Your privacy

    Cookie Policy

    An overview of cookies, providers and your choices. You can change your choices at any time.

    PolicyUpdated

    Version: 1.6 · 19 October 2026
    Scope: zitado.com and the Zitado platform.

    Zitado uses cookies and similar technologies to make the website and platform work. With your consent, we may store campaign information locally as described below. External analytics and marketing tags are disabled in this version. You can reject optional technologies without losing access to the ordinary functions of Zitado.

    1. What are cookies and similar technologies?

    Cookies are small data files that websites can store in your browser. We also use localStorage and sessionStorage, which can hold settings, sign-in information or session details in your browser. Pixels, scripts and similar technologies may collect information about visits and actions. Cookie consent rules can apply to these technologies as well – they are not limited to files literally called cookies.

    Some technologies are set by Zitado (first-party) and others may be provided by our partners (third-party). Their purposes and lifetimes vary.

    Back to contents

    2. Which categories do we use?

    CategoryPurposeIs consent required?
    NecessarySecurity, authentication, sign-in, remembering privacy choices and functions technically necessary for a service you requestNo, where the technology is genuinely technically necessary
    AnalyticsUnderstand website usage, measure traffic and improve the user experienceYes
    MarketingAdvertising, campaign and conversion measurement, including advertising pixels where enabledYes

    Analytics and marketing are separate choices. Agreeing to analytics does not automatically mean agreeing to marketing. In the cookie banner, you can choose Reject optional, Customize, or Accept all. Optional categories are not enabled in advance.

    Back to contents

    3. Necessary technologies and browser storage

    This overview describes the technologies used in this version. Some load only when you use sign-in, screening or payment functions. Providers’ own pages may use additional technologies under their cookie policies.

    Technology / nameProviderPurposeLifetime / status
    zitado-cookie-consent (localStorage)ZitadoRemembers your separate analytics and marketing choicesZitado records the choices, timestamp, text version and a 180-day validity period. An expired or superseded choice requires renewal on the next visit. A fresh choice is requested sooner for material changes to purposes or providers not covered by the previous choice.
    zitado.publicLocale (localStorage)ZitadoRemembers your choice of Danish or EnglishUntil changed or browser storage is cleared. The code has no automatic expiry date for this language preference.
    Supabase sign-in in localStorage, sb-xhcrvhhpoupcpjerxdgl-auth-token for the production projectSupabase / ZitadoMaintains sign-in and session informationThe browser entry has no fixed automatic expiry. The access token expires and may be refreshed automatically. The entry is removed by the client’s sign-out/session-removal flow or when browser data are cleared; token expiry alone does not erase the browser entry.
    zitado.ai-act-readiness.2026-08-v1 (localStorage)ZitadoAllows a started Ai Act screening to be resumed using a tokenToken and lifetime metadata only, at most 30 days from the original start; answers/results are loaded from the server. Expired entries are removed on the next read.
    cf.turnstile.u (localStorage on challenges.cloudflare.com)Cloudflare TurnstilePrevents automated abuse of sign-up and sign-inNo fixed browser expiry. The entry may remain until the provider removes or replaces it or you clear browser data. The Managed widget is used without pre-clearance; no Turnstile HTTP cookie was observed in the check. The challenge token’s five-minute validity is not a deletion period for browser storage or provider data.
    __stripe_mid and __stripe_sid (cookies)StripePayment fraud preventionApproximately one year and 30 minutes respectively from creation/renewal. Observed after the payment function was opened.
    _ab, _mf, 1 and id (sessionStorage on m.stripe.network)StripeSecurity and session information in the payment flowBrowser session.
    error-limiter (localStorage on billing.stripe.com)StripeLimits error reporting in the billing portalNo fixed browser expiry; retained until provider cleanup or browser data are cleared.

    Only technologies that are strictly necessary for the function in question may be used without consent. Any additional purpose must be assessed separately.

    Back to contents

    4. Consent-based analytics and marketing

    Google Tag Manager, Google Analytics 4, Ahrefs Analytics and Meta Pixel are disabled in this version. Consent does not enable them. Any later activation requires the information, purposes and consent categories to match the actual processing.

    ServicePurposeConsent categoryActual cookies / lifetime
    Google Analytics 4 via Google Tag Manager, if enabledVisit analytics and event measurementAnalyticsDisabled in this version. Historical production: _ga and _ga_0WWVB85RMS, approximately 400 days, measured on 15 October; these are not new cookies set by this version.
    Ahrefs AnalyticsWebsite analyticsAnalyticsDisabled in this version. No separate Ahrefs cookie was observed on 15 October. The existing GA import into Ahrefs is a separate account/server data flow.
    Meta Pixel, if enabled in Google Tag ManagerAdvertising and campaign measurementMarketingDisabled in this version. Historical production: _fbp, approximately 90 days, and referrer storage without documented automatic expiry, measured on 15 October.
    Other tags in Google Tag Manager, if anyMust be described according to their actual purposeAnalytics or marketing, depending on functionGTM is disabled. Tags present in the provider account are not thereby active on the website.

    Google Tag Manager manages the delivery of other scripts and tags. The actual active tags and their purposes determine the information and consent requirements.

    Cookies and storage from earlier visits may remain in your browser even when new tags are disabled. This includes Meta-related lastExternalReferrer and lastExternalReferrerTime, which have no documented automatic expiry. You can clear them in your browser settings. Changing browser choices does not automatically erase historical provider data; see the Privacy Policy for your rights.

    Campaign attribution and browser storage

    After consent to analytics or marketing, Zitado may store first- and last-visit campaign parameters (such as utm_source and utm_campaign) in localStorage under zitado-utm-attribution. These help us understand how a visitor arrived at Zitado. The present code clears this local record when both optional categories are disabled.

    Zitado may also use zitado-funnel-event:* entries in sessionStorage to avoid counting the same conversion event more than once during a browser session.

    UTM storage expires 30 days after the first recorded campaign visit; later visits do not extend this period. Invalid or expired records are removed on the next read. Only the named campaign fields and a path without query/hash or screening/share tokens are stored. External analytics and marketing tags are disabled in the launch configuration; later activation requires a separate category review.

    Back to contents

    5. How can you give, change or withdraw consent?

    On your first visit you can reject optional technologies, customise your choices or accept all categories. Consent applies only to the specific purposes you select.

    You can reopen your choices at any time using the cookie button in the lower-left corner or Cookie settings in the website footer. Cookie settings are also available in the authenticated Zitado application. Once you withdraw consent, future tracking that requires consent must stop. Withdrawal does not affect processing already carried out lawfully based on valid consent.

    You can also delete existing cookies and local browser storage in your browser settings. Doing so may sign you out or reset your preferences.

    Back to contents

    6. Third-party technologies for specific functions

    Cloudflare Turnstile is used during sign-up and login to prevent abuse. During checkout, Stripe may use technologies needed to process the transaction or prevent fraud. These technologies must be assessed individually; they are not automatically exempt from consent merely because a provider uses them.

    Stripe’s embedded checkout and billing portal load their own payment and security resources, including hCaptcha. We use these for the payment function you open and do not use payment details for marketing. Stripe may have existing cookies from your own visits to Stripe; these were not necessarily created by Zitado. See Stripe’s cookie overview and Cloudflare’s Turnstile information. Browser storage lifetimes are not the provider’s overall personal-data retention periods.

    Back to contents

    7. Personal data and your rights

    Where cookies or similar technologies process personal data, the GDPR also applies. We rely on consent for optional analytics and marketing tracking where required. For information about our other personal-data processing, suppliers, international transfers and your rights, see the Privacy Policy.

    Contact:

    Camonda ApS (registered secondary name: ZELLERT ApS) · Danish company registration (CVR) 43532421
    info@zitado.com

    Back to contents

    8. Updates

    We update this Cookie Policy when we change the technologies we use or their purposes. The list must reflect what actually runs in visitors' browsers. Where a material change is not covered by existing consent, we request a new choice.

    Back to contents