01What we set
| Name | Type | Purpose | Duration | Needs consent? |
|---|---|---|---|---|
stockisto_consent | Cookie | Remembers your accept/reject choice below, so we don't ask on every page. | 365 days | No (strictly necessary) |
__cf_bm, cf_clearance (Cloudflare Turnstile) | Third-party cookie (Cloudflare) | Written by Cloudflare only when you meet the human check on a form (sign-up, contact, newsletter). It records that this browser passed the check, so the same form does not ask again. It carries no name, email or message, and no form without the check writes it. | 30 minutes (__cf_bm); up to 30 days (cf_clearance), both set by Cloudflare | No (strictly necessary) |
stockisto_utm | Cookie | Remembers the campaign labels (utm_source, utm_medium, etc.) from the link you first arrived on. This shows us which campaigns bring visitors here. It stores no personal data, only the labels your own inbound link already carried. | 30 days | Yes (analytics & attribution) |
stockisto_ref | Cookie + localStorage | If you arrived via a referral link (?ref=CODE), remembers the code. This lets us credit a resulting signup to the referring company. | 30 days (cookie); until cleared (localStorage) | Yes (analytics & attribution) |
stockisto_mktg_session | sessionStorage | Once you accept, a random id that groups the events sent from one browser tab, so we can tell one visit from two. It is not tied to your identity. The page count described in section 2 never uses it. | Until the tab closes | Yes (analytics & attribution) |
stockisto_research_id | localStorage | Where research is configured and you accept, links research events and masked replay in this browser. Withdrawal removes it. | Until withdrawal or browser storage is cleared | Yes |
02Strictly necessary: no consent needed
03Analytics & attribution: one category, gated on your choice
Where product research is enabled, PostHog EU receives route templates and fixed action labels through Stockisto's proxy. Without acceptance, each event has a new random identifier and cannot link visits. The proxy removes IP and forwarding headers. No browser storage does not, by itself, make collection exempt from privacy law; the legal assessment of this unlinked collection remains open.
Acceptance permits a browser research identifier and masked session replay. Form values, page text and request bodies are excluded. Marketing and the portals share a consent preference; Find has a separate choice for each market. The Locator has no research tracking or choice switch. GA4 and GTM are dormant in this research setup.
Configured company inference can use locally downloaded IPinfo network-owner data or an evidenced business email domain. A network owner or domain is not proof of a visitor's employer or identity. We assess this limited business inference under legitimate interest; you may object. IP address data is powered by IPinfo. Security IP logs are separate from product research.
You can withdraw acceptance in Cookie choices and request access, export or erasure at privacy@stockisto.com. Withdrawal stops consented browser capture and removes its local research identifier; it does not undo earlier processing. Stockisto's raw discovery events have an enforced 30-day retention limit, are included in tenant export and erased with personal data; de-identified aggregates survive. That limit is not a PostHog retention guarantee. PostHog provider retention, export and erasure need separate verification before collection relying on them is activated. Primary hosting is Azure Sweden Central; PostHog uses EU endpoints. Any third-country access requires the applicable transfer safeguards in the DPA, including SCCs. We do not promise that all processing stays in the EU.