the consent requirement. Without them the Platform cannot operate, so they cannot be switched off through our settings; you can block them in your browser, but you will then be unable to sign in.
3.2 Functional (preference) cookies remember choices you make, such as language, time zone, list or grid view, column layouts in Hangar, and dismissed notices. Where a preference cookie is necessary to deliver a feature you have expressly requested, we treat it as strictly necessary; otherwise it is set only with your consent.
3.3 Analytics (performance) cookies help us understand how the Platform is used — which pages and features are visited, how users move through a flow such as making an offer or publishing a listing, and where errors occur — so that we can improve it. These cookies are set only with your consent.
3.4 Marketing (advertising and targeting) cookies are used to build interest profiles and show advertising on other sites. We do not use any marketing cookies and have no plans to.
4. The cookies we currently use
4.1 The table below lists the cookies and local-storage items in use on the date of this Policy. Names, providers and lifetimes marked in brackets will be confirmed once the production configuration is finalised, and the table will be kept current.
| Category | Name | Set by | Purpose | Type / lifetime |
|---|---|---|---|---|
| Strictly necessary | [SESSION COOKIE NAME] | vistason.com (first party) | Keeps you signed in to your account and associates requests with your session | Cookie — session, or persistent for up to [30] days if you choose "stay signed in" |
| Strictly necessary | [AUTH / REFRESH TOKEN NAME] | vistason.com (first party; issued via [SUPABASE] Auth, planned) | Renews your authenticated session without requiring you to sign in again | Cookie or local storage — up to [30] days |
| Strictly necessary | [CSRF TOKEN NAME] | vistason.com (first party) | Protects forms and state-changing actions (offers, bids, approvals, listing edits) against cross-site request forgery | Cookie — session |
| Strictly necessary | [EDGE / LOAD-BALANCING COOKIE NAME] | Cloudflare (edge network; set on vistason.com) | Distributes traffic across servers, distinguishes humans from automated traffic and protects the Platform against abuse | Cookie — up to [30] minutes / [24] hours as configured |
| Strictly necessary | [HOSTING COOKIE NAME] | Vercel (hosting; set on vistason.com) | Routes requests to the correct deployment and protects preview environments | Cookie — session or up to [24] hours |
| Strictly necessary | vistason_cookie_consent [name to be confirmed] | vistason.com (first party) | Records whether you have accepted or declined optional cookies so we do not ask again (introduced with the consent banner) | Cookie — [12] months |
| Functional | [PREFERENCES KEY] | vistason.com (first party, local storage) | Remembers interface preferences such as language, time zone, view mode and dismissed notices | Local storage — until cleared |
| Analytics | [POSTHOG] — e.g. ph_[PROJECT KEY]_posthog [planned] | [POSTHOG] (analytics sub-processor), hosted [EU REGION, to be confirmed] | Product analytics: page views, feature usage, funnels, error rates, anonymous or pseudonymous user identifier. Not yet deployed. Consent-based. | Cookie and local storage — up to [12] months |
| Marketing | None | — | We use no advertising, targeting or social-media cookies | — |
4.2 We do not embed third-party social-media buttons, advertising tags, chat widgets or video players that set their own cookies. If we introduce an embedded third-party service in future, it will be listed here and, where it sets non-essential cookies, loaded only after consent.
4.3 Email notifications sent by the Platform (via Amazon SES, operated by Amazon Web Services) may contain a link-tracking or open-tracking element so that we can tell whether transactional messages are delivered and acted on. Open-tracking pixels in marketing emails will be used only with your consent to marketing, and you may opt out at any time.
5. How to manage cookies
5.1 Platform controls. Once the consent banner described in clause 6 is live, you can review and change your choices at any time through the "Cookie settings" link in the footer of the website and in your account settings. Withdrawing consent is as easy as giving it: one click removes consent for analytics cookies and we stop setting them and delete those we control.
5.2 Browser controls. All major browsers let you view, block and delete cookies and local storage, and many let you block third-party cookies by default. Instructions are in your browser's help pages (for example Chrome, Firefox, Safari, Edge). Blocking strictly necessary cookies will prevent you from signing in and from using most of the Platform.
5.3 Do Not Track and Global Privacy Control. Where your browser sends a Global Privacy Control (GPC) signal, we will treat it as a refusal of non-essential cookies. We do not currently respond to the older "Do Not Track" header because there is no common standard for it.
5.4 Opting out of analytics directly. When [POSTHOG] is introduced, you will also be able to opt out through the provider's own mechanism described in its documentation, in addition to our consent settings.
5.5 Clearing your cookies also clears your consent record; we will ask for your choice again on your next visit.
6. Consent mechanics (to apply when non-essential cookies are introduced)
6.1 Before we set any analytics or other non-essential cookie we will show a consent banner that: (a) explains in plain language what the cookies are for; (b) offers "Accept" and "Reject" options of equal prominence, plus a "Settings" option to choose by category; (c) does not pre-tick any optional category; (d) does not use cookie walls — you can continue to use the Platform without accepting optional cookies; and (e) links to this Policy.
6.2 No non-essential cookie will be set until you have made an affirmative choice. Closing the banner without choosing, scrolling or continuing to browse is not treated as consent.
6.3 We will record the choice you made, the date and the version of this Policy in force, so that we can demonstrate consent under Article 7 GDPR. We will ask you again no later than [12] months after your last choice, or sooner if we add a new category or purpose.
6.4 If you are an Authorised User, your cookie choice is personal to you and your device; it is not made for you by your employer or your account Admin.
7. Cookies and personal data
7.1 Some cookie data, such as a session identifier together with your account, or an IP address in edge logs, is personal data. Our Privacy Policy explains the legal bases we rely on: strictly necessary cookies are processed on the basis of our legitimate interest in operating and securing the Platform and performing our contract with the customer; analytics cookies on the basis of your consent.
7.2 Cookie data that is personal data is retained as set out in the Privacy Policy (technical logs for [12] months; analytics data for [12] months after collection, or until you withdraw consent, whichever is sooner).
7.3 Analytics providers may process data outside the EEA/UK. Where that happens, the transfer safeguards described in the Privacy Policy (adequacy decisions, Standard Contractual Clauses, UK Addendum) apply, and we will prefer EU-hosted configurations where offered.
8. Changes to this Policy
8.1 We will update this Policy when we add, remove or change cookies, or when the law or guidance changes. The "updated" date shows the last change. Where a change introduces a new non-essential cookie, we will re-present the consent banner. The current version is always available at https://vistason.com/legal/cookie-policy.
9. Contact
9.1 Questions about this Policy or our use of cookies: legal@vistason.com, or by post to PostReach AI Limited, Room 1805-06, 18th Floor, Hollywood Plaza, 610 Nathan Road, Kowloon, Hong Kong, attention Privacy. DPO / privacy contact: [—]. You may also complain to your supervisory authority (in Spain, the Agencia Española de Protección de Datos, https://www.aepd.es [to be confirmed]).