Sub-processors and Cookies / Storage

Two lists you can rely on: who touches your data, and exactly what the product stores in a browser. The cookie table is written so you can paste the relevant rows straight into your own site's cookie policy.

Last updated: 14 August 2026 · Version: 1.2-beta

Part 1 — Sub-processor list

A sub-processor is a company we engage that may process personal data to help us run the Service. Each works under a data-protection contract and only on our instructions. For non-EU sub-processors we execute the European Commission's Standard Contractual Clauses (Decision 2021/914).

Our sub-processors

Sub-processor	Company / country	What they do for us	Personal data they may process	Transfer safeguard
WorkOS	WorkOS, Inc. — United States	Sign-in and password management (identity)	Account holder name and email	SCCs 2021/914
Hosting	To be added, via Cloudron	Runs the application, database, cache, and file storage	All account and lead data, at rest	To be added
Anthropic (optional, in-app AI chat only)	Anthropic — United States	Powers the in-app AI editor when you use it and it is enabled	The asset being edited (HTML/CSS), design-system CSS, your prompts	SCCs 2021/914
Email	To be added	Sends account emails (invites, set-password, resets)	Recipient email and name	To be added
Google Analytics (our own public website only, and only if you agree)	Google Ireland Limited — EU, with transfers to the United States	Counts visits to emblemstudio.ai and its legal pages, so we know which pages are worth writing	Page visited, approximate location, device and browser, and a random id in a cookie	SCCs 2021/914

Google Analytics is on our own marketing pages, and nowhere else. It does not run in the logged-in dashboard, it is not part of the embed on your website, and it never sees your leads or your visitors. If you say no to it, or never answer, it is not loaded at all.

Not our sub-processors — but you should know they receive data

These receive personal data at your instruction or under your own account. We do not engage or contract them; you do.

Recipient	What it is	When data reaches it
FunnelKit on your own WordPress	Your own CRM, on your own site	When you connect it and we deliver leads to it
Webhook endpoints	Web addresses you configure	When you set one up on a form
Your own AI provider (e.g. Anthropic, via the Strategist / MCP)	AI you connect under your subscription	When your connected AI reads or writes through the tools — it is your processor, not ours

Visitor location — worked out on our own server

When a form is submitted, we work out the approximate location (country/region/city) on our own server, from a local database — no per-visitor call to any outside service, and the visitor's IP is neither sent out nor stored. No outside company is involved in working it out.

The database we use (DB-IP) is a vendor, not a data recipient: we download a monthly file from them and send them nothing. Their licence asks only for an attribution line ("IP geolocation by DB-IP"), carried in our config and surfaced wherever geo is shown.

How we notify you of changes

We maintain this list. We will give 30 days' notice of adding or replacing a sub-processor so you can object, as set out in the DPA (Clause 7.7, general authorisation).

Part 2 — Cookies and browser storage

Emblem Studio uses cookies and similar browser storage (localStorage, sessionStorage) in two places: (A) the small script that runs your forms on your visitors' browsers, and (B) the logged-in dashboard you use. There are no advertising cookies and no cross-site tracking cookies; everything below is first-party (set on your own domain) or strictly necessary to the app.

Note on categories. Each item is labelled necessary, functional, or analytics. esf_visitor is labelled analytics rather than strictly necessary, because it does more than count: it also drives the new-versus-returning-visitor display rule, so it changes what a visitor is shown. It is gated behind consent in the embed. This matters to you because you place the script on your own site and remain responsible for cookie consent there. Note that ePrivacy Art. 5(3) covers localStorage too, not only cookies.

A) The embed on your visitors' browsers

(Paste the rows you use into your own site's cookie policy.)

Name	Type	Set when	Lifetime	Purpose	Category	Consent-gated in code today?
`esf_visitor`	Cookie (first-party)	On page load, before interaction	30 days	An anonymous, random per-browser id. Tells new visitors from returning ones and counts unique visitors for your stats. Also drives the new-vs-returning-visitor display rule (targeting, not just counting). Not linked to a name.	Analytics	Yes
`esf_ab_<formId>`	Cookie (first-party)	On page load, for a form with a running A/B test	30 days	Keeps a visitor on the same A/B version across visits	Functional (A/B)	No
`esf_sub`	`localStorage` (SaaS embed) / Cookie (WordPress plugin — same purpose, different storage type)	After a visitor completes a form	Per-form (set by you; can be permanent)	Remembers which forms this browser already completed, so you can stop showing or swap them	Functional	No (fires only after an actual submit)
`esf_dismissed_<shell>_<formId>`	`localStorage`	After a visitor closes a popup/ribbon/slide-in	Until a set time, or permanent	Remembers a dismissal so the same popup isn't shown again too soon	Functional	No (action-triggered, not page-load)
`esf_freq_<shell>_<formId>`	`localStorage` — hosted embed only; the WordPress plugin has no equivalent yet	When a popup/ribbon/slide-in closes, or the visitor leaves the page while it's still open	Author-configured hours (no "forever" option)	An independent "don't show this again for N hours" cooldown, separate from the dismiss rule above	Functional	No (action-triggered, not page-load)
`esf_hp`	(hidden form field, not storage)	On render	—	Spam trap — only bots fill it in	Security	N/A — not storage

Two things about the embed to disclose on your own site:

It sets esf_visitor and sends an anonymous per-browser id to our servers on page load, before the visitor interacts, so if your cookie banner blocks non-essential storage until consent, class it accordingly. esf_ab_<formId> sets on the same timing, for forms with a running A/B test.
It makes no third-party call. Approximate location is worked out on our own server at submit time, from a local database (see above).

B) The logged-in dashboard (only affects you, the account holder)

Name	Type	Lifetime	Purpose	Category
`emblem-studio-saas-session`	Cookie (HttpOnly)	120 min	Keeps you signed in	Strictly necessary
`XSRF-TOKEN`	Cookie	Session (~2h)	Security — protects app requests from cross-site forgery	Strictly necessary
`ess_connect_reintent`	Cookie (HttpOnly)	10 min	Holds a WordPress-connect step across a login round-trip	Strictly necessary
`es_embed_mode`	`sessionStorage`	Browser tab	Remembers the app is running inside the WordPress iframe	Strictly necessary
`es_embed_token`	`sessionStorage`	Browser tab	The access token that lets the dashboard run inside WordPress	Strictly necessary
`esLockToken:<formId>`	`sessionStorage`	Browser tab	Prevents you clashing with yourself when editing a form in two tabs	Functional (editor)
`es_selected_site_code`	`localStorage`	Persistent	Remembers your last-used site	Functional (preference)
`es_schedule_tz_mode`	`localStorage`	Persistent	Remembers your schedule timezone display choice	Functional (preference)

(The WordPress plugin's admin screens also set an editor preference es_inline_preview_enabled in localStorage — functional, admin-only.)

C) Our own marketing pages (emblemstudio.ai and these legal pages)

These are on our website, not yours and not your visitors'. None of it is part of the product you install.

Name	Type	Set when	Lifetime	Purpose	Category
`es_consent_analytics`	`localStorage` (first-party)	When you answer the cookie bar	Until you clear it or change your answer	Remembers whether you said yes or no, so we stop asking. Deliberately not a cookie: asking you about cookies should not itself set one.	Strictly necessary
`_ga`, `_ga_<id>`	Cookie (first-party)	Only after you say yes	Up to 2 years	Google Analytics. Counts visits and tells a returning visitor from a new one.	Analytics — consent required

Nothing loads until you accept. The Google Analytics script is not on the page at all until you choose it, and if you reject, nothing is requested from Google at all. Reject is one click, in the same place, at the same size as Accept. You can change your mind at any time from Cookie settings in the footer, and rejecting afterwards switches Analytics off and deletes the cookies it had set.

Advertising is switched off, whatever you choose. Accepting turns on visit counting and nothing else. Advertising storage, advertising data and ad personalisation are all refused every time, so this data can never reach a Google Ads account.

What we do not use

No advertising or marketing cookies anywhere. No session replay, keystroke logging, or mouse-movement recording. Your dashboard session is held in sessionStorage rather than a third-party cookie, so it keeps working in browsers that block those.

In the product — the embed on your site, and the dashboard — everything is first-party and there is no third-party tracking of any kind. Google Analytics runs on our own marketing pages only, and only for a visitor to our site who accepts it. It is not in the embed, so your visitors never meet it.