The short version
Meet Marley's public website and booking pages set no tracking cookies and no advertising cookies, and use no third-party analytics that identify you. Our analytics store nothing on your device at all. That is why you are not being shown a cookie banner — there is nothing here to ask your permission for.
The little we do store is needed to make the site work: a sign-in cookie if you log in to see your bookings at a salon, and a marker that stops a page reloading itself in a loop after we release an update.
1. What a cookie is here
A cookie is a small file a website stores in your browser. This statement also covers two closely related technologies we use, because they raise the same questions even though they are technically not cookies:
- localStorage and sessionStorage — browser storage that works like a cookie but is not sent with every request.
2. Meet Marley's public website and booking pages
2.1 Strictly necessary
These cannot be switched off, and under the Dutch Telecommunicatiewet (art. 11.7a) they require no consent because they are necessary to deliver a service you asked for.
| Name | Purpose | Type | Retention |
|---|---|---|---|
mm_portal |
Keeps you signed in to a salon's page where you see and manage your own bookings, after you enter the code we emailed you. Only set when you sign in — never on an ordinary visit. httpOnly, Secure, SameSite=Lax: JavaScript cannot read it, and your browser only sends it to the part of our service that shows your bookings. It contains no analytics identifier |
Cookie | 2 hours, or until you sign out — whichever comes first. It is not renewed: after two hours you ask for a new code |
mm_chunk_reload_at |
If we release an update while you have a page open, the page reloads itself once to pick it up. This records that it did, so it can never get stuck reloading in a loop. Only written when that happens | sessionStorage | Until the tab closes |
Your language is part of the web address (/en/… for English), so we do not need a cookie to
remember it.
2.2 Analytics — nothing stored on your device
We use Cloudflare Web Analytics to count page views and understand which pages are used.
It sets no cookie and no identifier of any kind. It does not fingerprint your device, does not follow you between websites, and cannot be used to recognise you on a return visit. We see totals, not people.
We also use PostHog, hosted in the EU (Frankfurt), to see where people give up on booking. On the public site it is set up so that it writes nothing to your device — no cookie, no localStorage, no sessionStorage. The random identifiers that tie together the pages of one visit are held only in your browser's memory and are gone when you close the tab, so it cannot recognise you on a return visit either. It keeps no profile of you and does not record what you type. What it sends, and why, is set out in §4 of our privacy statement.
This is a deliberate choice. Conventional analytics — Google Analytics in particular — would require a consent banner on every page, including the page where you book an appointment. We would rather measure less and leave you alone.
3. Meet Marley Studio (the salon business app)
Studio is the password-protected application used by salon staff. It is not part of the public website, and members of the public never load it.
3.1 Strictly necessary
| Name | Purpose | Type | Retention |
|---|---|---|---|
refresh_token |
Keeps you signed in. httpOnly, Secure, SameSite=Lax — it cannot be read by JavaScript |
Cookie | 30 days |
mm_session_started |
Records that this browser had a signed-in session, so an unexpected sign-out can be told apart from a normal first visit | localStorage | Until you sign out |
3.2 Functional
| Name | Purpose | Type | Retention |
|---|---|---|---|
mm_locale |
Remembers whether you chose Dutch or English | Cookie | 365 days |
| Onboarding draft | Keeps your answers if you reload the page mid-signup | sessionStorage | Until the tab closes |
| Install-prompt dismissal | Remembers that you dismissed the "add to home screen" prompt, so we do not ask again | localStorage | Until browser storage is cleared |
3.3 Analytics
| Name | Purpose | Type | Retention |
|---|---|---|---|
| PostHog analytics | Understanding which features salons actually use, so we know what to improve | Cookie + localStorage | 365 days |
We have restricted this deliberately:
- No session recording. We never record or replay what is on a salon's screen.
- No autocapture. We do not automatically log clicks or typing. In Studio that would mean capturing client names, phone numbers and appointment notes.
- No individual is identified. We never link analytics to a named user account. Statistics are grouped by salon, not by person.
- IP addresses are discarded before events are stored.
- Record identifiers are removed from page addresses before they are sent, so a page about one client becomes an anonymous route.
Legal basis: legitimate interest (art. 6(1)(f) GDPR) in improving a professional tool, balanced against a design that holds no personal profile of any user.
4. Third parties that receive data when you use Meet Marley
Not all of these set cookies — but all of them receive data, and you should know that.
| Party | What it receives | Where | Why |
|---|---|---|---|
| Cloudflare | Your IP address and request details, as our network provider | Global edge network | Security, DDoS protection, delivering the site |
| Railway | Everything you submit, as our hosting provider | EU West (Amsterdam) | Running the service and its database |
| Sentry | Technical error reports if something breaks | EU (Germany) | Diagnosing faults |
| Stripe | Salon billing details only — never a client's payment data through us | EU / US, under Stripe's data protection terms | Salon subscriptions |
| Resend | Your email address and the contents of the message | Ireland (EU) | Sending booking confirmations and reminders |
| PDOK (Kadaster) | Salon addresses only — no personal data of visitors | Netherlands | Placing salons on a map |
| PostHog | Meet Marley Studio usage, and which pages of the public website and booking pages are viewed — no profile of anyone is kept | EU (Frankfurt) | Improving the salon app (§3) and the booking flow (§2.2) |
We do not use Google Analytics, Google Tag Manager, Meta Pixel, or any advertising network.
We no longer load fonts from Google. Until 3 August 2026 our stylesheet requested the Geist typeface from Google's servers, which meant your IP address reached Google on every page load. We now serve that font from our own servers, so it does not.
5. Managing cookies
You can delete or block cookies through your browser settings. Blocking the strictly necessary ones will sign you out of Studio, and you will not be able to sign in to see your bookings at a salon. Booking an appointment works either way.
Because our public site sets no tracking cookies, there is no consent to withdraw and no preference centre to visit.
6. Changes
If we ever add something that tracks you, we will update this statement and ask for your consent before it loads — not after.
7. Contact
Meet Marley is a trade name of Spine HQ.
| KvK | 82037906 |
| VAT | NL003631560B86 |
| Contact | [email protected] |
You have the right to lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).