Cookie Notice

This Cookie Notice explains how Siit SAS (“Siit”, “we”, “us” or “our”) uses cookies and similar technologies when you visit siit.io and our other websites (the “Website”) and when you use our web applications, including the admin dashboard at app.siit.io and employee portals hosted at <subdomain>.siit.io (together, the “Platform”). It explains what these technologies are, why we use them, who receives the information they collect, how long we keep it, and the choices available to you.

This Cookie Notice supplements our Privacy Policy, which applies to any personal information collected through cookies. Capitalized terms not defined in this Cookie Notice have the meaning given to them in our Privacy Policy.

This Cookie Notice does not apply to cookies placed through Siit features embedded in our Customers’ own websites or tools (for example, a support portal or chat widget). Those cookies are governed by the cookie policy of the relevant Customer.

Cookies at a glance

We use strictly necessary cookies to run the Website and the Platform securely. They do not require your consent.

Some functional cookies also do not require your consent where they are strictly necessary to provide a feature you expressly request, such as remembering your interface language.

With your consent, we use other functional, analytics and marketing cookies on the Website and, where applicable, the Platform to provide enhanced features, understand how our services are used and measure our campaigns.

You can change your preferences at any time by clicking Cookie Settings in the footer of the Website.

Contents

  1. What are cookies and similar technologies?
  2. The cookies we use and why
  3. Who receives information collected through cookies
  4. International transfers
  5. How long we keep information collected through cookies
  6. Your choices
  7. Your rights
  8. Changes to this Cookie Notice
  9. Contact us

1. What are cookies and similar technologies?

Cookies are small text files placed on your browser or device when you visit a website. They allow the website to recognize your browser or device, for example to keep you signed in or to remember your preferences.

First-party cookies are set by Siit. Third-party cookies are set by other companies, such as analytics or advertising providers.

Session cookies expire when you close your browser. Persistent cookies remain on your device for a set period or until you delete them.

We also use similar technologies, such as pixels (or web beacons), tags, scripts, software development kits (SDKs) and local storage. In this Cookie Notice, we refer to all of these technologies as “cookies”.

2. The cookies we use and why

We use the categories of cookies described below. For each category, we explain why we use them, whether your consent is required, and the legal basis on which we rely under the GDPR. The tables list the cookies in use at the date of this Notice; the full, up-to-date list is available in our cookie consent tool via Cookie Settings.

2.1 Strictly necessary cookies

These cookies are essential for the Website and the Platform to function. They enable core features such as signing in, keeping your session secure, balancing traffic across our servers and remembering your cookie preferences.

Consent requirement: not required, because these cookies are strictly necessary.

GDPR legal basis: where personal information is processed, our legitimate interests in operating and securing the Website and the Platform. You can block them through your browser settings, but parts of the Website or the Platform may then not work.

‍

CookieProviderPurposeDuration
_cfuvidCloudflare (Website)Rate limiting and bot protection for the Website CDNSession
fs-consentConsent Pro (www.siit.io)Stores the ID and timestamp of the visitor’s cookie consent record so the banner remembers the visitor’s choice1 year
__cf_bmHubSpot via Cloudflare (HubSpot Meetings iframe)Bot protection for the embedded HubSpot Meetings calendar30 minutes
li_gcLinkedIn (Website)Stores the visitor’s consent to LinkedIn non-essential cookies6 months
admin_dashboard_access_tokenSiit (Platform)Encrypted login session for the admin dashboard; deleted on logout1 week (also ended server-side after 1 day of inactivity)
secured_assets_<company_uid>_access_tokenSiit (Platform)Authorizes the browser to load the Customer’s protected files and attachmentsSame as the login session (1 week)
siit_frontend_cellSiit (Platform / Employee Portal)Routes the browser to the regional infrastructure hosting the Customer’s data and serves the matching application version; contains no personal data1 year
siit_cellSiit (Platform / Employee Portal)Server-side routing hint identifying the regional infrastructure hosting the Customer’s data; contains no personal data1 week (Platform) / 1 month (Employee Portal); retained after logout
_itx_sessionSiit (Platform / Employee Portal)Security state during sign-in flows (including CSRF and SSO/OAuth state)Session
ory_session_<slug>Siit via Ory (auth.siit.io)Authentication session used when a user connects an MCP clientSession
ory_kratos_continuitySiit via Ory (auth.siit.io)Maintains continuity during multi-step MCP sign-in flows30 days
csrf_token_<hash>Siit via Ory (auth.siit.io)Protects MCP sign-in flows against cross-site request forgery (CSRF)1 year
ory_oauth2_login_csrf_<project>_*; ory_oauth2_consent_csrf_<project>_*Siit via Ory (auth.siit.io)Protects OAuth login and consent steps for MCP sign-in against CSRF30 minutes
__cf_bm; __cflbCloudflare in front of Ory (auth.siit.io)Bot protection and load balancing for the MCP sign-in page30 minutes / up to 1 day
employee_portal_<company_uid>_<workspace_subdomain>_access_tokenSiit (Employee Portal)Encrypted login session for the Employee Portal; deleted on logout1 month (also ended server-side after 7 days of inactivity)
secured_assets_<company_uid>_access_tokenSiit (Employee Portal)Authorizes the browser to load the Customer’s protected files and attachmentsSame as the login session (1 month)

‍

2.2 Functional cookies

These cookies remember choices you make and enable enhanced features, such as remembering your preferred interface language or providing in-app features.

Consent requirement: some functional cookies do not require your consent where they are strictly necessary to provide a feature expressly requested by you, such as remembering the interface language you selected. Other functional cookies are placed only with your consent.

GDPR legal basis: where a functional cookie does not require consent and personal information is processed, we rely on our legitimate interests in providing and administering the Services and remembering the preferences you select. Where consent is required and personal information is processed, we rely on your consent.

‍

CookieProviderPurposeDurationConsent required
localeSiit (Platform / Employee Portal)Remembers the interface language selected by the userSessionNo
messagesUtkHubSpot (Website)Recognizes the visitor in the HubSpot chat widget so previous conversations can be retained6 monthsYes
chmln:* (browser local storage)Chameleon (Platform)Supports in-app onboarding tours and product announcements and remembers which tours have been seen6 monthsYes

2.3 Analytics and performance cookies

These cookies help us understand how visitors use the Website and how users interact with the Platform – for example, which pages or features are used, how long visitors stay and whether they encounter errors – so that we can improve the Website and our Services. Some of these cookies collect your IP address to determine your approximate location.

Consent requirement: your consent is required.

GDPR legal basis: for personal information processed through these cookies, we rely on your consent for Website analytics and, for our own product usage analytics within the Platform, our legitimate interests in understanding and improving the Services, as described in our Privacy Policy. This does not affect the requirement to obtain your consent before placing any non-essential analytics cookie on your device.

CookieProviderPurposeDuration
_gaGoogle Analytics 4 (Website; Platform /signup and registration)Distinguishes visitors for Website usage statistics and Platform sign-up measurement13 months
_ga_<container_id>Google Analytics 4 (Website; Platform /signup and registration)Maintains session state for Website usage statistics and Platform sign-up measurement13 months
ph_<project_key>_posthogPostHog (Website and Platform; EU hosting)Website and product analytics using a visitor/user, device and session identifier; runs in-app surveys on the Platform; Platform session recording is disabled1 year
_clckMicrosoft Clarity (Website)Stores a Clarity user ID and preferences for heatmaps and session recordings1 year
_clskMicrosoft Clarity (Website)Groups multiple page views into one Clarity session recording1 day
CLIDMicrosoft Clarity (Website)Identifies the visitor across websites that use Microsoft Clarity1 year
__hstcHubSpot (Website; Platform /signup)Tracks visitors and sessions, including first, last and current visit timestamps and session count6 months
__hsscHubSpot (Website; Platform /signup)Tracks the current session and counts sessions and page views30 minutes
__hssrcHubSpot (Website; Platform /signup)Detects whether the browser was restarted to determine whether a new session has startedSession

2.4 Marketing and advertising cookies

These cookies are used to measure the effectiveness of our marketing campaigns and, where applicable, to show you relevant Siit ads on other websites and platforms. They may be set by our advertising partners, who may use them to build a profile of your interests.

Consent requirement: your consent is required.

GDPR legal basis: your consent.

CookieProviderPurposeDuration
hubspotutkHubSpot (Website; Platform /signup)Identifies a visitor and links the visitor to a HubSpot contact or marketing source when a form or sign-up is submitted6 months
_gcl_auGoogle Ads (Website and Platform)Stores ad-click information to attribute demo requests and sign-ups to Google Ads campaigns90 days
IDEGoogle / DoubleClick (Website and Platform)Advertising measurement and remarketing13 months
test_cookieGoogle / DoubleClick (Website and Platform)Checks whether the browser accepts cookies in connection with Google Ads15 minutes
_uetsidMicrosoft Advertising / Bing UET (Website; Platform registration)Session identifier used for Microsoft Ads conversion tracking1 day
_uetvidMicrosoft Advertising / Bing UET (Website; Platform registration)Visitor identifier used for Microsoft Ads conversion tracking and remarketing13 months
_uetmsclkidMicrosoft Advertising / Bing UET (Website)Stores the Microsoft Ads click ID for conversion attribution90 days
MUIDMicrosoft (Website)Microsoft user identifier used across Microsoft sites for advertising and Microsoft Clarity13 months
_fbpMeta (Website)Meta Pixel browser identifier used for ad delivery, measurement and retargeting3 months
frMeta (Website)Advertising delivery and measurement3 months
li_sugrLinkedIn (Website)Browser identifier used by the LinkedIn Insight Tag for advertising measurement3 months
bcookieLinkedIn (Website)LinkedIn browser identifier1 year
lidcLinkedIn (Website)Routing and data-center selection for LinkedIn services1 day
UserMatchHistory; AnalyticsSyncHistoryLinkedIn (Website)Synchronizes LinkedIn advertising identifiers and records when the visitor was last synchronized with LinkedIn30 days
li_fat_idLinkedIn (Website)Indirect LinkedIn member identifier used for conversion tracking and retargeting30 days
snitcher_device_idSnitcher (Website; Platform /signup)B2B visitor identification: identifies the company associated with a visitor’s IP address and distinguishes visitors on the same network1 year

3. Who receives information collected through cookies

Depending on the cookie, information collected through cookies may be accessed or received by Siit and/or the provider identified in Section 2. Where a provider processes information on our behalf, it acts as our service provider and processes the information under our instructions.

Some analytics and advertising providers may also process information for their own purposes. For certain advertising technologies, including the Meta Pixel and the LinkedIn Insight Tag, Siit and the relevant provider may act as joint controllers for the collection and transmission of information to that provider; the provider acts as an independent controller for its subsequent processing. Please review the relevant provider’s privacy notice for more information.

4. International transfers

Some of the providers listed in Section 2, including Google, Microsoft, Meta, HubSpot, Chameleon and Cloudflare, are located in, or may access information from, countries outside the European Economic Area (“EEA”), including the United States. Where Siit is responsible for a transfer of personal information outside the EEA, including where we are responsible for the collection and transmission of information to a third-party provider, we use the transfer mechanisms described in Section 8 of our Privacy Policy. Third-party providers are responsible for the subsequent processing and international transfers they carry out for their own purposes, as described in their privacy notices.

5. How long we keep information collected through cookies

Cookie lifetime: the lifetime of each cookie is indicated in the tables in Section 2 and in Cookie Settings. We limit the lifetime of cookies to what is necessary for the purposes for which they are used.

Information collected through cookies: we retain personal information collected through cookies only for as long as necessary for the purposes described in this notice, taking into account the nature of the information and the purposes for which it is processed. We delete or anonymize it when it is no longer needed.

Your cookie choices: we keep a record of your choices for up to one year, after which we may ask you to make your choices again.

6. Your choices

6.1 Your consent

We place cookies that require consent only after obtaining your consent. When you first visit the Website, our cookie banner lets you accept all, reject all or customize your choices, with the same ease. If you close the banner without making a choice, no cookies requiring consent are placed. You can withdraw your consent or change your preferences at any time, as easily as you gave it, by clicking Cookie Settings in the footer of the Website.

6.2 Browser settings and other tools

Most web browsers allow you to block or delete cookies through their settings, usually found in the “Settings”, “Options” or “Preferences” menu. The following links explain how to manage cookies in the most common browsers:

If you block strictly necessary cookies, parts of the Website or the Platform may not work properly. Please note that browser settings are not a substitute for your choices in our cookie consent tool (see Section 6.1).

You can also use the following tools:

7. Your rights

You have rights over the personal information collected through cookies, including the right to access, correct or delete it, and the right to lodge a complaint with the French data protection authority (CNIL) or the supervisory authority of the EU Member State in which you live or work. To learn more about your rights and how to exercise them, please see Section 7 of our Privacy Policy.

8. Changes to this Cookie Notice

We may update this Cookie Notice from time to time, for example when we add or remove cookies or to reflect changes in applicable law. We will update the “Last updated” date at the top of this Notice and, where required, ask for your consent again.

9. Contact us

If you have any questions about this Cookie Notice, please contact us at privacy@siit.io or by mail at Siit SAS, Attn: Privacy, 101 rue de Prony, 75017 Paris, France.

‍