Cookie Notice

Version 1.0-draftEffective August 30, 2026

Draft — pending confirmation. This document is an operational draft grounded in how Webba actually works. Company legal details (entity, address, governing law, contact addresses) are placeholders until confirmed, and the wording marked for review below should be reviewed by qualified counsel before launch. Questions: hello@webba.com.

This notice lists the cookies and browser storage Webba actually uses. All of them are first-party: set by Webba, for Webba, and never shared with advertisers. Most are strictly functional — they keep you signed in, grant access to a conversation or a purchase, or remember a small interface preference. One, webba_src, is for measurement: it remembers how you first arrived, so we can tell which links and searches bring buyers. Webba uses no advertising, no cross-site tracking, and no third-party analytics. ⚖ Legal review recommended: confirm whether the first-party measurement cookie (webba_src) needs consent in the jurisdictions you serve (e.g. ePrivacy/EEA, UK). It can be switched off by configuration (ANALYTICS_ATTRIBUTION_COOKIE=off) without a code change.

Cookies we set

marketplace_session — keeps an operator signed in to the admin area. Holds an opaque session token; HTTP-only; about 30 days.
webba_deal_room — grants a buyer access to their own conversation(s) with a seller. Holds signed access tokens; HTTP-only; about 30 days.
webba_purchase — grants a buyer access to their purchase. Holds a signed access token, limited to purchase pages; HTTP-only; about 30 days.
webba_src — measurement. Set on your first visit to a page: the campaign tags on the link you followed (utm_source, utm_medium, utm_campaign) if it had any, otherwise the kind of site that referred you and its host name, the page you landed on, and the time. It holds no IP address and nothing that identifies you, is read only if you later send an inquiry, offer or purchase request, and lasts 30 days. HTTP-only.

These cookies are marked HTTP-only (not readable by page scripts), use the “lax” same-site setting, and are served securely in production. Cookies are set per website address: a domain’s own page (for example a name’s lander) has its own.

Browser storage we use

sessionStorage — a per-visit analytics id. A random identifier generated in your browser so we can group the actions of a single visit for our own product analytics. It is not a cookie, is not linked to your identity, and is cleared when you close the tab. If your browser blocks it, the site still works.
localStorage — whether you have seen the chat introduction. Remembers that the Chat with Webba introduction has been shown, so it is not shown again. Never sent to our servers.
localStorage — an admin interface preference. The admin merchandising tools remember one on/off layout preference locally. It is never sent to our servers and does not apply to ordinary visitors.

Analytics

Our measurement is first-party and stays in our own database. Page views are counted on our servers: to count a visitor once rather than on every reload, we derive a keyed, one-way code from the IP address and browser type that changes every day; the IP address itself is not stored with the view, only the host name of the site that referred you. We also record a few actions — searches, opening Buy Now, following a WhatsApp, phone or email link, moving from one name to another — and, with an inquiry, offer or purchase request, how you first arrived (from webba_src). Visits from automated crawlers are not recorded. We do not use Google Analytics or any other third-party analytics or advertising service. See our Privacy Policy for how this data is used.

Contact

Questions: hello@webba.com.