Cookie Policy

Last updated: 2026-06-01

1. What this policy covers

This Cookie Policy explains what cookies and similar storage technologies Consultad uses on the consultad.io website and within the Consultad web application, why we use them, and how you can control them. It supplements the Privacy Policy (https://consultad.io/privacy).

2. What is a cookie?

A cookie is a small text file that a website places on your device when you visit it. Cookies allow the website to recognize your device on a return visit, remember your preferences, and operate features that require persistent state across page loads.

We also use local storage and session storage, which are similar in concept but stored by your browser rather than transmitted with each HTTP request. For simplicity, this policy refers to all such technologies as "cookies".

We classify the cookies we use into four categories:

Category	Description	Consent required
Strictly necessary	Required to operate the Platform. Always on; cannot be switched off.	No
Functional	Remember preferences such as language and theme. Set when you use the feature.	No (implied by use)
Analytics	Measure how the Platform is used so we can improve it. Off by default.	Yes
Advertising	Measure the effectiveness of our marketing campaigns. Off by default.	Yes

3. Cookies we use today

Cookie / storage key	Category	Type	Purpose	Expiry
`__session`	Strictly necessary	HTTP cookie, HttpOnly, Secure, SameSite=Lax, first-party	Authenticated session indicator. Set on successful sign-in; used to validate the user's identity on each request to the backend.	7 days (rolling)
`consultad_consent`	Strictly necessary	HTTP cookie, first-party	Records your cookie-consent choices (analytics and advertising opt-in state, banner version, timestamp) so the consent banner does not reappear. Stored by the Klaro! consent engine, self-hosted on Consultad's infrastructure.	180 days
`theme`	Functional	localStorage, first-party	Remembers your preferred UI theme (light / dark / system).	Until you clear browser storage
`consultad.app_locale`	Functional	localStorage, first-party	Remembers your preferred language (EN / PL / RO / DE).	Until you clear browser storage

Analytics and advertising cookies are not yet loaded by Consultad. As of this version of the policy, no third-party tracking scripts, pixels, or tags are active: the consent banner and the underlying engine (Klaro! v0.7, vendored and self-hosted) gate them, and Google Consent Mode v2 defaults to denied. Section 3a below gives you advance notice of the tags we are about to introduce.

3a. Cookies we are introducing (advance notice)

We are preparing to measure our own marketing funnel — how visitors reach consultad.io and sign up — and to send conversion signals back to the advertising platforms we use to promote Consultad. This measures Consultad's own marketing only; it is unrelated to the advertising data you connect as a customer.

From the effective date of 2026-06-23, and only after you opt in via the consent banner, the following tags may be loaded:

Google Analytics 4 (GA4) and Google Tag Manager — analytics category;
Meta Pixel (with the server-side Conversions API) — advertising category;
TikTok Pixel (with the server-side Events API) — advertising category;
Google Ads conversion tags — advertising category.

When active and consented, these tags may set the following cookies:

Cookie / key	Set by	Category	Purpose	Expiry
`_ga`	Google Analytics 4	Analytics	Distinguishes visitors for aggregate usage measurement.	2 years
`_ga_<container>`	Google Analytics 4	Analytics	Persists GA4 session state per property.	2 years
`_gid`	Google Analytics 4	Analytics	Distinguishes visitors over a 24-hour window.	24 hours
`_fbp`	Meta Pixel	Advertising	First-party browser identifier for Meta conversion attribution.	90 days
`_fbc`	Meta Pixel	Advertising	Stores the Meta click identifier (`fbclid`) for attribution.	90 days
`_ttp`	TikTok Pixel	Advertising	First-party identifier for TikTok conversion attribution.	13 months
`_gcl_*`	Google Ads	Advertising	Stores ad-click identifiers (e.g. `gclid`) for conversion attribution.	90 days
`consultad_attr`	Consultad (first-party)	Advertising	Stores marketing attribution parameters (click IDs, UTM tags) captured on landing, so a later sign-up or purchase can be attributed and a conversion reported. Set on the `.consultad.io` domain so it survives the host redirect to the app.	90 days

Server-side forwarding. For the Meta Conversions API, TikTok Events API, and Google Ads, Consultad also sends conversion events from its own backend. Any personal identifier used for matching (e.g. email) is hashed (SHA-256) before transmission and is never sent in clear text. Server-side forwarding for advertising platforms runs only when you have given advertising consent.

Data residency. Consultad processes and stores the underlying attribution data in the European Economic Area (europe-central2, Warsaw). The advertising platforms named above are independent controllers for the data they receive and may process it outside the EEA under their own safeguards — see the Privacy Policy (https://consultad.io/privacy, §7-8) and the Sub-processor list (https://consultad.io/subprocessors).

4. How to control cookies

Cookie preferences in the footer. Open "Cookie preferences" at the bottom of any page on consultad.io to view your current choices, change them, or withdraw consent for categories you have previously approved. Your new choices take effect immediately; tags for any deselected category are unloaded on the next page view.

Browser settings. All major browsers let you block or delete cookies. Note that blocking strictly necessary cookies (specifically __session) will prevent you from signing in to the Platform. Deleting cookies will reset your consent choices; the banner will reappear on your next visit.

Do Not Track. Some browsers send a "Do Not Track" signal. Because the Platform does not load third-party tracking by default, we do not currently take any additional action on this signal beyond what we already do.

Global Privacy Control. If your browser sends a Global Privacy Control ("GPC") signal, we treat it as a request to opt out of analytics and advertising cookies, including the tags announced in section 3a once they go live.

5. Changes to this Cookie Policy

We may update this policy when we add or remove cookies, change our consent mechanism, or in response to changes in applicable law. The "Last updated" date at the top of this page reflects the most recent change.

Where a change is material, in particular the introduction of any new analytics or advertising cookie, we will:

(a) update this policy at least fourteen (14) days before the new cookie is set;

(b) re-prompt your consent before any new non-essential cookie is loaded.

The analytics and advertising tags listed in section 3a are being introduced under this exact procedure: this policy gives advance notice now, and the consent banner has been re-prompted to every visitor before any of those tags can fire.

6. Contact

For questions about this Cookie Policy, write to karol@consultad.io.