SIA ESTATE BASE
COOKIE POLICY
Estate Base Platform https://estatebase.ai/
Revised October 1, 2026. Effective from the date of publication on the Platform
Data Controller: SIA Estate Base, reg. No. 40203765991, legal address: Miera iela 87A-9, Riga, LV-1013, Republic of Latvia
1. About this Policy
1.1. This Cookie Policy explains which cookies and similar technologies SIA Estate Base ("Estate Base", "we", "us") uses on the estatebase.ai website (the "Platform"), why, for how long, and how you can control them.
1.2. It supplements our Privacy Policy, in particular its Section 12. Capitalised terms not defined here have the meaning given in the Privacy Policy and the Terms.
2. What cookies and similar technologies are
2.1. A cookie is a small text file that a website stores in your browser and reads back on later visits. Similar technologies include your browser's local storage and scripts that read information from your device, such as its screen size or language.
2.2. Under Article 5(3) of Directive 2002/58/EC (the ePrivacy Directive) and Section 7.¹ of the Latvian Law on Information Society Services, we may store information on your device, or read it from there, without your consent only where this is strictly necessary to provide the service you asked for. For anything else we ask first. Where a cookie involves personal data, Regulation (EU) 2016/679 (GDPR) applies as well.
3. Our approach in short
3.1. Without asking, we use only cookies and storage that are strictly necessary for the Platform to work (Section 4).
3.2. We use analytics only if you accept it (Section 5): our own Umami, which sets no cookies, and Google Analytics, which sets two.
3.3. We do not use advertising, marketing, social-media or cross-site tracking cookies, and we do not sell your data or build advertising profiles. The advertising features of Google Analytics are switched off.
3.4. Rejecting is as easy as accepting, and the Platform works fully either way.
4. Strictly necessary cookies and storage (no consent required)
4.1. These are set by estatebase.ai itself (first-party). The Platform cannot work properly without them, so they cannot be switched off in the cookie settings. To the extent they involve personal data, we process it to perform our contract with you and in our legitimate interest in running a secure service (Article 6(1)(b) and (f) GDPR).
| Name | Purpose | Duration |
|---|---|---|
__Secure-authjs.session-token | Keeps you signed in after you sign in. Holds an encrypted, signed session with your account ID. May be split into parts ending .0, .1 and so on. | 30 days, renewed while you use the Platform; deleted when you sign out |
__Host-authjs.csrf-token | Protects the sign-in and sign-out forms against cross-site request forgery. | Until you close the browser |
__Secure-authjs.callback-url | Remembers which page to return you to after you sign in. | Until you close the browser |
__Secure-authjs.state, __Secure-authjs.pkce.code_verifier, __Secure-authjs.nonce | Protect "Continue with Google" sign-in against tampering. Set only when you use it. | 15 minutes (nonce: until you close the browser) |
eb_google_signup | While you go to Google to create an account, carries your language, the page to return to and the consent boxes you ticked, so the account is created with your choices. Read once, then deleted. | 10 minutes |
eb_anon | Links a chat you start without an account to this browser, so that only you can continue it and it can move into your account if you sign up. A random value; we keep only a hashed form of it. | 30 days; deleted when you sign in or create an account |
NEXT_LOCALE | Remembers the language you chose. | Until you close the browser, or 1 year when you pick a language in the language menu |
eb_consent | Remembers your cookie choice: whether analytics is allowed, the version of this Policy and a random ID of the choice (see Section 8). | 6 months, after which we ask again |
pendingSwipeLikes (local storage) | On the swipe page, keeps the listings you liked before signing in, so they can be saved to your account when you sign in. | Until you sign in, or until you clear your browser data |
4.2. Two further cookies, eb_ops (12 hours) and eb_video_studio (8 hours), are set only for Estate Base staff who sign in to our internal administration tools. They are never set for visitors.
5. Analytics (only with your consent)
5.1. What we use. Two analytics tools, switched on and off together by the one "Analytics" choice:
(a) Umami, open-source web analytics that we host ourselves on our own servers in the European Union. Its data goes to no one else;
(b) Google Analytics 4, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, which processes the data on our behalf.
5.2. Umami: what it records. The address of each page you open (without the part after "?", so the text of a chat question is never recorded), the page you came from, your browser and operating system, device type, screen size and language, and your approximate location (country, region and city), which our server derives from your IP address. It also records presses of buttons and links by their on-screen label, never by anything you typed. When you sign in on a device, your visits on it are linked to your account ID, including the pages you opened in that visit before signing in, so that we can understand how people move through the Platform.
5.3. Umami: what it stores on your device. Nothing: Umami sets no cookies and uses no local storage. It recognises repeat visits with a pseudonymous identifier computed on our server from your IP address, browser details and a secret value that changes periodically. Umami does not store your IP address. We still ask for your consent, because the analytics script reads information from your device (for example your screen size and language).
5.4. Google Analytics: what it records. The address of each page you open (without the part after "?", as above), the page you came from, your browser and operating system, device type, screen size and language, your approximate location (country, region and city), which Google derives from your IP address, and how pages are used, such as scrolling, time spent on a page and clicks on links to other sites. It also records what you do on the Platform, as counts and categories only: that a chat message was sent, which tools the answer used and how many listings it showed, sign-ups and sign-ins, the sign-up prompt, chat errors, listings opened, saved, attached to a chat or followed to their source, contact buttons pressed, help articles opened, changes to your memory, language changes, chats started, reopened, retried or deleted, and that a bug report was sent. With these it records public facts about a listing (its ID, type, city and price), which version of the home page you saw, and whether you are signed in (yes or no). It never records the text of a chat message or answer, or anything else you type. Google states that Google Analytics 4 does not log or store IP addresses. Google Analytics is never linked to your account, and Google signals, advertising features and data sharing for Google's advertising are switched off.
5.5. Google Analytics: what it stores on your device. Two cookies set on estatebase.ai by Google's script, and one of ours:
| Name | Purpose | Duration |
|---|---|---|
_ga | Tells apart visitors with a random ID, so that repeat visits are counted as one visitor. | 13 months |
_ga_32JFVMTCKD | Keeps the state of the current visit (session). | 13 months |
eb_auth_event | Set only if you accepted analytics, when you sign up or sign in with Google: tells Google Analytics that this happened (the words "sign_up" or "login" and "google", nothing about you). Read once by the page, then deleted. | 5 minutes |
5.6. Google and transfers outside the EU. Google may process Google Analytics data on servers outside the European Union, including in the United States. Google LLC is certified under the EU-U.S. Data Privacy Framework, and Google's data processing terms include the European Commission's Standard Contractual Clauses. See Google's privacy policy at https://policies.google.com/privacy and how Google uses data from sites that use its services at https://policies.google.com/technologies/partner-sites.
5.7. Legal basis and retention. Your consent (Article 6(1)(a) GDPR). Umami data is kept for no more than 12 (twelve) months, and Google Analytics data for no more than 14 (fourteen) months.
5.8. Until you choose, and if you reject, neither analytics script is loaded at all and nothing is sent to Google. If you withdraw your consent later, both stop at once (the page reloads without them) and we delete the Google Analytics cookies from your browser. Withdrawal does not affect processing carried out before it.
6. Content loaded from other services
6.1. Some pages show content that your browser fetches directly from another company's servers. Such a request tells that company your IP address and browser details, and the company may read or set its own cookies under its own policy. We do not control those cookies. They are:
(a) Mapbox, Inc. — map images on property pages, and the interactive map on the older map search pages. On those map search pages Mapbox's map software also keeps an identifier in your browser's local storage, renewed every 24 hours, and sends map-load events to Mapbox, which Mapbox uses to count map usage. See Mapbox's privacy policy at https://www.mapbox.com/legal/privacy.
(b) Listing photos — shown directly from the servers of the public sources that published the listing. Those sites receive your IP address when your browser loads a photo.
(c) Google — if you choose "Continue with Google", you are taken to Google, which uses its own cookies there; your Google profile photo, if you have one, is loaded from Google's servers. See https://policies.google.com/privacy.
6.2. Links to other sites (for example to the original listing, Google Maps or WhatsApp) contact those sites only when you click them.
7. How to change your choice
7.1. You can accept or reject analytics, or change your mind at any time, under "Cookie settings" at the bottom of every page, in the account menu, or with the button at the end of this Policy.
7.2. You can also delete or block cookies in your browser settings. If you block strictly necessary cookies, signing in and some other features will stop working.
8. Record of your choice
8.1. When you make or change a choice, we record the choice, its date and time, the version of this Policy and the random ID stored in the eb_consent cookie, so that we can show that consent was given. We do not record your IP address, your browser or your account with it. These records are kept for 2 (two) years and then deleted.
9. Changes to this Policy
9.1. We update this Policy when the cookies we use change. If we add a new optional category or tracker, we will ask for your consent again before using it.
10. Contact and complaints
10.1. For any questions about this Policy, write to support@estatebase.ai or info@estatebase.ai, or to SIA Estate Base, Miera iela 87A-9, Riga, LV-1013, Latvia.
10.2. You have the right to lodge a complaint with the Data State Inspectorate of the Republic of Latvia (Datu valsts inspekcija), Elijas iela 17, Riga, LV-1050, www.dvi.gov.lv, or with the supervisory authority of the EU Member State where you live or work.