Cookie Policy
Effective: 9 June 2026
1. Cookies in use
The Platform uses primarily first-party (own) cookies. Subject to the user’s consent, Google Analytics 4 (third-party) analytics cookies are also set; these are off by default (see section 5). The Controller uses no marketing or advertising cookies. The categories below reflect the actual behaviour.
2. Cookie categories at a glance
A summary of the categories (see the details below):
| Category | Purpose | Legal basis | Default |
|---|---|---|---|
| Strictly necessary | Login, session, security, core operation | Legitimate interest / providing the service | Always on (cannot be disabled) |
| Functional | Remembering language and display (theme) preferences | Consent | On by default (can be switched off) |
| Analytics | Usage statistics (Google Analytics 4) | Consent | Off by default (opt-in) |
| Marketing | — | — | Not used |
Strictly necessary cookies are always on. Functional (preference) cookies are on by default and can be switched off at any time; analytics cookies are off by default and load only with your explicit consent. We use no marketing or advertising cookies.
3. Strictly necessary cookies (always on)
Core features do not work without these, so they cannot be switched off. Legal basis: provision of the service and/or legitimate interest.
bizcup_session — your signed-in session (encrypted, httpOnly; ~30 days).
bizcup_oauth_state — CSRF protection for SSO sign-in (short-lived, cleared after login).
bizcup_invite — carries an invitation through the sign-in flow (transient).
4. Functional (preference) cookies — consent-based
These cookies serve user convenience. They are stored only if the user allows them in the cookie banner; until consent is withdrawn they operate on the basis of the user’s explicit choice (changing the theme or language).
bizcup-theme — remembers your chosen light/dark theme (~1 year).
NEXT_LOCALE — remembers your chosen language.
5. Analytics cookies (Google Analytics 4) — consent-based
This site uses Google Analytics 4 (GA4) to measure usage. These cookies are not strictly necessary, so they load only after your explicit, prior consent; they are switched off by default.
Cookies used: _ga and _ga_<measurement_id>. Their purpose is to distinguish users and sessions and to produce aggregated, anonymous usage statistics (e.g. pages visited, device type).
Lifetime: by default about 2 years (24 months) from your last visit; browsers often cap this to roughly 13 months (400 days).
Controller / processor: the cookies are set by the site operator, and the data is processed by Google (Google Ireland Limited and Google LLC) acting as a processor.
International transfer: data may also be processed outside the EU, in the USA. The current legal basis is the EU–US Data Privacy Framework adequacy decision (Google LLC is a certified participant), backed by the EU Standard Contractual Clauses (SCCs). This framework is under legal challenge, so we keep this notice updateable.
IP address handling: in GA4, IP anonymization is automatic and mandatory. Your IP address is used only transiently to derive approximate (city-level) location and is then discarded; it is not logged or stored. EU traffic is received by EU-based servers.
Marketing and advertising cookies: we set NONE and share no data with ad networks.
Your rights: you can withdraw consent at any time, as easily as you gave it, via the “Cookie settings” link in the footer. Withdrawal applies going forward and does not affect processing already carried out; on withdrawal we delete the existing GA cookies.
6. Consent and withdrawal
A cookie banner appears on your first visit. Strictly necessary cookies are always active. Functional (preference) cookies are on by default and work based on your explicit actions (changing the theme or language); you can switch them off at any time in the banner. Analytics cookies, by contrast, are off by default and load only with your explicit consent. You can change or withdraw your choice at any time via the “Cookie settings” link in the footer, or by clearing cookies in your browser. On withdrawal we delete the preference and Google Analytics cookies.