Cookie Policy

Effective date: 13.04.2026 · Last updated: 25.09.2026

1. What Are Cookies

Cookies are small text files stored on your device by your web browser. They are used to remember preferences, maintain login sessions, and ensure proper service operation.

Guardiso uses cookies mainly to the extent necessary for platform operation. Only with your consent do we store two more things: your appearance and language settings (sections 2b and 2c) and the Google Ads advertising cookies (section 3a). We do not build user profiles.

2. Essential Cookies

These cookies are required for proper service operation and cannot be disabled. They include:

Name	Purpose	Duration
__Secure-authjs.session-token	Authentication session: keeps the user signed in (Auth.js v5, HttpOnly, Secure)	Until sign-out / 30 days
__Host-authjs.csrf-token	CSRF protection: guards against cross-site request forgery	Session
__Secure-authjs.callback-url	Temporary return path after the OAuth sign-in flow completes	Session
guardiso_setup_choice	Onboarding path selection (demo, setup wizard, skip)	Session
guardiso_auditor_session	Auditor session: links the sign-in to the auditor access link, read-only access. Page scripts cannot read it (HttpOnly). It is set only when entering from the auditor portal.	Until the auditor access ends, at most 8 hours
guardiso-auditor	Auditor session marker with no data in it. It tells the page that an auditor is working, so the page keeps the portal language. It is set only when entering from the auditor portal.	Until the auditor access ends, at most 8 hours
guardiso-auditor-lang	Language of the auditor portal, set from the link in the invitation so that the following portal pages use the same language. Page scripts cannot read it (HttpOnly). It is set only in the auditor portal.	Session
dev_access	Password gate for the development environment (only on dev.guardiso.com, never set on production)	Session

Some of the items above (for example temporary OAuth flow parameters from GitHub or Slack when connecting integrations) are set only briefly and removed automatically once the operation completes.

2a. Bot protection (Cloudflare Turnstile)

The demo booking form (the “Book a call” page) is protected against automated abuse using Cloudflare Turnstile. This is a security mechanism necessary for the form to work. It protects against spam and abuse. To verify that a submission comes from a human, Cloudflare may set its own short-lived cookies:

Name	Purpose	Duration
__cf_bm	Cloudflare Bot Management: distinguishes human traffic from bots; set by Cloudflare during Turnstile verification	up to 30 minutes
cf_clearance	Confirmation that a Cloudflare security challenge was passed. It may be set under heightened protection	up to 1 year

These files serve security purposes only and fall under the strictly necessary category. They are not used for tracking, profiling or advertising. They are subject to Cloudflare's privacy policy. The Turnstile script is loaded only on the form page, not across the rest of the site.

Cloudflare Privacy Policy

2b. Browser storage (local storage)

Beyond cookies, the site uses your browser's local storage to remember your display preferences. This is technical data. It is not sent to the server or used for tracking.

Key	Purpose
guardiso-landing-theme	Light or dark theme preference for the landing page and the demo booking form
guardiso-theme	Interface theme preference in the authenticated part of the platform

2c. Interface language

We remember the language in two separate records, and each one answers a different question. The first says which language to show as soon as you arrive. The second says that a person picked the language by clicking the switch. Without that second record the platform would fall back to your company language after every sign-in and discard your choice.

Name	Type	Purpose	Duration
guardiso-lang	Cookie	Interface language (PL, EN, NL, DE, FI). The platform also writes it on its own, when it infers the language from your browser settings or takes your company language.	1 year
guardiso-lang	Browser storage	The same value, in case the cookie is lost.	Until you clear site data
guardiso-lang	Cookie	The language from the page address when you open a page in another language, for example with ?lang=en added. This keeps the following pages of the visit in the same language. It is not set if you refuse preference storage in the consent window.	Until you close the browser
guardiso-lang	Cookie	Platform language for an auditor. The auditor sign-in from the auditor portal writes it, with Polish as the language. It is not set outside the auditor sign-in.	Until the auditor access ends, at most 8 hours
guardiso-wybor-jezyka	Cookie	A record of your own language choice. It is created only when you click the language switch, never on its own.	1 year
guardiso-wybor-jezyka	Browser storage	The same value, so your choice survives opening a new tab even if the cookie disappears.	Until you clear site data

Each of these records belongs to the “Preferences” category in the consent window. If you refuse that category on a public page, we delete them and stop remembering your language between visits. The site keeps working, and for that single visit the language comes from the server response.

3. Analytics Cookies

Currently, Guardiso does not use any analytics cookies (e.g., Google Analytics, Plausible, Mixpanel).

We also do not use Real User Monitoring tools (for example Cloudflare Web Analytics). Our typefaces are served from our own server, so loading a page does not send your network address to Google Fonts.

In the future, we may introduce anonymous usage analytics to improve service quality. In that case, we will update this policy and notify users with 30 days' advance notice.

3a. Advertising Cookies (Google Ads)

On the public pages of guardiso.com we load the Google Ads tag, but only if you switch on the “Marketing” category in the consent window. The tag has one job: it checks whether a trial account was created by someone who came from our Google ad. When a page loads, it sends Google the page address without extra parameters, and Google also sees your device's network address. We have switched off counting moves between pages and collecting email addresses from forms. We do not tailor ads to a specific person. The tag does not run in the signed-in part of the platform. The only exception is the moment right after a trial account is created, when it sends Google one message about that event.

Name	Purpose	Duration
_gcl_au	Google Ads. Links a visit to the ad it came from.	90 days
_gcl_aw	Google Ads. Stores the ad click identifier. Created only when you arrive from an ad.	90 days
_gcl_gb	Google Ads. The same as above for clicks from iOS devices.	90 days
_gcl_ag	Google Ads. Stores the ad click identifier from Google apps on a phone. Created only when you arrive from such an ad.	90 days
_gcl_ls	Google Ads. A copy of the ad click identifier in browser storage, not in a cookie. We delete it when you withdraw consent.	Until you withdraw consent
_gcl_gs	Google Ads. Stores ad click data needed to count the account creation.	90 days
guardiso_konto_probne	Guardiso. A one-time note that a trial account has just been created. Removed once it has been passed to Google.	Up to 30 minutes

Google may also store its own cookies on its own domain, for example doubleclick.net. Google processes the ad click data as a separate controller, under the terms of its own privacy policy. You can withdraw your consent at any time in the cookie settings. After you withdraw it, we delete the cookies listed above and reload the page.

4. Third-party Cookies

During Google OAuth login, Google may set its own cookies as part of the authentication process. These cookies are subject to Google's privacy policy:

Guardiso has no control over cookies set by Google and does not use them for its own purposes.

5. Managing Cookies

You can manage cookies through your browser settings. Below are links to instructions for popular browsers:

Note: disabling essential cookies (e.g., authentication session) will prevent you from using the authenticated part of the Guardiso platform.

6. Contact

If you have questions about cookies, please contact us:

Email: kontakt@guardiso.com