1. What This Policy Covers
This Cookie Policy explains what www.elnora.ai, our marketing website, stores on your device and why. It sits alongside our Privacy Policy, which governs everything else we do with personal information.
Elnora AI, Inc. ("Elnora AI", "we", "us") is the controller of the information described in this Cookie Policy. For visitors in the European Economic Area and the United Kingdom, Elnora AI OÜ is the controller, including for the consent you give on the banner described in section 3. Elnora AI OÜ is also the controller for the personal data described in Section 8 of our Privacy Policy.
2. The Platform Sets Only Sign-In Cookies
platform.elnora.ai uses no analytics, advertising or tracking technologies. It sets no tracking cookies, no pixels and no web beacons, it does not fingerprint your device or track you across sites, and it is connected to no advertising platform.
It sets two cookies, both strictly necessary to sign you in:
| Name | Purpose | Duration |
|---|---|---|
sso_flow | Protects the single sign-on exchange between your identity provider and our servers | 10 minutes, restricted to the sign-in callback path |
providerSignin | Records which identity provider you signed in with, so the sign-in page can complete. Read once by the page, then deleted | Session |
Because both exist only to deliver the sign-in you asked for, neither requires your consent.
The application also keeps your session token, your workspace preferences and a local cache of files you open in your browser's own storage, so that the product works. None of it is used for tracking, profiling or advertising, and none of it leaves your browser for an advertising or analytics provider.
Product analytics for the platform are collected server-side from your authenticated use of the Services. They are not based on cookies, pixels, device fingerprinting, or cross-site tracking, and are never used for advertising.
Nothing you do inside the platform — your protocols, your research data, your account activity — is shared with any analytics or advertising provider, or used to target advertising at you anywhere.
3. Who We Ask, and Who We Do Not
You control the non-essential cookies this website sets. Where the law requires us to ask first, a banner asks; everywhere else measurement runs until you turn it off. Either way, Cookie choices at the bottom of every page changes your answer at any time.
If we determine your location to be in the European Economic Area, the United Kingdom, Switzerland or Quebec, a banner asks you before anything non-essential is set. Until you answer, nothing non-essential is written to your device, and neither the Google tag nor any advertising tag is loaded. The cookieless count described in section 6 is the only thing that runs, and it stores nothing on your device and reads nothing from it.
The banner offers Accept all, Reject all and Manage cookies, with accept and reject shown at the same size, in the same colour and in the same weight. Nothing is ticked in advance. Manage cookies opens the two purposes separately, so you can take one and refuse the other: Analytics, which counts how the site is used, and Advertising, which records which of our advertising brought you here and, where we have enabled it, lets us show our own ads to people who have already visited this website. Necessary cookies are shown as always on, because the site needs them to work and to remember what you chose. You can change any of it later, as easily as you gave it, under Cookie choices at the bottom of every page.
Everywhere else, including the United States and the rest of Canada, we begin measuring when you arrive, and we rely on this notice and on your ability to turn it off rather than on asking you first. Cookie choices in the footer turns it off on any visit, and turning it off deletes what is already stored, as section 8 describes.
We determine location from your IP address at the moment of your request, and we do not store it for that purpose. Where we cannot determine it, we treat you as though consent were required and ask you first. We rely on our legitimate interests in applying the correct privacy rules to your visit.
Your answer is stored for 180 days, and then the banner asks again. A refusal is never re-asked within that period, and the banner stays away while it stands.
Visitors in those places are still counted, by cookieless aggregate measurement described in section 6.
4. Cookies We Set
A cookie is a small text file a website asks your browser to store, which the browser sends back on later visits. Related technologies do the same job by other means: a pixel, also called a web beacon, is a small image or piece of code whose loading tells its provider that a page was opened, and local storage keeps data in the browser without sending it automatically. For the purpose of this policy, all of them are included in the term "cookies". We use cookies, and we use a pixel where the tables below name one. We use no local storage on this website.
Strictly necessary cookies keep the site working, remember the choice you made, and record a preference you asked for by loading a link that sets it. Analytics cookies count visits and order the pages within one visit. Advertising cookies record which campaign brought you here, so we can tell which of our marketing works, and, where we have enabled it, let us show our own ads to people who have already visited this website.
These are the cookies www.elnora.ai can set. eln_c is written when you answer, and it is the record of that answer. The analytics and advertising cookies are set once you have accepted them, or, where section 3 allows measurement without asking first, from your first page until you turn them off.
| Name | Type | Set by | Purpose | Duration |
|---|---|---|---|---|
eln_c | Strictly necessary (first party) | Elnora AI | Records the cookie choice you made, so we can honour it on every page and the banner stops asking. It holds your two answers and the date you gave them, and no identifier of any kind | 180 days |
eln_staff | Set at your request (first party) | Elnora AI | Marks a visit as ours, so Elnora's own testing is left out of the reports. Written only when one of our team opens a page with ?eln_staff=1 | 365 days |
eln_j | Analytics (first party) | Elnora AI | Orders the pages of a single visit, so the path someone took through the site can be read back | 30 minutes from your last activity on the site |
_ga | Analytics (first party) | Google Analytics | Distinguishes one visitor from another for aggregate traffic reporting. Its value is sent to Google LLC | 2 years |
_ga_Z0PSSP75YB | Analytics (first party) | Google Analytics | Maintains session state for the same aggregate reporting. Its value is sent to Google LLC | 2 years |
eln_attr | Advertising (first party) | Elnora AI | Records the campaign parameters and the advertising click identifier present in the link you arrived by, gclid and the equivalent identifiers from other advertising platforms, so we can tell which of our marketing brings people to the site. The first link you arrive by is the one it keeps | 90 days |
_gcl_aw | Advertising (first party) | Google Ads | Written by the Google tag when you arrive from one of our advertisements, so that a later enquiry can be counted back to the advertisement. Set only for a visitor who arrived on an advertising link, and only where advertising is on for them, either because they accepted it or because section 3 allows measurement where they are without asking first | 90 days |
_fbp | Advertising (first party) | Meta | Written by the Meta pixel to tell one browser from another, so that an enquiry can be counted back to the advertisement that produced it and, where we have enabled it, so we can show our own ads to people who have already visited this website. Set only where section 5 records the Meta pixel as enabled, and only where advertising is on for you | 90 days |
_fbc | Advertising (first party) | Meta | Written by the Meta pixel when you arrive from one of our advertisements, and holds the click identifier that advertisement carried. Set on the same conditions as _fbp, and only if you arrived on an advertising link | 90 days |
NID | Third party (google.com) | Google LLC | Set by Google when the booking calendar on our demo booking page is loaded. Google uses it for its own preferences and advertising purposes across Google services. Where we ask before measuring, the calendar is not loaded until you accept advertising or press the button that asks for it. We cannot read this cookie and we cannot delete it | About 6 months |
Personalised advertising is switched off in our Google tag, for every visitor in every country, including those who accept everything, so what that tag sends builds no advertising audience and is not used to show you our advertising anywhere else. The booking calendar is separate, and section 5 says what Google does with it. The Meta pixel is listed above because this page lists an advertising cookie before it is set, and section 5 states whether it is running today.
5. Providers We Use
| Provider | Role | What it receives | Their terms |
|---|---|---|---|
| Google Analytics (Google LLC) | Aggregate website traffic reporting. Acts as our processor under the Google Ads Data Processing Terms | Pages viewed and their titles; how long a page was open in front of you and how far down it was read; the order of the pages within one visit; which call-to-action you pressed and its label, and the field you were last in if you left a form unsent; whether the request came from a person, an AI agent, a search crawler, a link preview or other automation; your device, browser and language; your IP address, from which Google derives an approximate location; the campaign, referring site, landing page and advertising click identifier you arrived by; the role you select on the demo form; and the fact that a form was submitted or a booking begun. Some of these are sent by our own servers rather than by your browser, including a booking we later confirm, which we match back to your visit as described in our Privacy Policy | Google Privacy Policy |
| Google Ads (Google LLC) | Measuring which of our ads led to an enquiry | Conversion events imported from Google Analytics. Personalised advertising is switched off on this link, so the data builds no advertising audience and is not used to show you ads elsewhere | Google Privacy Policy |
| Meta (Meta Platforms Ireland Limited for visitors in the European Economic Area, the United Kingdom and Switzerland; Meta Platforms, Inc. elsewhere) | Not currently enabled. When we enable it: measuring which of our ads led to an enquiry, and showing our own ads to people who have already visited this website | The pages you view on this website and the fact that a form was submitted or a booking begun, together with your IP address, browser and device details. We and Meta are joint controllers for the collection and transmission of that data, and Meta is the sole controller of what it does with it afterwards | Meta Privacy Policy |
| Google Calendar (Google LLC) | The booking calendar embedded on our demo booking page, so you can pick a time without leaving the site | Your IP address, browser and device details, and the fact that you opened our booking page. Google sets its own NID cookie on your device when the calendar loads. Google is an independent controller for this, not our processor, and its own privacy policy governs what it does with it. Where we ask before measuring, we do not load the calendar until you ask for it | Google Privacy Policy |
| Vercel Analytics (Vercel Inc.) | Cookieless aggregate traffic counts. Acts as our processor under its Data Processing Agreement | Page requested, referrer, approximate location from your IP address, and a pseudonymous visitor value hashed from the request, which resets every day. For every visitor except one whose browser sends Global Privacy Control or Do Not Track, it also receives which conversion link was pressed and the page it was pressed from, and, for the same visitors, that a form was submitted or a booking begun. A browser sending Global Privacy Control or Do Not Track sends the page count only. No cookie | Vercel Privacy Notice |
We do not send your name, email address, telephone number, employer, or any other contact detail to these providers, in plain or hashed form. What you type into a form on this website reaches us and our email provider, and goes no further.
Google LLC and Vercel Inc. each act as our processor for the analytics and advertising measurement described above, under written terms that stop them using it for their own purposes. Two things sit outside that. The booking calendar is one: there Google acts as an independent controller under its own privacy policy, which is why we do not load it until you ask where consent is required. The Meta pixel is the other: where we enable it, we and Meta are joint controllers for the collection and transmission of the data it sends, and Meta decides on its own account what it does with that data afterwards.
The providers listed here are distinct from the subprocessors that handle Enterprise Customer Data on the platform. Those are listed in our Trust Center and in DPA Schedule 3. No provider on this page has any access to Customer Data.
6. Measurement Without Cookies
We use aggregate website analytics that sets no cookie and writes nothing to your device. Counting visitors without a cookie still needs some way to tell one visitor from another, so our provider derives a pseudonymous value by hashing the incoming request, including your IP address. That value resets every day, is never used to recognise you across other websites, and is not combined with any other data we hold about you.
We rely on our legitimate interests in understanding how much traffic our website receives. You may object at any time by writing to privacy@elnora.ai. Because this measurement holds nothing that could pick you out from anyone else, there is no record of you for us to find and remove; we will tell you plainly what we can and cannot do, and we will not ask you to identify yourself so that we can.
This is how we count visitors who receive no cookies: those who have not answered the banner yet, those who refused it, and those whose browser sends Global Privacy Control or Do Not Track. It keeps running for them because it writes nothing to your device and reads nothing from it, and because what those signals ask us to stop is tracking you and sharing information about you for advertising, and both of those stop. The daily value described above is still information about you, so you may object to it at any time.
This changed on 6 September 2026. The version of this policy dated 1 September 2026 said that a browser sending Global Privacy Control or Do Not Track was counted by nothing at all. From 6 September 2026 the cookieless page count above runs for those visitors too, and section 9 records the change.
7. What We Will Not Do
- We do not sell your personal information, as "sale" is defined by applicable privacy law
- We do not upload customer lists, contact lists, or email addresses, in plain or hashed form, to advertising platforms
- We do not use anything from platform.elnora.ai to target advertising at you, and we do not share it with advertising platforms
- We do not build advertising audiences based on sensitive categories, including health, biometric, or research subject matter
- We do not fingerprint your device to recognise you across websites or over time, and we use no technique designed to work around your browser's privacy settings
8. Your Choices
Change your mind at any time. Cookie choices, at the bottom of every page, reopens the question on any visit, in any country. Turning measurement off there deletes the analytics and advertising cookies already on your device and leaves only the record of your choice. The banner is where the two purposes are offered separately, and refusing one purpose there deletes only the cookies belonging to that purpose.
Opt-out preference signals. We honour the Global Privacy Control (GPC) and Do Not Track (DNT) browser signals. If either is present, no analytics, attribution or advertising cookie is set, anywhere in the world, regardless of your location, and you are not added to any advertising audience. We treat GPC as a valid request to opt out of sale and sharing under applicable United States privacy law.
Browser controls. You can clear or block cookies at any time in your browser settings; every major browser offers this under its privacy settings. The website works normally without them.
Google Analytics opt-out. Google offers a browser add-on that prevents Google Analytics from collecting data on any site.
Ask us. Write to privacy@elnora.ai and we will act on your request.
9. Changes to This Policy
We update this page whenever the cookies we set or the providers we use change. Every previous version stays available at its own dated address.
| Date | What changed |
|---|---|
| 6 September 2026 | A consent banner was introduced for the European Economic Area, the United Kingdom, Switzerland, Quebec and visitors whose location we cannot determine, offering analytics and advertising as separate choices. Sections 3, 4 and 5 now describe the cookies and the measurement in full, including three cookies and several measurement events that the previous version did not list. The cookieless page count in section 6 was extended to visitors sending Global Privacy Control or Do Not Track, having previously been withheld from them. Section 4 now lists the two Meta pixel cookies before they are set, and section 5 records that the pixel is not currently enabled and that Meta would be a joint controller with us if it were |
Material changes to how we handle personal information are also reflected in our Privacy Policy.
10. Contact
Questions about this policy go to privacy@elnora.ai.
The person in charge of the protection of personal information at Elnora AI, including for the purposes of section 3.1 of Quebec's Law 25, is Carmen Kivisild, Chief Executive Officer, reachable at privacy@elnora.ai or at the address below.
United States (Headquarters) Elnora AI, Inc., 48 South Rio Grande Street, Salt Lake City, UT 84101, USA
European Union / United Kingdom Elnora AI OÜ, Harju maakond, Saue vald, Laagri alevik, Vesiroosi tn 6, 76401, Estonia
For our full privacy commitments, including your rights over personal information, see the Privacy Policy.