1. What This Policy Covers
This Cookie Policy explains what www.elnora.ai, our marketing website, stores on your device and why. It sits alongside our Privacy Policy, which governs everything else we do with personal information.
Elnora AI, Inc. ("Elnora AI", "we", "us") is the controller of the information described in this Cookie Policy. For visitors in the European Economic Area and the United Kingdom, Elnora AI OÜ is the controller, including for the consent you give on the banner described in section 3. Elnora AI OÜ is also the controller for the personal data described in Section 8 of our Privacy Policy.
2. The Platform Sets Only Sign-In Cookies
platform.elnora.ai uses no analytics, advertising or tracking technologies. It sets no tracking cookies, no pixels and no web beacons, it does not fingerprint your device or track you across sites, and it is connected to no advertising platform.
It sets two cookies, both strictly necessary to sign you in:
| Name | Purpose | Duration |
|---|---|---|
sso_flow | Protects the single sign-on exchange between your identity provider and our servers | 10 minutes, restricted to the sign-in callback path |
providerSignin | Records which identity provider you signed in with, so the sign-in page can complete. Read once by the page, then deleted | Session |
Because both exist only to deliver the sign-in you asked for, neither requires your consent.
The application also keeps your session token, your workspace preferences and a local cache of files you open in your browser's own storage, so that the product works. None of it is used for tracking, profiling or advertising, and none of it leaves your browser for an advertising or analytics provider.
Product analytics for the platform are collected server-side from your authenticated use of the Services. They are not based on cookies, pixels, device fingerprinting, or cross-site tracking, and are never used for advertising.
Nothing you do inside the platform — your protocols, your research data, your account activity — is shared with any analytics or advertising provider, or used to target advertising at you anywhere.
3. Who We Ask, and Who We Do Not
You control the non-essential cookies this website sets. Where the law requires us to ask first, a banner asks; everywhere else measurement runs until you turn it off. Either way, Cookie choices at the bottom of every page changes your answer at any time.
If we determine your location to be in the European Economic Area, the United Kingdom, Switzerland or Quebec, a banner asks you before anything non-essential is set. Until you answer, nothing non-essential is written to your device, and neither the Google tag nor any advertising tag is loaded. The cookieless count described in section 6 is the only thing that runs, and it sets no cookie and stores nothing on your device.
The banner offers Accept all, Reject all and Manage cookies, with accept and reject shown at the same size, in the same colour and in the same weight. Nothing is ticked in advance. Manage cookies opens the two purposes separately, so you can take one and refuse the other: Analytics, which counts how the site is used, and Advertising, which records which of our advertising brought you here and, where we have enabled it, lets us show our own ads to people who have already visited this website. Necessary cookies are shown as always on, because the site needs them to work and to remember what you chose. You can change any of it later, as easily as you gave it, under Cookie choices at the bottom of every page.
Everywhere else, including the rest of the United States and the rest of Canada, we begin measuring when you arrive, and we rely on this notice and on your ability to turn it off rather than on asking you first. Cookie choices in the footer turns it off on any visit, and turning it off deletes what is already stored, as section 8 describes.
We determine location from your IP address at the moment of your request, and we do not store it for that purpose. Where we cannot determine it, we treat you as though consent were required and ask you first. We rely on our legitimate interests in applying the correct privacy rules to your visit.
Your answer is stored for 180 days, and then the banner asks again. A refusal is never re-asked within that period, and the banner stays away while it stands.
Visitors in those places are still counted, by cookieless aggregate measurement described in section 6.
4. Cookies We Set
A cookie is a small text file a website asks your browser to store, which the browser sends back on later visits. Related technologies do the same job by other means: a pixel, also called a web beacon, is a small image or piece of code whose loading tells its provider that a page was opened, and local storage keeps data in the browser without sending it automatically. For the purpose of this policy, all of them are included in the term "cookies". We use cookies, and we use a pixel where the tables below name one. Local storage is used only by the LinkedIn and Meta tags, for the entries listed below.
Strictly necessary cookies keep the site working, remember the choice you made, and record a preference you asked for by loading a link that sets it. Analytics cookies count visits and order the pages within one visit. Advertising cookies record which campaign brought you here, so we can tell which of our marketing works, and, where we have enabled it, let us show our own ads to people who have already visited this website.
These are the cookies www.elnora.ai can set. eln_c is written when you answer, and it is the record of that answer. The analytics and advertising cookies are set once you have accepted them, or, where section 3 allows measurement without asking first, from your first page until you turn them off.
| Name | Type | Set by | Purpose | Duration |
|---|---|---|---|---|
eln_c | Strictly necessary (first party) | Elnora AI | Records the cookie choice you made, so we can honour it on every page and the banner stops asking. It holds your two answers and the date you gave them, and no identifier of any kind | 180 days |
eln_staff | Set at your request (first party) | Elnora AI | Marks a visit as ours, so Elnora's own testing is left out of the reports. Written only when one of our team opens a page with ?eln_staff=1 | 365 days |
eln_j | Analytics (first party) | Elnora AI | Orders the pages of a single visit, so the path someone took through the site can be read back | 30 minutes from your last activity on the site |
_ga | Analytics (first party) | Google Analytics | Distinguishes one visitor from another for aggregate traffic reporting. Its value is sent to Google LLC | 2 years |
_ga_Z0PSSP75YB | Analytics (first party) | Google Analytics | Maintains session state for the same aggregate reporting. Its value is sent to Google LLC | 2 years |
eln_attr | Advertising (first party) | Elnora AI | Records the campaign parameters and the advertising click identifier present in the link you arrived by, gclid and the equivalent identifiers from other advertising platforms, so we can tell which of our marketing brings people to the site. The first link you arrive by is the one it keeps | 90 days |
_gcl_aw | Advertising (first party) | Google Ads | Written by the Google tag when you arrive from one of our advertisements, so that a later enquiry can be counted back to the advertisement. Set only for a visitor who arrived on an advertising link, and only where advertising is on for them, either because they accepted it or because section 3 allows measurement where they are without asking first | 90 days |
li_fat_id | Advertising (first party) | Written by the LinkedIn Insight Tag when you arrive from one of our LinkedIn advertisements, and holds the click identifier that advertisement carried, so that a later enquiry can be counted back to it. Set only if you arrived on an advertising link, and only where advertising is on for you | 30 days | |
li_adsId | Advertising (local storage) | Written by the LinkedIn Insight Tag to tell one browser from another, so that an enquiry can be counted back to the advertisement that produced it and so we can show our own ads to people who have already visited this website. Set only where advertising is on for you | Until you turn advertising off or clear your browser storage | |
_fbp | Advertising (first party) | Meta | Written by the Meta pixel to tell one browser from another, so that an enquiry can be counted back to the advertisement that produced it and so we can show our own ads to people who have already visited this website. Set only where advertising is on for you | 90 days |
_fbc | Advertising (first party) | Meta | Written by the Meta pixel when you arrive from one of our advertisements, and holds the click identifier that advertisement carried. Set on the same conditions as _fbp, and only if you arrived on an advertising link | 90 days |
lastExternalReferrer, lastExternalReferrerTime, multiFbc | Advertising (local storage) | Meta | Written by the Meta pixel to record the site that referred you, when, and the advertising click identifiers you arrived with, for the same measurement as _fbp and _fbc. Set only where advertising is on for you | Until you turn advertising off or clear your browser storage |
NID | Third party (google.com) | Google LLC | Set by Google when the booking calendar on our demo booking page is loaded. Google uses it for its own preferences and advertising purposes across Google services. Where we ask before measuring, the calendar is not loaded until you accept advertising or press the button that asks for it. We cannot read this cookie and we cannot delete it | About 6 months |
Personalised advertising is switched off in our Google tag, for every visitor in every country, including those who accept everything, so what that tag sends builds no advertising audience and is not used to show you our advertising anywhere else. The booking calendar is separate, and section 5 says what Google does with it.
The LinkedIn Insight Tag and the Meta pixel are different: where advertising is on for you, they let us show our own ads on LinkedIn, Facebook and Instagram to people who have already visited this website. When either tag loads, LinkedIn or Meta may also read or set cookies on its own domain under its own cookie policy. We cannot read or delete those. The platforms describe them as follows, in LinkedIn's Cookie Table under "Cookies LinkedIn drops on third party sites" and in Meta's Cookies Policy, both checked on 30 October 2026:
| Name | Set by | Purpose, as the platform describes it | Duration |
|---|---|---|---|
bcookie | LinkedIn (linkedin.com) | Identifies the browser, to detect abuse and for diagnostics | 1 year |
lidc | LinkedIn (linkedin.com) | Selects the data centre that answers | 24 hours |
li_gc, li_mc | LinkedIn (linkedin.com) | Store and cache the cookie consent you gave LinkedIn | 6 months |
UserMatchHistory, AnalyticsSyncHistory | LinkedIn (linkedin.com) | Record when LinkedIn last synced its advertising and analytics identifiers | 30 days |
lms_ads, lms_analytics | LinkedIn (linkedin.com) | Identify LinkedIn members off LinkedIn, for advertising and for analytics | 30 days |
li_sugr | LinkedIn (linkedin.com) | Makes a probabilistic match of a visitor's identity | 90 days |
_guid | LinkedIn (linkedin.com) | Identifies a LinkedIn member for advertising through Google Ads | 90 days |
bscookie, JSESSIONID, lang, sdsc | LinkedIn (linkedin.com) | Two-factor sign-in, request-forgery protection, language and database routing for LinkedIn's own service | 1 year for bscookie, session for the others |
BizographicsOptOut | LinkedIn (linkedin.com) | Records the opt-out of a visitor who is not a LinkedIn member | 10 years |
UID | Scorecard Research (scorecardresearch.com), listed by LinkedIn | Market and user research | 720 days |
fr | Meta (facebook.com) | Delivers, measures and improves the relevance of ads | 90 days |
oo | Meta (facebook.com) | Records an opt-out of ads from Meta based on activity on other websites | 400 days |
datr, sb | Meta (facebook.com) | Identify the browser securely, for site security and integrity | Not stated by Meta |
c_user, xs | Meta (facebook.com) | Keep you signed in to Facebook, if you are | 365 days |
5. Providers We Use
| Provider | Role | What it receives | Their terms |
|---|---|---|---|
| Google Analytics (Google LLC) | Aggregate website traffic reporting. Acts as our processor under the Google Ads Data Processing Terms | Pages viewed and their titles; how long a page was open in front of you and how far down it was read; the order of the pages within one visit; which call-to-action you pressed and its label, and the field you were last in if you left a form unsent; whether the request came from a person, an AI agent, a search crawler, a link preview or other automation; your device, browser and language; your IP address, from which Google derives an approximate location; the campaign, referring site, landing page and advertising click identifier you arrived by; the role you select on the demo form; and the fact that a form was submitted or a booking begun. Some of these are sent by our own servers rather than by your browser, including a booking we later confirm, which we match back to your visit as described in our Privacy Policy | Google Privacy Policy |
| Google Ads (Google LLC) | Measuring which of our ads led to an enquiry. Google is an independent controller for this, under the Google Ads Controller-Controller Data Protection Terms | Conversion events imported from Google Analytics. Personalised advertising is switched off on this link, so the data builds no advertising audience and is not used to show you ads elsewhere | Google Privacy Policy |
| LinkedIn (LinkedIn Ireland Unlimited Company for visitors in the European Economic Area, the United Kingdom and Switzerland; LinkedIn Corporation elsewhere) | Measuring which of our ads led to an enquiry, and showing our own ads on LinkedIn to people who have already visited this website | The pages you view on this website and how long each was open, the fact that a form was accepted or that you reached our demo booking step, and the advertising click identifier you arrived with, together with your IP address, browser and device details. We and LinkedIn are joint controllers for the collection and transmission of that data, and LinkedIn is the sole controller of what it does with it afterwards | LinkedIn Privacy Policy |
| Meta (Meta Platforms Ireland Limited for visitors in the European Economic Area and Switzerland; Meta Platforms, Inc. for visitors in the United Kingdom and elsewhere) | Measuring which of our ads led to an enquiry, and showing our own ads on Facebook and Instagram to people who have already visited this website | The pages you view on this website, the fact that a form was accepted or that you reached our demo booking step, and the advertising click identifier you arrived with, together with your IP address, browser and device details. Meta's automatic event collection and automatic advanced matching are switched off. We and Meta are joint controllers for the collection and transmission of that data, and Meta is the sole controller of what it does with it afterwards | Meta Privacy Policy |
| Not currently enabled. When we enable it: measuring which of our ads led to an enquiry, and showing our own ads on Reddit to people who have already visited this website. We will list the Reddit company responsible, the cookies it sets and what it receives here before we do | Nothing today | ||
| Google Calendar (Google LLC) | The booking calendar embedded on our demo booking page, so you can pick a time without leaving the site | Your IP address, browser and device details, and the fact that you opened our booking page. Google sets its own NID cookie on your device when the calendar loads. Google is an independent controller for this, not our processor, and its own privacy policy governs what it does with it. Where we ask before measuring, we do not load the calendar until you ask for it | Google Privacy Policy |
| Vercel Analytics (Vercel Inc.) | Cookieless aggregate traffic counts. Acts as our processor under its Data Processing Agreement | Page requested, referrer, approximate location from your IP address, and a pseudonymous visitor value hashed from the request, which resets every day. For every visitor except one whose browser sends Global Privacy Control or Do Not Track, it also receives which conversion link was pressed and the page it was pressed from, and, for the same visitors, that a form was submitted or a booking begun. A browser sending Global Privacy Control or Do Not Track sends the page count only. No cookie | Vercel Privacy Notice |
We do not send your name, email address, telephone number, employer, or any other contact detail to these providers, in plain or hashed form. What you type into a form on this website reaches us and our email provider, and goes no further.
Google acts as our processor for Google Analytics, under the Google Ads Data Processing Terms, and Vercel acts as our processor for cookieless traffic counts, each under written terms that stop them using it for their own purposes. For Google Ads conversion measurement, Google is an independent controller under the Google Ads Controller-Controller Data Protection Terms. The booking calendar sits outside both: there Google acts as an independent controller under its own privacy policy, which is why we do not load it until you ask where consent is required.
Joint controllers for our advertising tags
When the LinkedIn Insight Tag or the Meta pixel runs on our website, we and the platform are joint controllers under Article 26 of the GDPR for collecting the information the tag reads on our website and sending it to the platform. Neither of us is a joint controller for what the platform does with it afterwards; the platform alone decides that, under its own privacy policy. The essence of each arrangement is:
- We are responsible for asking your consent before the tag loads where the law requires it, for giving you this information, for setting the tag up correctly and securely, and for your rights in respect of the collection and transmission.
- For Meta, the arrangement is its Controller Addendum: Meta is responsible for your rights to access, correct, delete, restrict, receive a copy of and object to the data it stores once it has received it. For LinkedIn, the allocation in this section is the arrangement between us, alongside LinkedIn's Ads Agreement and its privacy policy: LinkedIn is responsible for what it does with the data once it has received it, including your rights over the data it stores.
- You can exercise your rights against us or against the platform. If you write to us about data the platform holds, we forward your request within three working days.
- How Meta and LinkedIn process the data, their legal basis and how to contact them are in their privacy policies, linked in the table above.
People who accept advertising, or who do not turn it off where we do not ask first, may be added by LinkedIn or Meta to a list of our website visitors for up to 180 days after their last visit. We see only the size of each list.
The providers listed here are distinct from the subprocessors that handle Enterprise Customer Data on the platform. Those are listed in our Trust Center and in DPA Schedule 3. No provider on this page has any access to Customer Data.
6. Measurement Without Cookies
We use aggregate website analytics that sets no cookie and writes nothing to your device. Counting visitors without a cookie still needs some way to tell one visitor from another, so our provider derives a pseudonymous value by hashing the incoming request, including your IP address. That value resets every day, is never used to recognise you across other websites, and is not combined with any other data we hold about you.
We rely on our legitimate interests in understanding how much traffic our website receives. You may object at any time by writing to privacy@elnora.ai. Because this measurement holds nothing that could pick you out from anyone else, there is no record of you for us to find and remove; we will tell you plainly what we can and cannot do, and we will not ask you to identify yourself so that we can.
This is how we count visitors who receive no cookies: those who have not answered the banner yet, those who refused it, and those whose browser sends Global Privacy Control or Do Not Track. It keeps running for them because it sets no cookie and writes nothing to your device, and because what those signals ask us to stop is tracking you and sharing information about you for advertising, and both of those stop. The daily value described above is still information about you, so you may object to it at any time.
This changed on 6 September 2026. The version of this policy dated 1 September 2026 said that a browser sending Global Privacy Control or Do Not Track was counted by nothing at all. From 6 September 2026 the cookieless page count above runs for those visitors too, and section 9 records the change.
7. What We Will Not Do
- We do not sell your personal information, as "sale" is defined by applicable privacy law
- We do not upload customer lists, contact lists, or email addresses, in plain or hashed form, to advertising platforms
- We do not use anything from platform.elnora.ai to target advertising at you, and we do not share it with advertising platforms
- We do not build advertising audiences based on sensitive categories, including health, biometric, or research subject matter
- We do not fingerprint your device to recognise you across websites or over time, and we use no technique designed to work around your browser's privacy settings
8. Your Choices
Change your mind at any time. Cookie choices, at the bottom of every page, reopens the question on any visit, in any country. Turning measurement off there deletes the analytics and advertising cookies and local storage entries already on your device and leaves only the record of your choice. Cookies LinkedIn or Meta keep on their own domains are not ours to delete; your settings with them control those. The banner is where the two purposes are offered separately, and refusing one purpose there deletes only the cookies belonging to that purpose.
Opt-out preference signals. We honour the Global Privacy Control (GPC) and Do Not Track (DNT) browser signals. If either is present, no analytics, attribution or advertising cookie is set, anywhere in the world, regardless of your location, and you are not added to any advertising audience. We treat GPC as a valid request to opt out of sale and sharing under applicable United States privacy law.
Browser controls. You can clear or block cookies at any time in your browser settings; every major browser offers this under its privacy settings. The website works normally without them.
Google Analytics opt-out. Google offers a browser add-on that prevents Google Analytics from collecting data on any site.
Ask us. Write to privacy@elnora.ai and we will act on your request.
9. Changes to This Policy
We update this page whenever the cookies we set or the providers we use change. Every previous version stays available at its own dated address.
| Date | What changed |
|---|---|
| 31 October 2026 | Section 4 lists the cookies LinkedIn and Meta set on their own domains. Section 5 sets out the joint-controller arrangement for their tags and how long their visitor lists last, records that Google is an independent controller for Google Ads, and names Meta Platforms, Inc. for visitors in the United Kingdom. |
| 30 October 2026 | The LinkedIn Insight Tag and the Meta pixel are now enabled for advertising measurement and for showing our own ads to people who visited this website; sections 4 and 5 list their cookies, local storage and what each receives, and record Reddit as not yet enabled. |
| 6 September 2026 | A consent banner was introduced for the European Economic Area, the United Kingdom, Switzerland, Quebec and visitors whose location we cannot determine, offering analytics and advertising as separate choices. Sections 3, 4 and 5 now describe the cookies and the measurement in full, including three cookies and several measurement events that the previous version did not list. The cookieless page count in section 6 was extended to visitors sending Global Privacy Control or Do Not Track, having previously been withheld from them. Section 4 now lists the two Meta pixel cookies before they are set, and section 5 records that the pixel is not currently enabled and that Meta would be a joint controller with us if it were |
Material changes to how we handle personal information are also reflected in our Privacy Policy.
10. Contact
Questions about this policy go to privacy@elnora.ai.
The person in charge of the protection of personal information at Elnora AI, including for the purposes of section 3.1 of Quebec's Law 25, is Carmen Kivisild, Chief Executive Officer, reachable at privacy@elnora.ai or at the address below.
United States (Headquarters) Elnora AI, Inc., 48 South Rio Grande Street, Salt Lake City, UT 84101, USA
European Union / United Kingdom Elnora AI OÜ, Harju maakond, Saue vald, Laagri alevik, Vesiroosi tn 6, 76401, Estonia
For our full privacy commitments, including your rights over personal information, see the Privacy Policy.