Cookie Policy
How SenseOn uses cookies and similar technologies on senseon.io.
What this policy covers
Cookies, pixels and browser storage can store or read information on your device. This policy explains their purposes and how you can control optional use.
Necessary cookies protect forms, sign-in, requested downloads and privacy choices. Google Analytics and advertising technologies require the relevant analytics or marketing consent.
UK statistics mode
For visitors located in the UK, we use PostHog anonymous statistics to improve the site unless you turn them off. The cookie lasts up to 90 days. This mode has no person profiles, identification or replay.
The legal basis is PECR Schedule A1 paragraph 5 and UK GDPR legitimate interests. Use the one-click Turn off control next to Analytics: on in the banner, or reopen Cookie Settings at any time.
EU and other visitors, including visitors whose location is unknown, are asked for consent before PostHog analytics cookies are used.
PostHog cookieless counting is used after an explicit refusal in consent mode. PostHog counts these visits without a cookie, using a server-side hash. It sets no browser storage. It creates no person profiles and does not identify you or record replay.
Tracking technologies
This table covers the technologies used by the website. Providers run only when their services are configured. Cookie lifetime and event retention are different; provider project retention is managed separately.
| Tool or technology | Owner | Purpose | Lifetime | Legal basis |
|---|---|---|---|---|
| Vercel Analytics | Vercel | Cookieless, aggregated website measurement; runs independently of cookie choices. | No analytics cookie; provider manages measurement retention | Legitimate interests in improving the website. |
| PostHog consent analytics: ph_<project key>_posthog | PostHog | Website engagement analytics after consent. The optional identification tick links visits this browser has already recorded under analytics consent, and future visits, to your details. PostHog replay stays off. | Up to 90 days for the cookie | Consent. |
| __ph_opt_in_out_<project key> | PostHog | Remembers whether PostHog measurement is permitted. Removed when PostHog is off or counting is cookieless. | Up to 90 days | Privacy preference; legitimate interests in respecting your choices. |
| ph_<project key>_window_id / ph_<project key>_primary_window_exists (session storage) | PostHog | Maintains the browser tab for consent analytics or UK statistics. Removed when PostHog is off or counting is cookieless. | Browser tab session | Consent for analytics; PECR Schedule A1 paragraph 5 and UK GDPR legitimate interests for UK statistics. |
| PostHog anonymous statistics: ph_<project key>_posthog | PostHog | UK statistics to improve the site unless you turn them off; no person profiles, identification or replay. | Up to 90 days for the cookie | PECR Schedule A1 paragraph 5; UK GDPR legitimate interests. |
| PostHog cookieless counting | PostHog | PostHog counts these visits without a cookie, using a server-side hash after an explicit refusal in consent mode; no person profiles, identification or replay. | No browser storage; project retention is managed separately | Legitimate interests in anonymous website measurement. |
| Google Analytics 4: _ga / _ga_* | Website analytics and conversion reporting only after analytics consent. | Provider-managed expiry and retention; not specified by this website. | Consent. | |
| Google Ads: _gcl_aw / _gcl_dc | Advertising conversion measurement when configured, only after marketing consent. | Provider-managed expiry and retention; not specified by this website. | Consent. | |
| Meta Pixel: _fbp / _fbc | Meta | Advertising page views and conversion measurement when configured, only after marketing consent. | Provider-managed expiry and retention; not specified by this website. | Consent. |
| LinkedIn Insight: li_fat_id / _li_ss | Campaign and conversion measurement when configured, only after marketing consent. | Provider-managed expiry and retention; not specified by this website. | Consent. | |
| Sentry | Sentry | Error and performance diagnostics, including sampled session replay with text and inputs masked and media blocked. Runs when monitoring is configured; not controlled by Cookie Settings. | Project retention is managed separately; browser session monitoring may use session storage | Legitimate interests in reliability and security. |
| Apex event bridge | SenseOn | Receives requested forms and privacy choices; page-view reporting requires analytics consent. No additional Apex browser cookie. | Project retention is managed separately | Contract and legitimate interests for requests and privacy choices; consent for analytics. |
| __Host-so_csrf | SenseOn | Protects forms against cross-site request forgery. | Session | Necessary for the requested service; contract and legitimate interests in security and functionality. |
| __Host-senseon_consent | SenseOn | Remembers privacy choices and the notice version. | Up to 12 months | Necessary to remember and respect privacy choices; legitimate interests. |
| __Host-so_auth_session | SenseOn | Keeps authorised users signed in. | Up to 7 days | Necessary for the requested service; contract and legitimate interests in security and functionality. |
| __Host-so_magic_link_state / __Host-so_sso_state | SenseOn | Protects magic-link and single sign-on callbacks. | Up to 15 minutes | Necessary for the requested service; contract and legitimate interests in security and functionality. |
| __Host-so_auth_rollout | SenseOn | Keeps authentication availability consistent during a staged rollout. | Up to 30 days | Necessary for the requested service; contract and legitimate interests in security and functionality. |
| __Host-so_lm_session | SenseOn | Protects access to requested downloadable resources. | Session; signed access token valid for up to 24 hours | Necessary for the requested service; contract and legitimate interests in security and functionality. |
| __Host-so_lm_visit | SenseOn | Verifies a visit to the requested download page. | Up to 10 minutes | Necessary for the requested service; contract and legitimate interests in security and functionality. |
| __Host-so_download_grant | SenseOn | Permits access to resources after a successful request. | Up to 1 hour | Necessary for the requested service; contract and legitimate interests in security and functionality. |
| __Host-so_demo_offer_context | SenseOn | Reads signed context for the demo offer you requested. | Signed context valid for up to 10 minutes; cookie expiry depends on its issuer | Requested form context; contract and legitimate interests. |
| __Host-so_utm | SenseOn | Stores the first and last campaign touch. With marketing consent it also stores Google, Meta and LinkedIn click identifiers. | Session without analytics consent. With analytics consent, up to 30 days from the last campaign touch, external referral, or the first page visit or consent refresh that records a grant of analytics consent. A later visit that only brings the cookie in line with consent does not extend that time. A cookie saved before this expiry was recorded is set for 30 days on the first page visit or consent refresh that rewrites it while analytics consent is on. | Consent for persistent attribution; legitimate interests in session form context. |
| __Host-so_utm_summary | SenseOn | Stores a non-sensitive attribution summary for form context. | Session | Legitimate interests in session form context. |
| __Host-so_ft / __Host-so_lt | SenseOn | Stores first-touch and last-touch attribution. | Session; up to 30 days with analytics consent | Consent for persistent attribution; legitimate interests in session form context. |
| so_exp_* and experiment session storage | SenseOn | Keeps a page experiment variation consistent during your visit. | Session | Legitimate interests in consistent website presentation. |
| senseon_sid (session storage) | SenseOn | Keeps a session identifier for form and consent-permitted event reporting. | Browser tab session | Requested forms and privacy choices; consent for analytics reporting. |
| so_siem_estimate_pending (local storage) | SenseOn | Retries a requested estimate submission if the server could not be reached. Does not retain the optional identification choice. | Retried or removed on a later visit; requests older than 24 hours are discarded then | Requested service; contract and legitimate interests in reliable delivery. |
Optional linking of your visits
The optional tick on a form or sign-in lets us link this browser's PostHog identifier to a keyed hash of your email. The site sets the PostHog cookie to expire after 90 days. We do not send your email, name or company to PostHog. This linking requires your consent.
You can withdraw through Cookie Settings.
Managing your choices
You can accept, reject or change optional cookie categories at any time. Use the control below or the Cookie Settings link in the footer.
You can also block or delete cookies through your browser. Blocking necessary cookies may stop forms, sign-in or requested downloads from working.
Changes and contact
We may update this policy when our technology, providers or legal obligations change. Questions should be sent to privacy@senseon.io.
Notice version: 2026-10-02
Last updated: 14 October 2026