Siit Cookie Notice
Cookie Notice
This Cookie Notice explains how Siit SAS (“ Siit”, “ we”, “ us” or “ our”) uses cookies and similar technologies when you visit siit.io and our other websites (the “ Website”) and when you use our web applications, including the admin dashboard at app.siit.io and employee portals hosted at
This Cookie Notice supplements our Privacy Policy, which applies to any personal information collected through cookies. Capitalized terms not defined in this Cookie Notice have the meaning given to them in our Privacy Policy.
This Cookie Notice does not apply to cookies placed through Siit features embedded in our Customers’ own websites or tools (for example, a support portal or chat widget). Those cookies are governed by the cookie policy of the relevant Customer.
Cookies at a glance
We use strictly necessary cookies to run the Website and the Platform securely. They do not require your consent.
Some functional cookies also do not require your consent where they are strictly necessary to provide a feature you expressly request, such as remembering your interface language.
With your consent, we use other functional, analytics and marketing cookies on the Website and, where applicable, the Platform to provide enhanced features, understand how our services are used and measure our campaigns.
You can change your preferences at any time by clicking Cookie Settings in the footer of the Website.
1. What are cookies and similar technologies?
Cookies are small text files placed on your browser or device when you visit a website. They allow the website to recognize your browser or device, for example to keep you signed in or to remember your preferences.
First-party cookies are set by Siit. Third-party cookies are set by other companies, such as analytics or advertising providers.
Session cookies expire when you close your browser. Persistent cookies remain on your device for a set period or until you delete them.
We also use similar technologies, such as pixels (or web beacons), tags, scripts, software development kits (SDKs) and local storage. In this Cookie Notice, we refer to all of these technologies as “cookies”.
2. The cookies we use and why
We use the categories of cookies described below. For each category, we explain why we use them, whether your consent is required, and the legal basis on which we rely under the GDPR. The tables list the cookies in use at the date of this Notice; the full, up-to-date list is available in our cookie consent tool via Cookie Settings.
2.1 Strictly necessary cookies
These cookies are essential for the Website and the Platform to function. They enable core features such as signing in, keeping your session secure, balancing traffic across our servers and remembering your cookie preferences.
Consent requirement: not required, because these cookies are strictly necessary.
GDPR legal basis: where personal information is processed, our legitimate interests in operating and securing the Website and the Platform. You can block them through your browser settings, but parts of the Website or the Platform may then not work.
| Cookie | Provider | Purpose | Duration |
|---|---|---|---|
_cfuvid |
Cloudflare (Website) | Rate limiting and bot protection for the Website CDN | Session |
fs-consent |
Consent Pro (www.siit.io) | Stores the ID and timestamp of the visitor’s cookie consent record so the banner remembers the visitor’s choice | 1 year |
__cf_bm |
HubSpot via Cloudflare (HubSpot Meetings iframe) | Bot protection for the embedded HubSpot Meetings calendar | 30 minutes |
li_gc |
LinkedIn (Website) | Stores the visitor’s consent to LinkedIn non-essential cookies | 6 months |
admin_dashboard_access_token |
Siit (Platform) | Encrypted login session for the admin dashboard; deleted on logout | 1 week (also ended server-side after 1 day of inactivity) |
secured_assets_<company_uid>_access_token |
Siit (Platform) | Authorizes the browser to load the Customer’s protected files and attachments | Same as the login session (1 week) |
siit_frontend_cell |
Siit (Platform / Employee Portal) | Routes the browser to the regional infrastructure hosting the Customer’s data and serves the matching application version; contains no personal data | 1 year |
siit_cell |
Siit (Platform / Employee Portal) | Server-side routing hint identifying the regional infrastructure hosting the Customer’s data; contains no personal data | 1 week (Platform) / 1 month (Employee Portal); retained after logout |
_itx_session |
Siit (Platform / Employee Portal) | Security state during sign-in flows (including CSRF and SSO/OAuth state) | Session |
ory_session_<slug> |
Siit via Ory (auth.siit.io) | Authentication session used when a user connects an MCP client | Session |
ory_kratos_continuity |
Siit via Ory (auth.siit.io) | Maintains continuity during multi-step MCP sign-in flows | 30 days |
csrf_token_<hash> |
Siit via Ory (auth.siit.io) | Protects MCP sign-in flows against cross-site request forgery (CSRF) | 1 year |
ory_oauth2_login_csrf_<project>_*; ory_oauth2_consent_csrf_<project>_* |
Siit via Ory (auth.siit.io) | Protects OAuth login and consent steps for MCP sign-in against CSRF | 30 minutes |
__cf_bm; __cflb |
Cloudflare in front of Ory (auth.siit.io) | Bot protection and load balancing for the MCP sign-in page | 30 minutes / up to 1 day |
employee_portal_<company_uid>_<workspace_subdomain>_access_token |
Siit (Employee Portal) | Encrypted login session for the Employee Portal; deleted on logout | 1 month (also ended server-side after 7 days of inactivity) |
secured_assets_<company_uid>_access_token |
Siit (Employee Portal) | Authorizes the browser to load the Customer’s protected files and attachments | Same as the login session (1 month) |
2.2 Functional cookies
These cookies remember choices you make and enable enhanced features, such as remembering your preferred interface language or providing in-app features.
Consent requirement: some functional cookies do not require your consent where they are strictly necessary to provide a feature expressly requested by you, such as remembering the interface language you selected. Other functional cookies are placed only with your consent.
GDPR legal basis: where a functional cookie does not require consent and personal information is processed, we rely on our legitimate interests in providing and administering the Services and remembering the preferences you select. Where consent is required and personal information is processed, we rely on your consent.
| Cookie | Provider | Purpose | Duration | Consent required |
|---|---|---|---|---|
locale |
Siit (Platform / Employee Portal) | Remembers the interface language selected by the user | Session | No |
messagesUtk |
HubSpot (Website) | Recognizes the visitor in the HubSpot chat widget so previous conversations can be retained | 6 months | Yes |
chmln:* (browser local storage) |
Chameleon (Platform) | Supports in-app onboarding tours and product announcements and remembers which tours have been seen | 6 months | Yes |
2.3 Analytics and performance cookies
These cookies help us understand how visitors use the Website and how users interact with the Platform – for example, which pages or features are used, how long visitors stay and whether they encounter errors – so that we can improve the Website and our Services. Some of these cookies collect your IP address to determine your approximate location.
Consent requirement: your consent is required.
GDPR legal basis: for personal information processed through these cookies, we rely on your consent for Website analytics and, for our own product usage analytics within the Platform, our legitimate interests in understanding and improving the Services, as described in our Privacy Policy. This does not affect the requirement to obtain your consent before placing any non-essential analytics cookie on your device.
| Cookie | Provider | Purpose | Duration |
|---|---|---|---|
_ga |
Google Analytics 4 (Website; Platform /signup and registration) | Distinguishes visitors for Website usage statistics and Platform sign-up measurement | 13 months |
_ga_<container_id> |
Google Analytics 4 (Website; Platform /signup and registration) | Maintains session state for Website usage statistics and Platform sign-up measurement | 13 months |
ph_<project_key>_posthog |
PostHog (Website and Platform; EU hosting) | Website and product analytics using a visitor/user, device and session identifier; runs in-app surveys on the Platform; Platform session recording is disabled | 1 year |
_clck |
Microsoft Clarity (Website) | Stores a Clarity user ID and preferences for heatmaps and session recordings | 1 year |
_clsk |
Microsoft Clarity (Website) | Groups multiple page views into one Clarity session recording | 1 day |
CLID |
Microsoft Clarity (Website) | Identifies the visitor across websites that use Microsoft Clarity | 1 year |
__hstc |
HubSpot (Website; Platform /signup) | Tracks visitors and sessions, including first, last and current visit timestamps and session count | 6 months |
__hssc |
HubSpot (Website; Platform /signup) | Tracks the current session and counts sessions and page views | 30 minutes |
__hssrc |
HubSpot (Website; Platform /signup) | Detects whether the browser was restarted to determine whether a new session has started | Session |
2.4 Marketing and advertising cookies
These cookies are used to measure the effectiveness of our marketing campaigns and, where applicable, to show you relevant Siit ads on other websites and platforms. They may be set by our advertising partners, who may use them to build a profile of your interests.
Consent requirement: your consent is required.
GDPR legal basis: your consent.
| Cookie | Provider | Purpose | Duration |
|---|---|---|---|
hubspotutk |
HubSpot (Website; Platform /signup) | Identifies a visitor and links the visitor to a HubSpot contact or marketing source when a form or sign-up is submitted | 6 months |
_gcl_au |
Google Ads (Website and Platform) | Stores ad-click information to attribute demo requests and sign-ups to Google Ads campaigns | 90 days |
IDE |
Google / DoubleClick (Website and Platform) | Advertising measurement and remarketing | 13 months |
test_cookie |
Google / DoubleClick (Website and Platform) | Checks whether the browser accepts cookies in connection with Google Ads | 15 minutes |
_uetsid |
Microsoft Advertising / Bing UET (Website; Platform registration) | Session identifier used for Microsoft Ads conversion tracking | 1 day |
_uetvid |
Microsoft Advertising / Bing UET (Website; Platform registration) | Visitor identifier used for Microsoft Ads conversion tracking and remarketing | 13 months |
_uetmsclkid |
Microsoft Advertising / Bing UET (Website) | Stores the Microsoft Ads click ID for conversion attribution | 90 days |
MUID |
Microsoft (Website) | Microsoft user identifier used across Microsoft sites for advertising and Microsoft Clarity | 13 months |
_fbp |
Meta (Website) | Meta Pixel browser identifier used for ad delivery, measurement and retargeting | 3 months |
fr |
Meta (Website) | Advertising delivery and measurement | 3 months |
li_sugr |
LinkedIn (Website) | Browser identifier used by the LinkedIn Insight Tag for advertising measurement | 3 months |
bcookie |
LinkedIn (Website) | LinkedIn browser identifier | 1 year |
lidc |
LinkedIn (Website) | Routing and data-center selection for LinkedIn services | 1 day |
UserMatchHistory; AnalyticsSyncHistory |
LinkedIn (Website) | Synchronizes LinkedIn advertising identifiers and records when the visitor was last synchronized with LinkedIn | 30 days |
li_fat_id |
LinkedIn (Website) | Indirect LinkedIn member identifier used for conversion tracking and retargeting | 30 days |
snitcher_device_id |
Snitcher (Website; Platform /signup) | B2B visitor identification: identifies the company associated with a visitor’s IP address and distinguishes visitors on the same network | 1 year |
3. Who receives information collected through cookies
Depending on the cookie, information collected through cookies may be accessed or received by Siit and/or the provider identified in Section 2. Where a provider processes information on our behalf, it acts as our service provider and processes the information under our instructions.
Some analytics and advertising providers may also process information for their own purposes. For certain advertising technologies, including the Meta Pixel and the LinkedIn Insight Tag, Siit and the relevant provider may act as joint controllers for the collection and transmission of information to that provider; the provider acts as an independent controller for its subsequent processing. Please review the relevant provider’s privacy notice for more information.
4. International transfers
Some of the providers listed in Section 2, including Google, Microsoft, Meta, HubSpot, Chameleon and Cloudflare, are located in, or may access information from, countries outside the European Economic Area (“EEA”), including the United States. Where Siit is responsible for a transfer of personal information outside the EEA, including where we are responsible for the collection and transmission of information to a third-party provider, we use the transfer mechanisms described in Section 8 of our Privacy Policy. Third-party providers are responsible for the subsequent processing and international transfers they carry out for their own purposes, as described in their privacy notices.
5. How long we keep information collected through cookies
Cookie lifetime: the lifetime of each cookie is indicated in the tables in Section 2 and in Cookie Settings. We limit the lifetime of cookies to what is necessary for the purposes for which they are used.
Information collected through cookies: we retain personal information collected through cookies only for as long as necessary for the purposes described in this notice, taking into account the nature of the information and the purposes for which it is processed. We delete or anonymize it when it is no longer needed.
Your cookie choices: we keep a record of your choices for up to one year, after which we may ask you to make your choices again.
6. Your choices
6.1 Your consent
We place cookies that require consent only after obtaining your consent. When you first visit the Website, our cookie banner lets you accept all, reject all or customize your choices, with the same ease. If you close the banner without making a choice, no cookies requiring consent are placed. You can withdraw your consent or change your preferences at any time, as easily as you gave it, by clicking Cookie Settings in the footer of the Website.
6.2 Browser settings and other tools
Most web browsers allow you to block or delete cookies through their settings, usually found in the “Settings”, “Options” or “Preferences” menu. The following links explain how to manage cookies in the most common browsers:
If you block strictly necessary cookies, parts of the Website or the Platform may not work properly. Please note that browser settings are not a substitute for your choices in our cookie consent tool (see Section 6.1).
You can also use the following tools:
- Google Analytics Opt-out Browser Add-on
- Your Online Choices (Europe)
- Digital Advertising Alliance (United States)
- Digital Advertising Alliance of Canada
7. Your rights
You have rights over the personal information collected through cookies, including the right to access, correct or delete it, and the right to lodge a complaint with the French data protection authority (CNIL) or the supervisory authority of the EU Member State in which you live or work. To learn more about your rights and how to exercise them, please see Section 7 of our Privacy Policy.
8. Changes to this Cookie Notice
We may update this Cookie Notice from time to time, for example when we add or remove cookies or to reflect changes in applicable law. We will update the “Last updated” date at the top of this Notice and, where required, ask for your consent again.
9. Contact us
If you have any questions about this Cookie Notice, please contact us at privacy@siit.io or by mail at Siit SAS, Attn: Privacy, 101 rue de Prony, 75017 Paris, France.