Car Studio AI — Cookie & SDK Policy
Version 2.0 · Effective date: 30 September 2026 · Last updated: 30 September 2026
Applies to: carstudio.ai, app.carstudio.ai (including the business/dealer panel), and the Car Studio AI iOS and Android apps.
1. What this policy is about
Our website uses cookies and browser storage; our web application uses cookies, browser storage and third-party tags; our mobile apps use software development kits (SDKs) and device identifiers that do the same job as cookies. This policy lists every one of them by name, what it is for, who sets it, how long it lasts, and how you can turn it off.
Two rules apply everywhere:
- In the EEA, UK and Switzerland, nothing optional runs on carstudio.ai without your choice. Only items we need to run the service are set automatically. Everything used for analytics, session replay or advertising waits for your decision (Microsoft Clarity runs without cookies until then, see 3.2), and refusing costs you no feature. Elsewhere on carstudio.ai optional items run on notice (Section 2); exceptions on app.carstudio.ai and in the mobile apps are stated in Sections 4 and 5.
- You can change your mind. Web, in the EEA, UK and Switzerland: footer link "Cookie settings"; elsewhere: e-mail kvkk@carstudio.ai or block cookies in your browser. Apps: your device's tracking and notification settings.
2. How we ask — carstudio.ai
In the EEA, UK and Switzerland — and wherever we cannot determine your country — your first visit shows a banner with two equally weighted one-click buttons, "Accept all" and "Necessary only"; optional items stay off until you opt in. Elsewhere, including Türkiye, you see a notice and optional items run; to object, e-mail kvkk@carstudio.ai or block cookies in your browser settings. The banner accepts or refuses both optional categories together. Your choice is stored in the cs_consent cookie for 180 days (after which we ask again) and logged with a time stamp and the banner version so we can demonstrate it. The two optional categories are:
- Analytics — Google Analytics 4 (via Google Tag Manager), Microsoft Clarity, PromptWatch.
- Marketing — Meta Pixel, attribution storage of ad-click identifiers, Google advertising signals.
Google tags receive your choice through Consent Mode v2 (analytics_storage, ad_storage, ad_user_data, ad_personalization). Without consent Google receives only cookieless, non-identifying pings. Meta Pixel and PromptWatch are not loaded at all until you allow their category. Microsoft Clarity loads on every visit but, until you allow Analytics, runs without cookies through its own consent signal (each page view is recorded separately and cannot be linked to your other visits); its cookies are set only after you allow Analytics.
3. carstudio.ai — cookies and storage
3.1 Strictly necessary — no consent required
| Name | Set by | Purpose | Type | Duration |
|---|---|---|---|---|
cs_consent | Car Studio AI | Stores your cookie choice (version.analytics.marketing.id) | Cookie, first-party | 180 days |
locale | Car Studio AI | Remembers your language | Cookie, first-party + localStorage | Cookie: session; localStorage: until cleared |
cs_guide | Car Studio AI | Remembers that you requested our used-car sales guide, so the PDF opens directly next time | Cookie, first-party + localStorage | 1 year |
user-country | Car Studio AI | Country detected from your connection, used on the pricing page to show regional pricing | localStorage | Until cleared |
theme | Car Studio AI (next-themes) | Light/dark mode | localStorage | Until cleared |
npblur_* (npblur_selected_image, npblur_selected_image_name, npblur_processed_image, npblur_last_processed_image, npblur_custom_plate_image, npblur_custom_plate_image_name, npblur_processing_type, npblur_process_credential, npblur_process_credential_date, npblur_user_email, npblur_user_phone) | Car Studio AI | Free number-plate tool: keeps your selected and processed images and your registration in your browser so you can download results and reuse the tool within the day | localStorage | Until you clear the browser; the daily usage credential is removed on your first visit the next day |
| Vercel Web Analytics & Speed Insights | Vercel | Cookieless traffic and performance measurement; visitors identified by a request hash discarded after 24 h; no cross-site tracking | No cookie or storage | — |
3.2 Analytics — with your consent in the EEA, UK and Switzerland; on notice elsewhere
| Name | Set by | Purpose | Type | Duration |
|---|---|---|---|---|
_ga | Google Analytics 4 | Distinguishes visitors | Cookie, first-party | 2 years |
_ga_[measurement ID] | Google Analytics 4 | Keeps session state | Cookie, first-party | 2 years |
_clck | Microsoft Clarity | Persists the Clarity user ID and preferences | Cookie, first-party | 1 year |
_clsk | Microsoft Clarity | Connects page views into one session recording | Cookie, first-party | 1 day |
CLID | Microsoft | Identifies the first time Clarity saw this user across Clarity-using sites | Cookie, third-party (clarity.ms) | 1 year |
ANONCHK | Microsoft | Indicates whether MUID is transferred to ANID (ad-measurement flag) | Cookie, third-party | 10 minutes |
MR | Microsoft | Indicates whether to refresh MUID | Cookie, third-party | 7 days |
MUID | Microsoft | Microsoft's cross-site user identifier (advertising and analytics) | Cookie, third-party | 1 year |
SM | Microsoft | Synchronises MUID across Microsoft domains | Cookie, third-party | Session |
| PromptWatch client | PromptWatch B.V. | Measures visits that arrive from AI assistants and logs AI-crawler activity | Script; storage not documented by the provider | Not documented by the provider |
Microsoft states that it acts as an independent controller for Clarity data. Clarity receives cookieless page-view recordings on carstudio.ai before you choose; allowing the Analytics category also allows Clarity's cookies and links your page views into one session. We run Clarity with
ad_Storagedenied unless you also allow Marketing. Masking on carstudio.ai is set to Relaxed: input boxes and drop-downs are masked; other text and images, including photos you upload to the free tools, are recorded as displayed.
3.3 Marketing — with your consent in the EEA, UK and Switzerland; on notice elsewhere
| Name | Set by | Purpose | Type | Duration |
|---|---|---|---|---|
_fbp | Meta Pixel | Identifies browsers for ad measurement and audiences | Cookie, first-party | 3 months |
_fbc | Meta Pixel | Stores the last Meta ad-click ID (fbclid) | Cookie, first-party | 3 months |
cs_attribution | Car Studio AI | Remembers UTM parameters and ad-click IDs (gclid, fbclid, msclkid) so a sign-up can be attributed to the campaign; cleared when you refuse or withdraw marketing consent | sessionStorage | Until the tab is closed |
| Google ad signals | ad_storage, ad_user_data, ad_personalization set to granted | Consent Mode signal | — |
4. app.carstudio.ai — the web application
On app.carstudio.ai the tags listed in 4.2 load when a page opens. The cookie notice records your acknowledgement in cookieConsent. You can block these tags with browser tracking protection or with the provider opt-outs listed in Section 6. We are working to bring app.carstudio.ai under the same consent banner as carstudio.ai.
4.1 Strictly necessary
| Name | Set by | Purpose | Type | Duration |
|---|---|---|---|---|
authToken | Car Studio AI | Keeps you signed in to the web application | Cookie, first-party | 365 days |
userCountry | Car Studio AI | Country detected from your connection (pricing, tax) | Cookie, first-party | 365 days |
cookieConsent | Car Studio AI | Records your cookie choice | localStorage | Until cleared |
exportConfig | Car Studio AI | Remembers your last export settings in the editor | localStorage | Until cleared |
NEXT_LOCALE | Car Studio AI (next-translate) | Language (set only when you choose a language other than the default) | Cookie, first-party | 100 days |
4.2 Analytics, chat and marketing tags on app.carstudio.ai
| Provider | Identifier in our code | Cookies / storage | Purpose | Category |
|---|---|---|---|---|
| PostHog (EU Cloud, Frankfurt) | EU project 282892 | ph_[token]_posthog (365 days) + localStorage | Product analytics: editor, export and subscription funnels; session replay with all text and input fields masked — uploaded and generated images, videos and canvases are not recorded | Analytics |
| Google Analytics 4 | G-Q4N6K3GLLN | _ga, _ga_Q4N6K3GLLN (2 years) | Product analytics; events such as downloads and exports | Analytics |
| Google Tag Manager | GTM-TV4VH6GT | As configured in the container | Tag loading | Analytics / Marketing |
| Microsoft Clarity | project seacelfwoe | _clck, _clsk, CLID, MUID, ANONCHK, MR, SM (see 3.2) | Session replay of the editor and profile pages. Masking Relaxed: input boxes and drop-downs masked; other text and images — including your uploaded vehicle photos and generated results — recorded as displayed | Analytics |
| HubSpot (EU data centre) | portal 144222788 | __hstc (6 months), hubspotutk (6 months), __hssc (30 minutes), __hssrc (session), messagesUtk (6 months, chat) | Chat widget and visitor tracking for our sales/CRM | Analytics; messagesUtk becomes necessary once you open the chat |
| Meta Pixel | 1179501864341198 | _fbp, _fbc (3 months) | Conversion measurement for Meta ads | Marketing |
| Stripe | — | __stripe_mid (1 year), __stripe_sid (30 minutes) on the checkout page | Fraud prevention and payment security | Strictly necessary (only on checkout) |
5. Mobile apps — SDKs and identifiers
Mobile apps do not use browser cookies; SDKs and device identifiers do the same job. The operating-system permission prompts (camera, photos, notifications, tracking) are separate from, and do not replace, the privacy choices below.
5.1 Your choices in the app
- What runs on launch: the apps do not currently have a separate in-app privacy screen. The SDKs in 5.2 and 5.3 start when the app opens; the advertising SDKs in 5.4 start after the iOS tracking prompt has been answered.
- iOS tracking prompt (App Tracking Transparency): decides whether the advertising identifier (IDFA) may be read by Adjust, Meta and TikTok. Change in Settings › Privacy & Security › Tracking. We show no ads in the app; the identifier is used only to measure which campaign brought you and to reconcile purchases.
- Android advertising ID: reset or delete in Settings › Google › Ads.
- Notifications: system permission; withdraw in device settings.
5.2 Necessary — run automatically
| SDK | Provider | Identifiers and data | Purpose | Retention (provider) |
|---|---|---|---|---|
| App storage (MMKV, Redux Persist) | Car Studio AI | Login token, settings, cached projects — stored on the device | Running the app offline-tolerant | Until you log out or uninstall |
| Firebase Crashlytics | Installation ID, crash trace, device, OS, app version | Crash reporting | 90 days | |
| Firebase Remote Config | Installation ID, app version, country | Feature flags | — | |
| Sentry | Functional Software, Inc. | Error trace, device, OS, app version, account e-mail address, truncated IP | Error and performance monitoring | 90 days |
| OneSignal | OneSignal, Inc. | Push token, device, OS, language, time zone, app version, user ID, notification interactions | Push notifications (only if you allow notifications) | Duration of our contract |
| RevenueCat (iOS) | RevenueCat, Inc. | Device type, OS, Apple receipt, app user ID | Validating in-app purchases and restoring them | Duration of our contract |
| Adapty | Adapty Tech Inc. | IDFV / app-set ID, device, OS, language, time zone, subscription events, user ID | Paywall configuration; subscription state | Duration of our contract |
| Google Sign-In | Google account token | Optional login | — | |
Device info (react-native-device-info) | — | Device model, OS version, app version | Support diagnostics and compatibility | — |
5.3 Analytics and session replay
| SDK | Provider | Identifiers and data | Purpose | Retention |
|---|---|---|---|---|
| PostHog (React Native SDK) | PostHog, Inc. — EU Cloud, Frankfurt | Random distinct ID and device ID stored on the device; app opened/backgrounded/installed/updated, screen views, feature events; device model, OS, app version, language; country from IP (IP not stored) | Usage measurement; feature flags. Starts on launch; no session replay | Events 1 year |
| Firebase Analytics | Google LLC | App-instance ID, our named events (screen views, feature use, purchases; the sign-up event includes your e-mail address) and Firebase's standard automatic events, device, approximate location from IP | Usage measurement. Starts on launch on Android and, on iOS, once the tracking prompt has been answered | 2 months |
| Microsoft Clarity (React Native SDK 4.x, Android only) | Microsoft Corporation — independent controller | Screen-layout reconstruction, taps, scrolls, gestures, screen names, device, country from IP | Session replay and heatmaps to find usability problems. Masking Balanced: input fields, numbers and e-mail addresses masked; other text and images, including uploaded vehicle photos and results, recorded as displayed | Recordings 30 days; heatmaps and flagged recordings up to 9 months |
5.4 Advertising measurement — after the iOS tracking prompt
| SDK | Provider | Identifiers and data | Purpose | Notes |
|---|---|---|---|---|
| Adjust (SDK 5.x) | Adjust GmbH (Germany) | IDFA/GAID (only with tracking permission), IDFV/app-set ID, IP, device, install, sign-up, login and purchase events; sensor signals for fraud detection | Which campaign led to the install; fraud prevention | Waits up to 60 s for your ATT answer before sending |
| Meta (Facebook) SDK | Meta Platforms | App events (install, sign-up, purchase), advertising ID only with tracking permission, device, IP | Measuring Meta ad campaigns | Advertiser-ID collection is switched on or off according to your ATT answer; automatic app-event logging is on |
| TikTok Business SDK | TikTok Pte. Ltd. | App events, advertising ID with tracking permission, device, IP | Measuring TikTok ad campaigns | Started after the ATT answer |
6. How to opt out or control tracking on your own
- Web: in the EEA, UK and Switzerland, footer "Cookie settings" on carstudio.ai (reopens the banner); elsewhere, e-mail kvkk@carstudio.ai; everywhere, browser settings to block or delete cookies (this may sign you out).
- PostHog: PostHog holds data only on our behalf; to object or to have your PostHog data deleted, e-mail kvkk@carstudio.ai.
- Google Analytics: tools.google.com/dlpage/gaoptout · Google ads settings: adssettings.google.com
- Microsoft Clarity / Microsoft: privacy.microsoft.com · account.microsoft.com/privacy/ad-settings
- Meta: facebook.com/ads/preferences · facebook.com/settings?tab=ads
- HubSpot: cookie and tracking information at legal.hubspot.com/privacy-policy
- TikTok: in-app Settings › Privacy › Ads
- Adjust: adjust.com/opt-out
- iOS: Settings › Privacy & Security › Tracking · Android: Settings › Google › Ads
- Industry opt-outs: youronlinechoices.eu (EU), optout.aboutads.info (US)
7. Changes and contact
We update this list whenever we add, remove or reconfigure a tool; the version and dates at the top change accordingly, and material changes trigger a new banner decision. Questions: kvkk@carstudio.ai.
Related: Privacy Policy · Terms of Service