Cookie Policy

At SizaBill Invoicing (Pty) Ltd ("SizaBill", "we", "our", or "us"), we take the same care with the small invisible things - like cookies - as we do with your client records. This policy explains what cookies and similar technologies we use on our public website, sizabill.co.za, and inside the SizaBill app, why we use them, and how you stay in control. In short: the app uses only the essential cookies that keep you signed in, and analytics and marketing tools run on the public website alone, and only if you allow them.

It sits alongside our Privacy Policy and is aligned with the Protection of Personal Information Act, 4 of 2013 (POPIA) and the international ePrivacy norms our customers expect.

A cookie is a small text file your browser saves when you visit a site. The site can read it back later to remember things like whether you are signed in or which preferences you chose.

We also use closely related technologies that work in the same spirit:

• Local storage: a small piece of memory inside your browser used to remember your cookie consent choices.
• Pixels and tags: tiny pieces of code from third-party services (such as Google Analytics or Meta) that record usage signals when you have agreed to analytics or marketing cookies. They load on our public website only, never inside the SizaBill app.
• Session storage: temporary in-browser memory that disappears as soon as you close the tab, used for short-lived workflow state inside the portal, and to hold campaign tags until you make a cookie choice (see section 4).

We group everything we set into three honest categories. You decide which ones to allow when our cookie banner appears, and you can change your mind at any time.

• Essential cookies: always on. Without these, the platform cannot keep you securely signed in, prevent cross-site request forgery, or remember the cookie choices you have already made.
• Analytics cookies: off by default. If you turn them on, we use Google Analytics 4 to understand how people move through our public website so we can improve it. Google Analytics never runs inside the SizaBill app, where your business and client records live. It uses a random identifier, not your name or email address, and we report on visitors in aggregate.
• Marketing cookies: off by default. If you turn them on, third-party services such as the Meta Pixel, the LinkedIn Insight Tag and the TikTok Pixel may set cookies that help us measure whether our adverts and content are reaching the right audience, and let us show relevant SizaBill content to similar professionals on those platforms. Google’s own advertising features that work through Google Analytics, such as Google signals and advertising audiences, are switched on only with this choice too, never with analytics alone. Like analytics, they run on our public website only, never inside the SizaBill app.

Essential (always on)

• next-auth.session-token - keeps you signed in. HTTP-only and secure. Lifespan: up to 30 days, or until you sign out.
• next-auth.csrf-token - protects login and account forms from cross-site request forgery. Lifespan: current session.
• next-auth.callback-url - remembers where to send you after you sign in. Lifespan: current session.
• sizabill_consent_v2 - stored in your browser’s local storage. Records the cookie choices you made in our banner so we do not pester you on every page. Lifespan: until you change it under Your cookie choices at the top of this page, clear your browser data, or we publish a policy change that needs your choice again.

Analytics (only if you allow them)

• _ga - Google Analytics 4 anonymous visitor identifier. Lifespan: up to 2 years.
• _ga_<container> - GA4 session state for a specific measurement ID. Lifespan: up to 2 years.
• sizabill_campaign - stored in your browser tab’s session storage, and only when you arrive through a link that carries campaign tags (such as utm_source, or the click identifier Google Ads adds). It holds those tags, and nothing else from the address, until you make a cookie choice, so that a visit from one of our adverts can still be counted if you then allow analytics. It is sent nowhere unless you allow analytics, and is deleted when you close the tab.

Marketing (only if you allow them)

• _fbp / _fbc - Meta Pixel conversion attribution. Lifespan: up to 90 days.
• bcookie / lidc / _li_* - LinkedIn Insight Tag identifiers used for ad measurement and conversion tracking. Lifespan: up to 2 years.
• _ttp - TikTok Pixel identifier used for ad measurement and conversion tracking. Lifespan: up to 13 months.

When essential cookies are at work, all we capture is the bare minimum needed to keep you signed in safely: a session identifier, a CSRF token, and your most recent cookie choice.

When you allow analytics, we receive aggregated signals about our public website like: which pages you visited, how long you spent on a page, the rough country and city your visit originated from (derived from your IP, never your full address), the type of device and browser you used, and the website or campaign that referred you.

Before a page address is sent to Google Analytics, we clean it. Anything in the address that could identify you or open your account, such as an email address or the security code in a password-reset or verification link, is removed. Only campaign tags (like utm_source) are kept, so we can tell which advert or newsletter brought you.

When you allow marketing, the same kinds of signals are shared with Meta, LinkedIn and TikTok so they can attribute conversions to specific adverts and help us reach similar professionals. We do not share your name, email, banking details, or any client data with these networks, ever.

Some cookies are set by third parties on our behalf. Each one has its own privacy practices, and we encourage you to read their policies if you would like the full picture:

• Google Analytics 4 (analytics): policies.google.com/privacy
• Meta Pixel (marketing): facebook.com/privacy/policy
• LinkedIn Insight Tag (marketing): linkedin.com/legal/privacy-policy
• TikTok Pixel (marketing): tiktok.com/legal/privacy-policy

You can change your cookie choices at any time. There are two easy ways:

• Your cookie choices: at the top of this page. Switch any category on or off and save. When you switch analytics or marketing off, it takes effect immediately: we delete the Google Analytics cookies we set and reload the page, so nothing from your earlier choice keeps running.
• In your browser settings: every modern browser lets you view, block, and delete cookies. The exact menu differs from browser to browser, but the controls are usually under "Privacy and security" or "Site settings".

If you turn off essential cookies, parts of SizaBill, including sign-in itself, will stop working. Turning off analytics or marketing only changes what we and our partners can measure; the platform will continue to function normally.

We keep a record of each choice you make (what you allowed and when), because POPIA requires us to be able to show the consent we rely on.

We respect Global Privacy Control (GPC) signals where modern browsers send them. If your browser sends a GPC signal on its first visit to our site, we treat it as a request to keep analytics and marketing cookies off until you explicitly opt in via our banner. Older "Do Not Track" signals are read on a best-effort basis but are not formally standardised, so we always recommend using the SizaBill cookie banner for an authoritative choice.

SizaBill is a business-to-business platform intended for adult practitioners and their nominated staff. We do not knowingly serve cookies to children under 18. If you believe a child has somehow ended up on our site, please contact us so we can investigate.

If we add a new analytics or marketing partner, change how a cookie is used, or extend a cookies lifespan in a material way, we will publish a new version of this policy and increment the version number above. Where the change is material, we will also reset our consent banner so you can confirm your choices again.

For anything cookie-related, what we set, why we set it, or how to switch something off, please contact our Information Officer at privacy@sizabill.co.za.

You also have the right to lodge a complaint with the Information Regulator of South Africa via inforegulator.org.za if you feel we have not handled your concerns with the care they deserve.