Cookie Policy
Last updated: 2026-08-16
This policy is published in English and Swedish. In the event of any discrepancy, the English version governs. It should be read together with our privacy policy, which explains how the personal data collected through cookies is used.
1. What cookies are
A cookie is a small text file stored on your device by a website. Similar technologies, including local storage and tracking pixels, serve the same purposes and are covered by this policy on the same terms. Where this policy refers to cookies, it refers to those technologies as well.
Cookies set by us are described as first party cookies. Cookies set by another organisation whose code runs on our pages are described as third party cookies, and that organisation receives the information the cookie carries.
2. Your consent
Cookies that are strictly necessary to provide the service you have asked for are set without consent, as the law permits. Every other cookie is set only after you have consented to the category it belongs to.
Before you make a choice, no analytics or advertising cookie is written. Google Analytics loads with all storage denied, which means it writes no cookie and sends no identifier until you accept the analytics category. The Meta, LinkedIn and TikTok advertising tags are not loaded at all until you accept the marketing category.
You may change or withdraw your choice at any time. Withdrawing consent stops further collection. It does not delete cookies already written, which you can remove through your browser settings, and it does not affect processing that took place while consent was in force.
3. The cookies we use
The following cookies may be set. Which of them are actually present depends on the choices you have made and on which parts of the service you use.
Strictly necessary
Required to operate the website and to keep you signed in. These cannot be declined, because without them the service cannot be provided. No consent is required for them.
| Name | Purpose | Duration |
|---|---|---|
| auth_token | Keeps you signed in between requests. Set when you sign in and removed when you sign out. | Up to 30 days, depending on how you signed in |
| active_account | Records which account you are working in where you have access to more than one. | Until the browser is closed |
| google_oauth_state, apple_oauth_state, gcal_oauth_state, shopify_oauth_nonce, canva_oauth_verifier | Protects the process of connecting an external account against request forgery. Set when the connection begins and removed when it completes. | A few minutes |
| google_oauth_return, apple_oauth_return, gcal_oauth_return, google_oauth_mobile | Records the page to return you to once an external account has been connected. | A few minutes |
| shopify_shop | Identifies the Shopify store the application was opened from. | Until the browser is closed |
| admin_impersonated_user | Present only during a support session in which a member of our staff is acting in an account with authorisation. Removed when that session ends. | Until the browser is closed |
Analytics
Used to understand how the service is used so that it can be improved. Set only if you accept the analytics category. PostHog is configured on European hosting; Google Analytics processes data in the United States under the safeguards described in our privacy policy.
| Name | Provider | Purpose | Duration |
|---|---|---|---|
| _ga | Google Analytics | Distinguishes browsers so that visits can be counted. | Two years |
| _ga_<property id> | Google Analytics | Maintains the analytics session state for the property. | Two years |
| ph_<project token>_posthog | PostHog | Distinguishes browsers and records which features are used within the application. | Twelve months |
Marketing
Used to measure the effect of our advertising and to show advertisements for oriiion. Set only if you accept the marketing category. These cookies allow Google, Meta and LinkedIn to recognise your browser across sites, and their use may constitute sharing for cross-context behavioural advertising under Californian law.
| Name | Provider | Purpose | Duration |
|---|---|---|---|
| _gcl_au | Google Ads | Attributes a visit to a Google advertisement so that the effect of our advertising can be measured. | Three months |
| _fbp | Meta | A browser identifier used by Meta to attribute visits and actions to advertising on Facebook and Instagram. | Three months |
| _fbc | Meta | Records the Meta advertisement click that brought you to the site. | Three months |
| bcookie | A browser identifier used by LinkedIn to attribute visits to advertising. | One year | |
| li_sugr | A browser identifier used by LinkedIn for measurement. | Three months | |
| UserMatchHistory | Records that your browser has been matched to a LinkedIn member for advertising measurement. | 30 days | |
| lidc | Routes your requests to a LinkedIn data centre. | One day |
Functional
The cookie settings panel offers a functional category for cookies that remember optional preferences. We do not currently set any cookie in this category. The category is retained so that if such a cookie is introduced, it is covered by a consent choice from the outset rather than added to an existing one.
4. Information stored in your browser
In addition to cookies, we store the following in your browser's local storage. This information stays on your device and is not transmitted to us as a cookie:
- oriiion_cookie_consent, recording that you have made a cookie choice and when.
- oriiion_cookie_preferences, recording which categories you accepted.
- oriiion_on_the_go_dismissed_at, recording that you dismissed a prompt so that it is not shown again immediately.
We also keep a record of consent choices on our servers, consisting of a hashed form of your IP address, your browser identification, the categories accepted and the time. This is kept for twelve months as evidence that consent was obtained, after which consent is requested again. The hash is used so that the record cannot be read back as an IP address.
5. Controlling cookies in your browser
Browsers allow you to block or delete cookies. The controls are found in the privacy or security settings of the browser, and the exact route differs between browsers and versions.
Blocking strictly necessary cookies will prevent you from signing in and will stop parts of the service from working. Blocking or deleting other cookies has no effect on the service.
If you delete the local storage entries described in section 4, we no longer hold a record of your choice in the browser and the cookie banner is shown again.
6. Third parties and international transfers
Where a third party cookie is set, that provider receives information about your visit and processes it under its own terms. Accepting a category is what permits that to happen.
The providers concerned, and the safeguards applied where they process data outside the European Economic Area, are described in our privacy policy and on our sub-processor page.
7. Questions
For questions about this policy or about a specific cookie, write to data@oriiion.ai.