Effective: 2026-05-01
Our public marketing site at caura.ai uses Google Analytics 4 and Google Ads and the X advertising pixel to measure visits and ad-driven conversions. We operate Consent Mode v2 with a region-based default: in the EU 27, UK, Gibraltar and Cyprus, supported browser time zones start denied and a cookie banner asks for your decision; other browser time zones start granted on page load. An explicit saved accept or decline takes precedence. Accept grants analytics and advertising categories together, including advertising personalisation. You can revisit your choice at any time via the “Cookie preferences” link in the footer.
When measurement is granted, the following first-party cookies are set:
| Name | Provider | Purpose | Duration |
|---|---|---|---|
_ga | Google Analytics 4 | Distinguishes unique visitors. | 2 years |
_ga_KLYDXHH521 | Google Analytics 4 | Persists session state for the GA4 property. | 2 years |
_gcl_au | Google Ads | Conversion-linker cookie used for ad-attribution. | 90 days |
When the initial preference denies measurement — including before you accept in supported EU/UK time zones — Google Analytics and Datadog RUM scripts do not load. The X pixel also starts only when the regional or explicit preference allows measurement; it can use browser/click identifiers for advertising attribution. See X’s conversion-tracking information.
Marketing-site Datadog RUM uses the same regional or saved preference. It processes performance, errors, resource URLs and interaction metadata when permitted. The SDK is downloaded only when the preference permits measurement. Accepting later starts it without a reload; declining stops collection on an already loaded SDK. Session Replay is disabled in our configuration.
The preference is stored in ga-consent-v1 in localStorage on that browser origin. The marketing footer’s Cookie preferenceslink reopens the choice. Choose Decline and reload to apply the saved choice to all marketing tags; a tag already loaded may continue until that page is reloaded. Existing browser storage can be removed through your browser settings.
The hosted dashboard uses Datadog RUM and Pendo when configured and permitted by the same saved or regional analytics preference described above. Neither SDK is downloaded before that preference permits it. Changing the preference pauses or resumes event collection in an open dashboard, including when changed in another tab on the same browser origin. Anonymous Pendo on public app routes follows the same preference. Pendo receives usage events and pseudonymous visitor/account identifiers; our authenticated identity payload includes user, organisation and tenant IDs, role and plan, without email or display name. Datadog RUM collects performance, error and interaction metadata, with page-text and action-name masking, search terms removed from page URLs, and Session Replay disabled.
| Storage | Provider and purpose | Duration |
|---|---|---|
_dd_s cookie | Datadog RUM session and sampling state. | 15 minutes of inactivity, extended by activity up to a 4-hour session. |
Pendo visitor/account identifiers in localStorage; first-party cookie fallback such as _pendo_visitorId.*, _pendo_accountId.* and _pendo_meta.* | Pendo visitor/account association and metadata state. | LocalStorage retention is managed by the SDK; documented identifier/metadata cookies expire after 100 days. |
ga-consent-v1 in localStorage | Caura stores the explicit analytics preference. | Until changed or cleared. |
Browser storage depends on SDK version and browser support. See Datadog browser storage and Pendo cookies and localStorage. Contact privacy@caura.ai about those processing activities and your rights.
The Caura dashboard uses the items below. These are "strictly necessary" for the Service you have requested and are therefore exempt from the prior-consent requirement under Directive 2002/58/EC ("ePrivacy Directive") Article 5(3).
| Name | Type | Purpose | Duration |
|---|---|---|---|
session_token | First-party cookie (HttpOnly, Secure, SameSite=Lax) | Authenticates your dashboard session. | 24 hours; cleared on sign-out. |
csrf_token | First-party cookie (readable by the app, Secure, SameSite=Lax) | Cross-site-request-forgery protection for the dashboard. | 24 hours; cleared on sign-out. |
gh_oauth_state, g_oauth_state | First-party cookie (HttpOnly, Secure, SameSite=Lax) | Cross-site-request-forgery protection while you sign in with GitHub or Google. | 10 minutes; deleted when sign-in completes. |
gh_oauth_origin, g_oauth_origin | First-party cookie (HttpOnly, Secure, SameSite=Lax) | Returns you to the Caura address where you started GitHub or Google sign-in. | 10 minutes; deleted when sign-in completes. |
sso_flow | First-party cookie (HttpOnly, Secure, SameSite=Lax) | Cross-site-request-forgery protection while you sign in through your organization's identity provider (enterprise single sign-on), and returns you to the Caura address where you started. | 10 minutes; deleted when sign-in completes. |
sidebar_state | First-party cookie (readable by the app) | Remembers whether you collapsed the dashboard sidebar. | 7 days |
| UI preferences | localStorage | Interface state such as dismissed notices, collapsed cards, your last-chosen setup tab and which collaboration threads you have read. | Until cleared by you |
Some Caura pages load a first-party operations widget served from ops.caura.ai used by our support team to detect that a signed-in user is viewing a page. It is isolated in a cross-origin frame and communicates with Caura-operated infrastructure; it cannot read the dashboard’s storage, cookies or session token from that frame.
Non-essential browser storage is already used as described above. We will update this policy when processing changes. See our sub-processor list for provider changes and our DPA for the customer-notice commitment.
Questions? privacy@caura.ai. See our full Privacy Policy for more on how we handle personal data.