Cookie Notice — XCreOS

1. What cookies are

Cookies and similar technologies (local storage, pixels) are small files stored on your device that help a site function, remember preferences, and measure usage.

2. Categories we use

Category Purpose Examples Consent
Strictly necessary Sign-in, security, load balancing, saving your consent choice session/auth cookies, CSRF token Always on (no consent needed)
Functional The website chat widget (talk to us / SMS opt-in) LeadConnector chat widget On with the widget; texting requires your explicit opt-in in the widget
Analytics Understand feature usage to improve the product PostHog, Google Analytics 4 Off until you opt in (opt-in regions)
Marketing Measure campaigns and reach (not active at launch) reserved for future ad pixels (e.g. Meta, LinkedIn) Off until you opt in

We do not run advertising/marketing cookies at launch. If we add them, they will be listed here and gated behind consent.

3. Your choices

  • Use our cookie banner to accept or reject by category, and reopen "Cookie settings" anytime from the site footer to change your choice.
  • Control cookies in your browser settings (blocking some may break sign-in or features).
  • Opt out of Google Analytics via Google's browser add-on.

4. Banner behavior (implementation spec — Phase 4)

  1. On first visit, show a banner with Accept all · Reject all · Manage preferences (three categories with toggles).
  2. No analytics or marketing tags fire before consent in opt-in regions; necessary cookies only.
  3. Store the consent choice; do not re-prompt every page load.
  4. Wire consent state to the tag manager (GTM, Phase 7) so PostHog/GA4 fire only after the analytics toggle is on.
  5. Provide a persistent "Cookie settings" footer link to reopen and change consent.
  6. Test the handshake: fresh load → nothing fires → accept → tags fire. (This is the #1 silent analytics breakage.)

5. Changes & contact

We may update this notice; material changes get a new effective date. Questions: [email protected]. See also our Privacy Policy.