Cookie Policy

2. The cookies we set

There are exactly two, and both are necessary for the site to work.

• bv_refresh_token — set by our sign-in service when you sign in, whether with an email address and password or through Google, Microsoft, or GitHub, and cleared when you sign out. It keeps you signed in. It is marked HttpOnly, so no script on the page can read it, and it expires when the session credential inside it does.
• bv_consent — set when you make a choice in the cookie banner. It records which categories you accepted, so we do not ask again on every visit. It lasts 180 days.

3. What we store in your browser without a cookie

Everything in this section is stored by the site itself rather than in a cookie. Unless a line says otherwise, it is local storage, which survives closing the tab until it is cleared. Session storage is emptied when you close the tab. Where a name below ends in <business>, <account> or <table>, one item is kept for each business, account or table it applies to, with that one’s identifier in its name.

• accessToken — the short-lived token the application sends with each request to prove who you are. Local storage, so a script on the page can read it. It is the only credential kept outside a cookie: the longer-lived refresh credential stays in the HttpOnly bv_refresh_token cookie above, however you sign in.
• bv_session — a marker recording only that a signed-in session exists. It holds no credential.
• userId, userEmail, userRole — your user id, email address, and role, so the application knows who you are as you move around it.
• bv_pending_verify_email — session storage. Your email address, carried from the registration form to the "check your email" screen so that screen can show it and offer to resend. Cleared when you close the tab.
• bv_verify_return_to — the page to take you to once you have confirmed your email address (for example an invitation you signed up to accept), with the email address that signed up, so that no other account is taken there. After seven days it is no longer used, and it is deleted the next time the site reads it.
• bv_auth_return_to — session storage. The page to take you back to when you sign in through Google, Microsoft, or GitHub, kept while you are away at that provider.
• bv_forgot_email — session storage. The email address you typed on the sign-in screen, carried to the "forgot password" screen so you do not have to type it again.
• buyverse.cookie-consent — the same consent record as the bv_consent cookie, kept in local storage as well.
• buyverse.cookie-consent.dismissed — session storage. It records only that you closed the banner without choosing, so it is not shown again in that tab.
• buyverse-theme, i18nextLng, buyverse_api_version — your appearance choice, your language, and the API version selected in developer settings.
• buyverse_active_business_id, buyverse.activeCartId — which of your businesses you are working in, and the id of your active cart.
• buyverse_sidebar_collapsed, buyverse_nav_persona:<business>, buyverse.dashboard.layout.v2, spend_dashboard_widgets, sell-side-analytics-dashboard-settings, bv:density:<table>, bv:products:view, marketplace-view-preferences — layout preferences: whether the sidebar is collapsed, whether a business that both buys and sells is working as a buyer or as a seller, how you arranged your dashboard and analytics widgets, how closely a table’s rows are spaced, whether your product list shows as a list or a grid, and how the business directory lays out its results.
• buyverse_nav_agent_operator:<business> — session storage. Whether that business runs an AI agent, its own or a connected one, reused for up to five minutes so the navigation does not ask again on every page.
• bv:getlive:<business> — that the business has already been shown its "You’re live" message, so it is not shown again.
• buyverse_pending_plan — the plan you selected before creating an account, so onboarding can carry it through.
• widget_onboarding_data:<account> — your progress through the checkout-widget setup wizard, kept for each account so you can leave and come back.
• searchHistory — your recent marketplace searches, so the search box can offer them again. It stays in your browser and is not sent to us as a list.
• bv:compare-list — the products and services you have picked to compare side by side.
• bv:deal-compare — session storage. The deals you have picked to compare side by side.
• bv.analytics.did — the analytics identifier described in the next section. It exists only while you have accepted analytics.
• buyverse-offline-v1 — cache storage, not local storage: a copy of our "you are offline" page, which the site’s service worker keeps so it can show you that page when your connection drops. It holds nothing about you.

4. Analytics, and what accepting it turns on

Accepting the analytics category turns on one thing: product analytics through PostHog. From then on, when you do certain things on the website — for example viewing a product, a deal or the business directory, running a search, applying a filter, or taking a step in creating an account — your browser sends PostHog an event. The first such event creates a random identifier, stored in local storage as bv.analytics.did, so that events from one browser can be grouped together. Each event carries the time, the full address of the page you were on, the details of the event itself and that identifier; the Privacy Policy sets out exactly what an event carries, under "Analytics and error tracking". The request carries no cookie, and PostHog stores nothing in your browser.

Until you accept analytics, nothing is sent to PostHog and the identifier is not created. If you refuse analytics, or withdraw it later in the cookie preferences, nothing more is sent and the identifier is deleted from your browser straight away.

Accepting the marketing category turns nothing on today: no marketing or advertising technology is in use on the site, and nothing acts on that choice. It is recorded so that it is already in place if that ever changes.

5. The checkout widget on a seller’s own website

If a seller has embedded the BuyVerse.ai checkout widget on its own website and has configured redirect checkout, the widget stores one item, buyverse_order, in session storage on that seller’s domain when you pay: the order id, the order number, and the total of the order, so the page you are returned to can show them. It is cleared when you close the tab. Where the seller does not use redirect checkout, nothing is stored.

6. Your choices

The banner offers three categories: necessary, analytics, and marketing. Analytics and marketing are off until you turn them on — we treat no choice as no consent, and nothing waits for you to opt out.

You can reopen the preference centre at any time from the link in the footer, and you can also control cookies through your browser settings. Blocking the two cookies above will stop you being able to stay signed in.

7. Third-party scripts and services

Stripe’s payment library loads at checkout on the website and inside the embedded widget. Stripe uses it for card processing and fraud detection, and it may set cookies of its own. Those are governed by Stripe’s policies, not ours, and we do not control them.

Two other providers receive information from your browser, through our own code rather than through a script of theirs, and both are switched on for this service today. PostHog receives product-analytics events only after you have accepted analytics, as described above. Sentry receives a report when an error on a page is not handled, or a page fails and shows its error screen instead: the error’s type, message and stack trace, which part of the website caught it, the pattern of the page’s route rather than the address you visited, and, when the error happened on our server, the reference number the error screen shows you. That report is a diagnostic, not analytics, so it is sent whatever you chose in the cookie banner; the website’s error reporter stores nothing in your browser — no cookie, and nothing in local or session storage — and the report carries no cookie. As with any server your browser connects to, both receive your IP address. Whether each runs is a deployment setting rather than a change to the product, so we will not promise it cannot change without you noticing; what we commit to is that this page and the Privacy Policy’s list of providers are updated whenever one is switched on or off.

No other third-party script is loaded on this deployment — no advertising tag, no font or widget from another domain.

8. Changes and contact

We will update this policy when what we store changes, and the "last updated" date above will change with it. For questions, contact privacy@buyverse.ai. See our Privacy Policy for how we handle personal information generally.