Cookies are small text files stored on your device when you visit a website. They help sites function properly, remember your preferences, and provide usage analytics.
These cookies are essential for the platform to function. They cannot be disabled.
| Cookie | Purpose | Duration |
|---|---|---|
next-auth.session-token | Authentication session | Session |
next-auth.csrf-token | CSRF protection | Session |
next-auth.callback-url | Auth redirect handling | Session |
cookie-consent (kept in your browser's local storage, not a cookie) | Remembers the choices you made in the cookie banner, for this site address | No fixed expiry: kept until you change your choices or clear this site's data |
The cookie banner asks only about what can run on the page you are on. Everywhere, it asks about session recording, and about PartnerAPI's own product analytics. On a partner portal whose organisation has set up Google Analytics, it also asks about that organisation's analytics, and, where the organisation has also turned on advertising measurement, about that too. Each choice is separate: you can accept one and decline another, and nothing is switched on that you were not asked about. If an organisation adds Google Analytics or advertising measurement after you made your choice, the banner asks you again, about the new choice only.
PartnerAPI uses Sentry to record how pages behave during a visit, so we can find and fix problems. Recordings hide the text on screen. With your consent, Sentry also links error reports to your account's internal identifier (never your name or email address). Nothing is recorded before you consent, and recording stops when you withdraw.
| Cookie | Purpose | Duration |
|---|---|---|
| Sentry session | Session recording, error monitoring and performance tracking | Session |
PartnerAPI uses Amplitude to understand how its product is used: which pages and features are used and where people get stuck, so we can improve them. Amplitude is set to store and process this data in the European Union. The banner asks about it on every PartnerAPI page as a separate choice, Product analytics, which measures which features you use so PartnerAPI can improve them. Nothing is collected and the Amplitude script is not started before you consent.
With your consent, Amplitude receives the pages you view (the page's address with identifiers and search terms removed) and the actions you take in the product, such as starting a sign-up step or sending a message, described by type and never by their content. On the sign-up and sign-in pages, before you have a role in the organisation whose site you are on, only a random identifier stored on your device is used; elsewhere nothing is collected until you have one. Once you have a role, we identify you only by an internal account identifier, together with your organisation's identifier and your role. Amplitude never receives your name, your email address or the text you type, and is set not to store your IP address or derive your location from it. It does not record clicks or form fields automatically. PartnerAPI staff are never included, and neither is an organisation's admin while they view a partner's portal as that partner.
Amplitude does not set cookies here. It keeps its identifiers in your browser's local storage, separately for each site address, so they are never shared between one organisation's site and another's. If you withdraw consent, collection stops and these entries are deleted; signing out deletes them too.
| Local storage entry | Purpose | Duration |
|---|---|---|
AMP_<first 10 characters of the project key> | Amplitude — device identifier, session identifier, account identifier once signed in, and your opt-out state | Until you withdraw consent, sign out or clear your site data |
AMP_unsent_<first 10 characters of the project key> | Amplitude — events waiting to be sent | Until they are sent, you withdraw consent, sign out or clear your site data |
These cookies appear only on a partner portal whose organisation has connected its own Google Analytics, and only after you consent to analytics. No further analytics data is collected or sent once you withdraw consent.
| Cookie | Purpose | Duration |
|---|---|---|
_ga | Google Analytics — distinguishes unique visitors | 2 years |
_ga_<container-id> | Google Analytics 4 — persists session state | 2 years |
_gid | Google Analytics — distinguishes unique visitors | 24 hours |
Google Analytics. PartnerAPI does not use Google Analytics itself. An organisation that runs a partner portal on PartnerAPI can choose to connect its own Google Analytics account to measure page views and aggregate usage on that portal's pages. Where it has, the data goes to that organisation's Google Analytics account, under the organisation's own agreement with Google (Google Ireland Ltd, with processing by Google LLC in the United States), and the organisation decides how it is used — PartnerAPI does not receive it. The Google Analytics script is loaded only after you grant analytics consent in our cookie banner — no analytics cookies are set and no data is sent to Google before you consent. The legal basis is your consent (GDPR Art. 6(1)(a) and the ePrivacy Directive). Questions about how an organisation uses its analytics data should go to that organisation.
What the organisation's Google Analytics receives, once you consent: page views on the portal's partner-facing pages (its landing page, sign-in and sign-up pages, and the portal itself), and the steps of signing up and signing in (for example "signed up" and "signed in", with the sign-in method). The page addresses and titles the portal sends are cleaned first: invitation codes, sign-in parameters, email addresses and record identifiers are removed, and only campaign tags and Google Ads click identifiers are kept. No name, email address or account identifier is sent. Analytics consent covers analytics only: unless you also consent to advertising measurement (below), Google's advertising storage stays switched off and no advertising cookie is set. Google Analytics can also record page changes itself, from the full page address; the organisation is asked to switch that option off, and where it has not, Google receives those addresses uncleaned. If you arrive from an advertisement before choosing, its campaign tags are held in your browser for that tab only, and are sent with your first page view if you consent or deleted if you decline. A note that you started signing in is likewise kept in your browser for up to an hour, so the sign-in can be counted once it completes; nothing is sent unless you have consented.
You can opt out at any time by declining or withdrawing analytics consent in the cookie consent banner, or by installing the Google Analytics Opt-out Browser Add-on. Withdrawing analytics also ends advertising measurement.
An organisation that uses Google Analytics on its portal can also choose to count partner sign-ups as conversions in its own Google Ads account. Only where it has does the cookie banner ask about advertising measurement, as a separate choice from analytics; it needs analytics to work.
If you consent, the organisation's Google tag may set Google's conversion-linker cookies (_gcl_au, _gcl_aw, _gcl_gb and similar _gcl_* cookies) and tell Google Ads which sign-ups followed a click on one of the organisation's ads (Google Consent Mode's advertising storage and advertising user data are switched on). The data goes to the organisation's Google Ads account under its own agreement with Google; PartnerAPI does not receive it. Ad personalisation stays switched off: your visit is not used to personalise the ads you see, and Google signals stay off. If you decline or withdraw, advertising storage is switched off again and analytics, if you allowed it, carries on. Withdrawing stops any further use; advertising cookies already set are not deleted by the banner and expire on their own after 90 days, unless you clear them in your browser sooner.
| Cookie | Purpose | Duration |
|---|---|---|
_gcl_au | Google Ads conversion linker — links a sign-up to an earlier ad visit | 90 days |
_gcl_aw, _gcl_gb and similar _gcl_* cookies | Google Ads — the click identifier from the ad you arrived from, when there was one | 90 days |
You can manage your cookie preferences at any time with a Cookie preferences link, which re-opens the cookie consent banner, or through your browser settings. Your choices are kept separately for each site address, so change them on the site you made them on: on PartnerAPI's own pages, the link is in the footer of these legal pages; on an organisation's partner portal, it is at the bottom of the portal's welcome, sign-in and sign-up pages and, once you are signed in, in your account menu. Where the banner offers more than one choice, Manage lets you switch each one on or off.
Most browsers allow you to:
Note that blocking strictly necessary cookies may prevent the platform from functioning correctly.
Under the GDPR and ePrivacy Directive, you have the right to:
If you have questions about our use of cookies, contact us at: