Cookie Notice

Last updated: 2 November 2026

Change note. November 2026: analytics and ad measurement now load on visit outside consent regions; a decline or Global Privacy Control turns them off. Earlier declines stay declines.

1. About this notice

This Cookie Notice explains how 8x Social, Inc., a Delaware corporation ("8x," "we," "us") uses cookies and similar browser-storage technologies on the 8x web platform (the "Platform"). It supplements, and should be read together with, our rep & applicant privacy notice (see Rep & Applicant Privacy Notice).

Scope of users. The Platform is used by sales representatives engaged as independent contractors, by applicants who sign up to be considered as such, and by businesses that visit our company pages (the home page, the /for-companies pages, and the 8x Dialer pages at /dialer and its feature pages) to learn about or book 8x's services. This notice addresses the cookies set in those visitors' browsers. It does not address the personal data of the prospects 8x contacts; for how 8x handles prospect personal data, see Prospect Privacy Notice and the cold-call disclosure (see call-recording disclosure scripts).

Summary. 8x uses first-party cookies that are strictly necessary or functional to run the Platform. Analytics — our product analytics (PostHog) and Google Analytics — and, on our company pages only, the Meta Pixel and the Google Ads tag, which measure which of our ads bring businesses to us, follow the consent rule in Section 4. Where consent is required (the EU, the EEA, the UK, Switzerland, Quebec, Brazil, Turkey, the United Arab Emirates, and wherever we cannot tell your country, or your country is not yet on our list), they load only if you accept through our cookie banner. Elsewhere they load when you visit, and you can opt out at any time through Your Privacy Choices. A rejection, or your browser's Global Privacy Control signal, always turns them off; if you decline, PostHog keeps only a privacy-preserving, non-identifying count (no cookies, no device storage). When a business submits an inquiry, books a call or joins the 8x Dialer waitlist, our server reports that conversion to Meta (and a call booked on Cal.com to Google Analytics too), under the same rule. You can change your choice at any time (see Section 6).

Controller and contact. The controller responsible for the personal data processed via these cookies is 8x Social, Inc., a Delaware corporation, 1111B S Governors Ave STE 47647, Dover, DE 19904, United States. For privacy questions, contact our Privacy Team at privacy@8x.social.

2. What cookies are

A cookie is a small text file stored in your browser when you visit a website. Cookies can be:

First-party (set by the site you are visiting — here, the 8x Platform) or third-party (set by another domain). 8x's own cookies are first-party. When analytics runs (Section 4), Google Analytics additionally sets cookies associated with Google as a third party, and on our company pages the Google Ads tag and the Meta Pixel set cookies associated with Google and Meta.
Session (deleted when you close your browser) or persistent (stored until they expire or you delete them).
Strictly necessary / essential (required for the site to function and for you to log in securely), functional (remember your preferences or context), analytics (measure usage), or advertising (track you for marketing). 8x uses strictly-necessary and functional cookies always, and analytics (PostHog product analytics and Google Analytics) and advertising cookies, which only measure our own ads, under the consent rule in Section 4.

Some of the values below use the __Host- prefix. This is a security hardening measure: a __Host--prefixed cookie is sent only over HTTPS, scoped to the exact origin that set it, and cannot be set or overwritten by subdomains. It does not make the cookie a tracker.

3. Cookies we use

The essential and functional cookies below are first-party, set by the 8x Platform itself. Analytics — PostHog product analytics and Google Analytics — and the advertising cookies follow the consent rule in Section 4: our own two advertising cookies are set by our server, and the Meta and Google ones appear only on our company pages.

Cookie	Category	Purpose	Set by	Duration
Supabase authentication session cookies	Strictly necessary (essential)	Keep you securely logged in. These cookies carry your authenticated session so the Platform knows who you are on each request and can enforce access controls. Without them you cannot sign in or use the Platform.	8x (via our authentication provider, Supabase — see Sub-processors)	Session / the lifetime of your authenticated session
`__Host-8x_view_as_rep`	Functional / essential to an administrative feature	Records that an authorized 8x administrator is using the "view as rep" impersonation tool to see the Platform as a particular representative would. It is set only when an admin activates that feature and governs which view is rendered. It is not a tracking or profiling cookie.	8x	Up to 2 hours / cleared when impersonation ends
`__Host-displayLocale`	Functional	Remembers your selected display language / locale preference (i18n) so the interface renders in your chosen language across visits.	8x	Persistent (until you clear it or change your language preference)
`8x-cookie-consent` (browser localStorage and a first-party cookie)	Strictly necessary (records your choice)	Stores whether you accepted or rejected analytics and advertising cookies, so we do not ask again and they stay off unless you accepted. The cookie copy lets our server read the same choice. Cookie settings removes the stored choice, sets the cookie copy to "denied" and re-shows the banner; where consent is not required, the same link reads Your Privacy Choices and opens the banner, and Reject stores "denied".	8x	Persistent (until you use Cookie settings or clear site data); the cookie copy lasts 1 year from your last visit
`_8x_region`	Strictly necessary	Records whether the rule for your country asks for consent first (`consent`) or tracks on load (`open`), so the banner knows whether to ask. Our server sets it from the country (and, in Canada, the province) our hosting provider derives from your IP address; it holds no identifier and no choice.	8x	1 day
`__Host-detectedRegion`	Functional	Records the country our hosting provider derives from your IP address, so the rep pages open in the matching language.	8x	1 hour
`__Host-8x_cal_oauth_nonce`	Strictly necessary (security)	Protects the Google Calendar connection from forged requests: a one-time random value checked when Google sends you back to 8x. Set only while you connect a calendar.	8x	1 hour
`__Host-adminCampaign`	Functional (8x administrators only)	Remembers which campaign an 8x administrator last chose in the admin console.	8x	90 days
`rep_home_seen`	Functional (rep app)	Remembers that the rep app's Home page has played its opening animation, so it plays only once per browser session.	8x	Session
`sidebar_state`	Functional (rep app)	Remembers whether you collapsed the rep app's sidebar.	8x	1 year
`ph_…_posthog`	Product analytics (first-party)	Set by PostHog, our product-analytics provider, to understand how the Platform is used so we can improve it. Set only under the consent rule in Section 4; if you decline, or your browser sends Global Privacy Control, PostHog sets no cookies or storage and keeps only a privacy-preserving, non-identifying count. Session recording shows only the Platform's interface text (navigation, tabs, column headings, labels, steps, error headings, and the text of our public website, sign-in and legal pages); all other text and every form input stay masked, so names, emails, phone numbers, notes, and lead data are not captured. Served first-party via the 8x origin.	8x (via PostHog — see Sub-processors)	Persistent (about 1 year) — only under Section 4's rule
`_ga`, `_ga_<stream-id>`	Analytics (third-party — Google)	Google Analytics 4. Distinguishes visitors and sessions to measure site usage. Set only under the consent rule in Section 4; if you decline, your browser sends Global Privacy Control, or you have not chosen where consent is required, Google Analytics does not load and these cookies are never set.	8x (via Google — see Sub-processors)	Persistent (up to 2 years)
`8x_src`	Advertising measurement (first-party)	Remembers how you first reached the site (the campaign tags in the link, the referring site and the page you landed on), so an inquiry, a call booked through Book a call or a sign-up to the 8x Dialer waitlist can be credited to the campaign that brought you. Set and read only by our server, while your consent holds (Section 4), and expired as soon as it does not.	8x	90 days
`8x_ad`	Advertising measurement (first-party)	Remembers the ad click you arrived from (the click identifier Google, Meta or TikTok adds to the link), so an inquiry, a booked call or a sign-up to the 8x Dialer waitlist can be credited to that ad. Set and read only by our server, under the same consent rule as `8x_src`.	8x	90 days
`_fbp`, `_fbc`	Advertising measurement (third-party — Meta)	Meta Pixel, on our company pages only. Identify your browser and the Meta ad you clicked, so Meta can count our conversions and optimise who sees our ads. Set only under the consent rule in Section 4, and never if your browser sends Global Privacy Control.	8x (via Meta — see Sub-processors)	90 days
`_gcl_au`, `_gcl_aw`	Advertising measurement (third-party — Google)	Google Ads tag, on our company pages only. Link an inquiry, a booked call or a sign-up to the 8x Dialer waitlist to the Google ad that led to it. Set only under the consent rule in Section 4, and never if your browser sends Global Privacy Control.	8x (via Google — see Sub-processors)	Up to 90 days

The Supabase authentication session is implemented as first-party cookies on the 8x origin; no third-party Supabase-domain cookie is set in your browser.

4. Analytics, advertising measurement and your consent

We use analytics to understand how the Platform is used so we can improve it, and advertising measurement to see which of our ads bring businesses to us. We handle them as follows:

Google Analytics (third-party): Where consent is required, loaded only after you accept through the cookie banner; until you accept, the Google Analytics script is not loaded at all and sets no cookies (this is Google's "basic" consent mode). Elsewhere it loads when you visit, unless you have rejected or your browser sends Global Privacy Control. You can decline as easily as you can accept, and you can change your mind later (Section 6).
Product analytics (PostHog, first-party): Follows the same rule. Where consent is required, it runs only after you accept through the same cookie banner; until you accept, PostHog sets no cookies or storage. Elsewhere it runs when you visit, unless you have rejected or your browser sends Global Privacy Control. If you decline, PostHog keeps only a privacy-preserving, non-identifying count of visitors who declined (a server-side hash — no cookies, no device storage, no personal data). Event capture and session recording run only while the rule allows them, and session recording shows only the Platform's interface text (navigation, tabs, column headings, labels, steps, error headings, and the text of our public website, sign-in and legal pages) while all other text and every form input stay masked, so readable personal data is not captured.
Meta Pixel and Google Ads tag (third-party, company pages only): We advertise 8x's services to businesses on Meta and Google. On our company pages (the home page, the /for-companies pages except the company sign-in page, and /dialer and its feature pages), and never on the rep pages, the rep app, the admin console or private links, these two tags follow the same rule (only after you accept where consent is required, when you visit elsewhere) and never load if your browser sends Global Privacy Control. They tell Meta and Google which page you viewed and whether you submitted an inquiry, booked a call or joined the 8x Dialer waitlist, so we can see which ads work and Meta and Google can optimise who sees our ads.
Conversions our server reports: When a business submits an inquiry, books a discovery call or joins the 8x Dialer waitlist (on /dialer or one of its feature pages), our server reports it to Meta (through Meta's Conversions API) and, for a call booked on Cal.com, to Google Analytics. To Meta it sends the event, its time and page, the email address entered (hashed with SHA-256, never in plain text), the Meta identifiers from _fbp, _fbc or 8x_ad, and, when the conversion happens on our site, the IP address and browser user agent of that request. To Google Analytics it sends only the event and the client identifier from _ga. When you use Book a call, the campaign tags and these identifiers travel to Cal.com with your booking only while your consent holds, so the booking can be credited; otherwise Cal.com receives only a note that it does not, and never the referring site. While your consent holds, we also keep the campaign tags, and the identifier, platform and time of your most recent ad click, with your inquiry, booking or waitlist entry for as long as we keep that record, so we can count how many inquiries, booked calls and waitlist sign-ups each ad brought.
Where consent is required, and elsewhere: Consent is required in the EU (including its outermost regions and the Åland Islands), Iceland, Liechtenstein, Norway, the UK, Switzerland, Gibraltar, the Isle of Man, Jersey, Guernsey, Quebec, Brazil, Turkey and the United Arab Emirates, and wherever we cannot tell your country from your IP address, or your country is not yet on our list. There, none of the analytics or advertising measurement above happens until you accept: no tags, no server-side report, and no 8x_src or 8x_ad cookie. Everywhere else all of it is on when you visit, unless you reject (in the banner or through Your Privacy Choices) or your browser sends Global Privacy Control. A rejection, or Global Privacy Control, always wins, even over an earlier Accept.
No fingerprinting or data-broker tags are present.

Jurisdiction-specific note. Cookie/consent rules differ by market:

EU / UK (ePrivacy): Storing or reading information on a user's device generally requires prior consent except for cookies that are strictly necessary to provide the service the user has requested. EU/UK is in scope — GDPR and the ePrivacy Directive apply (see Rep & Applicant Privacy Notice, "International transfers" / territorial scope). Google Analytics, PostHog product analytics and all of the advertising measurement above are therefore gated behind opt-in consent and are not loaded, set or sent unless you accept (if you decline, PostHog keeps only a cookieless, non-identifying count). The functional cookies (locale preference, impersonation) are disclosed in this notice.
US (CCPA/CPRA): The Meta Pixel and the Google Ads tag on our company pages count as "sharing" personal information for cross-context behavioral advertising under California law. You can opt out at any time: use Your Privacy Choices in the footer (marked with California's opt-out icon) and choose Reject, or turn on Global Privacy Control, which we honor as an opt-out.
Brazil (LGPD), Mexico, India (DPDP): Brazil is a region where consent is required, so everything above waits for your Accept. In Mexico and India, analytics and advertising measurement run when you visit and you can opt out through Your Privacy Choices. We address any additional local requirements through our broader privacy program.

5. Our commitment when analytics changes

Consistent with the commitment in earlier versions of this notice, when we introduced analytics (Google Analytics, and when we brought PostHog product analytics under the same banner) we, at deployment:

Updated this Cookie Notice to describe each service, its purpose, the recipients (Google and PostHog), and its duration; and
Implemented a consent mechanism — a cookie banner that loads analytics only on acceptance, with reject offered as easily as accept, and the ability to change your choice (Section 6).

When we introduced advertising measurement on our company pages (October 2026), its tags loaded only through the same banner from the start; this version of the notice adds the description in step 1.

Since November 2026, outside the regions where consent is required (Section 4), analytics and advertising measurement load when you visit, with Your Privacy Choices as the opt-out.

For any future non-essential cookie or tracking technology, we will apply the same two steps before, or at the point at which, we rely on it, and honor opt-out preferences where opt-out is the applicable standard.

6. Managing cookies and your choice

Withdrawing or changing your consent. You can withdraw consent for analytics (Google Analytics and PostHog) and advertising measurement at any time, as easily as you gave it: select Cookie settings in the footer of the website, the sign-in pages and these legal pages, or at the bottom of your Profile page in the rep app. Where consent is not required, the same link reads Your Privacy Choices and opens the banner without changing anything; choosing Reject there stops analytics and the advertising tags on the page straight away, stores "denied" and deletes the same cookies as below, without showing the banner again. Cookie settings stops analytics and the advertising tags on the page straight away. It deletes the stored 8x-cookie-consent choice and sets its cookie copy to "denied", deletes the Google Analytics cookies (_ga, _ga_<stream-id>), the Google Ads and Meta cookies (_gcl_au, _gcl_aw, _fbp, _fbc) and the PostHog cookie and storage, and shows the banner again so you can make a new choice. Our server expires 8x_src and 8x_ad on your next page load and stops reporting your conversions. Analytics and the advertising tags do not load again until you accept. Cookie settings also lets you change an earlier rejection. Withdrawing does not affect the lawfulness of analytics or advertising measurement carried out before you withdrew.

Essential and functional cookies are required for the Platform to work — in particular, blocking the authentication session cookies will prevent you from logging in.

You can control or delete cookies through your browser settings. Most browsers let you view stored cookies, delete them, and block cookies from specific sites. See your browser's help documentation (Chrome, Firefox, Safari, Edge) for instructions. Note that clearing cookies will sign you out, reset your saved locale preference, and reset your cookie choice.

Cross-references: Rep & Applicant Privacy Notice · Prospect Privacy Notice · Sub-processors