Cookie Policy

1. About this policy

This Cookie Policy explains how Senitix Teknoloji LTD. ŞTİ. (“Senitix,” “we,” “us” or “our”) uses cookies and similar technologies, and the choices you have about them. Senitix is a limited company organized under the laws of the Republic of Türkiye, with its registered office at Cevizli Mah. Zuhal Cad. A Blok No:46 İç Kapı No:50, Maltepe, İstanbul, Türkiye.

This policy covers:

• Our website at www.senitix.com, including senitix.com.
• The Senitix application: your Senitix account at app.senitix.com, Senitix CRM at crm.senitix.com, and the services those pages connect to, such as api.senitix.com.
• Our status page at status.senitix.com, which sets no cookies of its own, may receive the same Cloudflare security cookies described in section 4.2, and uses the error monitoring described in section 5.3. Unlike our website, the status page loads its typeface from Google Fonts, so opening it sends your IP address and browser details to Google.

As of the effective date below, senitix.com redirects to www.senitix.com, our canonical address. If you reach a page before that redirect takes effect, you may be looking at an earlier version of our site that used different technology; that earlier site’s own notice, not this one, describes what it used.

It supplements our Privacy Policy, which explains how we collect, use and disclose personal information and the rights you may have under U.S. state privacy laws. If your organization uses Senitix, our Terms of Service and Data Processing Addendum also apply. This policy does not cover other companies’ websites that we link to, or websites that our customers run themselves.

2. The short version

• We ask before we set analytics or marketing cookies. The first time you visit, a banner lets you choose “Accept all,” “Reject all” or open “Cookie settings.” Until you accept, we set no analytics cookie, wherever you are. Unless you visit our English site from the United States, we set no marketing cookie and load no Meta or LinkedIn script until you accept either.
• One thing loads before you choose: Google’s tag, without cookies. Unless your browser sends a Global Privacy Control signal, Google’s tag (Google Analytics and, except on our legal documents before you choose, the Google Ads tag) loads on every page for every visitor, with all of Google’s consent signals set to denied. In that state it sets and reads no cookie and sends no cookie identifier; it sends Google only cookieless pings, which Google uses to count and model visits and conversions in aggregate, as section 4.5 describes.
• If you accept, Google Analytics also uses its cookies to understand site usage. It measures things like the pages people view and the events section 4.5 describes; it does not use the data for advertising, and Google Signals and ads personalization are off.
• While Marketing is on, we use the Meta Pixel, the Google Ads tag and the LinkedIn Insight Tag to measure our ads, and the LinkedIn Insight Tag also to show our ads on LinkedIn to people who visited our website. They tell Meta, Google and LinkedIn which of our ads led to a visit, a request or a free-trial sign-up, as section 4.6 describes. We send LinkedIn no name, email address or anything you type into a form, and Meta none of these in clear: with Marketing on, our server sends Meta only one-way hashes of the email address you verified at sign-up and, once your account is created, of your phone number and name. Google may receive your sign-up email address only in an irreversibly hashed form, never the address itself. Meta, Google and LinkedIn also use what they receive for their own purposes, under their own policies; Google’s ads personalization signal always stays denied, so we do not remarket to you through Google. On LinkedIn, we may show our ads to LinkedIn members who visited our website, as section 4.6 describes. For most visitors it is off unless you turn it on. If you visit our English site from the United States, it is on from your first page view until you turn it off, unless your browser sends a Global Privacy Control signal.
• A live chat loads with every page. Our live chat, provided by Crisp, loads on every page of our website without waiting for a cookie choice, so you can write to us. It stores a chat session identifier in your browser, and Crisp receives your IP address, browser details and the page you are on; if you write, it carries your messages to our team (section 4.7). It is not one of the consent categories and cannot be turned off in “Cookie settings.”
• Our security provider may set a security cookie. Cloudflare may set a strictly necessary cookie that helps block automated attacks, on senitix.com and in the application. It is not set on www.senitix.com, which is delivered by Amazon CloudFront.
• Videos load only when you press play. At that point, the video provider (YouTube or Vimeo) may set its own cookies.
• The application uses only what it needs. Its cookies and browser storage keep you signed in, protect your account, keep the service working and remember your language, settings and unsaved work.
• You are in control. Change your choice any time with the “Your Privacy Choices” link in the footer of every page, or in your browser; we honor the Global Privacy Control signal as a request to keep analytics and marketing off. Apart from the Meta Pixel, the Google Ads tag and the LinkedIn Insight Tag, which some U.S. state laws may treat as a “sale” or “sharing” of personal information, or as targeted advertising (section 4.6), we do not sell or share personal information, and we do not use it for targeted advertising.

3. Cookies and similar technologies

A cookie is a small text file that a website stores in your browser so it can recognize that browser on later requests. A first-party cookie is set for the domain you are visiting; a third-party cookie is set for a different domain, such as the domain of a video player embedded in the page. A session cookie is deleted when you close your browser; a persistent cookie remains until it expires or you delete it.

Similar technologies work in comparable ways. Local storage keeps small pieces of information in your browser until they are removed, and session storage keeps them only until you close the browser tab. A pixel (also called a web beacon) is a tiny image that reports when a page or an email is opened. The Meta Pixel, the Google Ads tag and the LinkedIn Insight Tag described in section 4.6 are scripts that work in a similar way: they report page views and a few events to Meta, Google and LinkedIn.

We call a cookie or similar technology strictly necessary when the website or the application cannot provide what you asked for without it: for example, keeping you signed in, protecting you from forged requests, blocking automated attacks or remembering the cookie choice you made. We call one analytics when it only helps us understand, in aggregate, how visitors use our website, and marketing when it helps us measure our advertising, such as which of our ads led to a visit. Neither is strictly necessary, so our website sets analytics cookies only after you accept them, and marketing cookies only after you accept them too, except for U.S. visitors to our English site, for whom Marketing is on until they turn it off (sections 4.1, 4.5 and 4.6). The cookieless Google measurement described in section 4.5 sets no cookie and does not depend on that choice. The application does not use cookies or similar technologies for advertising, social media or tracking you across other websites. Neither does our website, except for the Meta Pixel, the Google Ads tag and the LinkedIn Insight Tag in the Marketing category (section 4.6). Our live chat is outside these categories: it loads with every page of our website, whatever you choose, so that you can reach us (section 4.7).

4. Our website

4.1 What loads before you choose, and what needs your consent

When you first visit www.senitix.com, before you make a cookie choice in the banner described in section 7, the website sets no analytics or social media cookie, and no advertising cookie other than those of the Meta Pixel, the Google Ads tag and the LinkedIn Insight Tag for U.S. visitors to our English site (section 4.6). It does load our live chat, provided by Crisp, which stores a chat session identifier in two cookies and in your browser’s local storage as soon as it loads (section 4.7). Apart from those, and the sign-in summary described below when you are already signed in to the application, the website writes nothing else to your browser’s local or session storage. It loads no tag manager, social media plug-in, or heat-mapping or session-recording tool, whether or not you consent. Unless your browser sends a Global Privacy Control signal, it does load Google’s tag in cookieless mode, which sets no cookie and sends Google only the pings described in section 4.5. It loads no advertising tag other than that Google tag, the Meta Pixel and the LinkedIn Insight Tag, and the Meta Pixel and the LinkedIn Insight Tag load only while Marketing is on (section 4.6). Fonts, images and scripts are served from our own infrastructure, except for the live chat, which loads its own script, styles, fonts and sounds from Crisp. The website’s security settings allow a script to run in the page only from a source we have listed, which includes Crisp for the live chat, Google’s tag (section 4.5) and, while Marketing is on, the Meta Pixel and the LinkedIn Insight Tag (section 4.6). As a result, loading a page sends information about your visit to the providers that host and deliver the website for us, Amazon Web Services and its content delivery network Amazon CloudFront; to Crisp, our live chat provider, on every page; to Google as well, in cookieless mode, unless your browser sends a Global Privacy Control signal (section 4.5); and to Meta and LinkedIn, only while Marketing is on.

Forms on the website, such as the contact form, send us the information you type when you submit them. They set no cookie of their own. If you have accepted analytics, submitting the contact, sales or sign-up form, or clicking through to the sign-up page, is also recorded as an analytics event, as section 4.5 describes. Starting a free-trial sign-up is also reported to Google, as a cookieless ping if you have not accepted, as section 4.5 describes. While Marketing is on, a contact or sales request sent successfully, or a free-trial sign-up you start, is also reported to Meta as an event, without anything you typed, and a successful free-trial sign-up is reported to LinkedIn as a conversion, as section 4.6 describes. Our Privacy Policy explains how we use what you send.

If you are already signed in to the Senitix application. When the application signs you in, it also sets the sx_auth cookie listed in section 5.1, which holds no personal data. Only when our website finds that cookie does it ask the application who is signed in, so that the site’s header can show your name and organization and link to the application instead of offering sign-up and login. The answer is kept in your browser’s session storage as sx-account for up to five minutes, and is removed when you close the tab or sign out. Without that cookie, the website makes no such request.

4.2 Security cookies from Cloudflare

We use Cloudflare, Inc. for the DNS of our domains, and to protect senitix.com and the Senitix application against attacks and automated abuse. Where Cloudflare’s protection is active, it may set a strictly necessary cookie that helps it tell people apart from bots and, if your browser is asked to complete a security check, a second cookie that records that you passed it. We use these cookies only for security. Cloudflare describes them in its cookie documentation.

Our website itself, www.senitix.com, does not pass through Cloudflare’s protection: it is delivered by Amazon CloudFront, an Amazon Web Services network that serves the pages from the edge location nearest you and receives your IP address and the details of each request. So the two Cloudflare cookies listed in section 4.8 are set only on senitix.com, which does nothing but redirect you to www.senitix.com, and not on the pages you go on to read.

4.3 Embedded videos

Some pages may include a video. The video player is not loaded with the page: you see a play button, and nothing is requested from the video provider until you press it. When you press play, your browser loads the player from Wistia, from YouTube’s privacy-enhanced domain (youtube-nocookie.com), operated by Google, or from Vimeo, depending on where the video is hosted.

From that moment, the provider receives the information your browser sends with any request, such as your IP address, information about your browser and the site you are viewing, and it may set its own cookies or use similar technologies. The provider controls those technologies under its own privacy policy; see Wistia’s privacy policy, Google’s Privacy Policy and Vimeo’s privacy information. Closing the video removes the player from the page, but cookies the provider has already set remain until they expire or you delete them.

4.4 Cookies for website editors

People who sign in to edit the website for Senitix receive the standard cookies of WordPress, the software the website runs on. These cookies are set only when an editor signs in. Visitors cannot create an account on the website and never receive them.

4.5 Google Analytics and Google’s cookieless measurement

We use Google Analytics 4 (measurement ID G-JQ32B8VWLV), provided by Google, to understand how visitors use our website. Its cookies need your consent. If you accept analytics (by choosing “Accept all” in the cookie banner, or saving “Cookie settings” with the “Analytics” category on), Google Analytics may set and read its cookies. Until you accept, no Google Analytics cookie is set; this applies wherever you are, including in the United States. You can withdraw your consent at any time in “Cookie settings,” which the “Your Privacy Choices” link in the footer of every page opens; doing so stops Google Analytics from using its cookies from your next page view and deletes the _ga cookies listed in section 4.8.

Cookieless measurement. Unless your browser sends a Global Privacy Control (GPC) signal, Google’s tag (Google Analytics and the Google Ads tag, AW-18501219935) loads on every page of our website for every visitor, before you make a choice and also after you refuse, with all four of Google’s consent signals (ad_storage, ad_user_data, ad_personalization and analytics_storage) set to denied. In that state it sets and reads no cookie and sends no cookie identifier. It sends Google only cookieless pings: the address of the page you view, the site you came from, your browser and device type, the time, whether an event happened (a page view, or the start of a free-trial sign-up, which is reported to Google Analytics as “generate_lead” and to Google Ads as the “Deneme kaydı” (trial sign-up) conversion, carrying only a random event identifier) and, as with any internet request, your IP address. Google uses these pings to count and model visits and conversions in aggregate; we see only totals. We do this on the basis of our legitimate interest in measuring our website and our advertising (Art. 6(1)(f) GDPR; Art. 5(2)(f) of the Turkish Personal Data Protection Law, KVKK). You can object by turning on Global Privacy Control in your browser: the Google tag then does not load at all and no ping is sent. Google may transfer these pings to Google LLC in the United States (section 9).

We use Google Consent Mode v2. Every signal defaults to denied, and the cookieless pings above are what Google receives while they stay denied. If you accept analytics, only the analytics_storage signal changes to granted; accepting analytics does not change the signals used for advertising, because we do not use Google Analytics for advertising. ad_storage and ad_user_data change to granted only while Marketing is on, for the Google Ads tag (section 4.6); ad_personalization stays denied whatever you choose, because we do not use Google for personalized advertising or remarketing. Google Signals and ads personalization are turned off in our Google Analytics property.

If your browser sends a Global Privacy Control (GPC) signal, wherever you are, we treat it the same as choosing “Reject all”: analytics and marketing stay off unless you later turn them on yourself in “Cookie settings.” Under GPC the Google tag does not load at all, so not even the cookieless pings are sent.

With your consent, Google Analytics measures the pages you view, the site or search engine you arrived from, your device, browser and language, and your approximate location at the city level, which Google derives from your IP address; Google Analytics does not log or store the IP address itself. It also records two events: submitting our contact, sales or free-trial sign-up form (“generate_lead”), and clicking through to the sign-up page (“sign_up_click”). We keep this analytics data in Google Analytics for 14 months.

Google Analytics is provided by Google Ireland Limited for visitors in the EEA, the UK and Türkiye, and by Google LLC, based in the United States, for other visitors. Google processes this data as our service provider (in EU and UK terms, our processor), under Google’s own data processing terms, and does not use it for Google’s own purposes. Where Google transfers this data to the United States, it relies on the standard contractual clauses in those terms and, for Google LLC, its certification under the EU-U.S. Data Privacy Framework; section 9 says more about where this information is processed. Using Google Analytics with your consent is not a sale or sharing of personal information, and Senitix does not use Google Analytics data for cross-context behavioral advertising. The Meta Pixel and the Google Ads tag work differently, as section 4.6 explains.

Your choice itself is recorded in a strictly necessary first-party cookie, sx_consent, listed in section 4.8, so that we do not ask you again and so that analytics and marketing load only as you chose.

The home page and your country. When you open the home page, www.senitix.com, from Türkiye, it sends you to our Turkish site, www.senitix.com/tr/. This uses only the country our content delivery network derives from your connection for that one request; nothing is stored and no cookie is set. Every other page opens as the address you asked for. If you choose a language from the language menu, the sx_lang cookie listed in section 4.8 remembers it, and the home page stops redirecting you.

4.6 Meta Pixel, Google Ads tag and LinkedIn Insight Tag (Marketing)

We use the Meta Pixel (pixel ID 28588767130742431), provided by Meta, to measure how our own ads perform, such as those we run on Instagram, and to let Meta optimize their delivery. We use the Google Ads tag, provided by Google, for the same purpose for our ads on Google, such as in search results; it is described after the Meta Pixel below. We use the LinkedIn Insight Tag, provided by LinkedIn, for the same purpose for our ads on LinkedIn; it is described after the Google Ads tag below. The Meta Pixel and the LinkedIn Insight Tag run only while the Marketing category is on. The Google Ads tag loads before that, in the cookieless mode described in section 4.5; while Marketing is on, it may also set its cookies and use enhanced conversions. Whether Marketing starts on or off depends on where you are:

• Most visitors: not granted until you accept. On our English site for visitors from any country other than the United States, or from a country we cannot determine, and on our Turkish site (www.senitix.com/tr/) wherever you are, Marketing is not granted until you choose “Accept all” in the cookie banner or save “Cookie settings” with the “Marketing” category on. Until then, nothing is requested from Meta or LinkedIn: no Meta or LinkedIn script loads, no information is sent to Meta or LinkedIn and no Meta Pixel, Google Ads or LinkedIn Insight Tag cookie is set. Google’s tag, including the Google Ads tag, still loads in cookieless mode and sends Google only the pings described in section 4.5.
• U.S. visitors to our English site: on until you turn it off. If you visit our English site (any page outside www.senitix.com/tr/) from the United States and have not made a choice yet, Marketing is on and the Pixel, the Google Ads tag and the LinkedIn Insight Tag load with your first page view, unless your browser sends a Global Privacy Control (GPC) signal, in which case it stays off and no banner is shown. The banner tells you that marketing cookies are on and lets you turn them off (section 7). On our legal documents, including this policy, neither starts on by itself: they load there only if you have already turned Marketing on. It is not loaded at all on our newsletter preference and unsubscribe pages. To tell whether you are in the United States, the website uses only the country our content delivery network, Amazon CloudFront, derives from your connection for that one request; nothing is stored for it and no cookie is set.

Analytics works differently: Google Analytics cookies stay off until you accept them, wherever you are, while Google’s tag itself loads in cookieless mode (section 4.5).

What Meta receives. While Marketing is on, your browser loads the Pixel’s script from connect.facebook.net and the Pixel reports to www.facebook.com. Meta receives the address of the page you view (which can include campaign parameters beginning with utm_ and, if you arrived from one of our Meta ads, Meta’s own click identifier), the page you came from, your IP address, details of your browser and device, and the identifiers in the _fbp and _fbc cookies. We have turned off Meta’s Advanced Matching and automatic configuration, so the Pixel never passes your name, email address, phone number or any other personal detail to Meta as event data. If you start a free-trial sign-up while Marketing is on, our server also tells Meta that the sign-up started, that your account was created, that your trial started and of your first payment, as described below.

The events the Pixel reports. The Pixel uses Meta’s standard event names:

• PageView, for every page you view.
• ViewContent, only on our pricing page and our features page; its only detail is the kind of page, “pricing” or “features.”
• Lead, when a contact or sales form has been submitted successfully, including a sales request sent through the Senitix CRM form embedded on our pages; its only detail is “contact” or “sales.”
• Lead, also when you start a free-trial sign-up and we accept your email address; its only detail is “email-signup,” and it carries a random event identifier so the same sign-up is not counted twice.

Nothing you type into a form is sent to Meta.

Cookies. While Marketing is on, the Pixel sets two first-party cookies on senitix.com, both listed in section 4.8: _fbp, which identifies your browser for ad measurement, and _fbc, which is set only when you arrive from a Meta ad link that carries a click identifier. Each lasts 90 days. Meta may also set or read its own cookies on its own domains, under its own policy.

Turning Marketing off. You can turn Marketing off at any time in “Cookie settings,” which the “Your Privacy Choices” link in the footer of every page opens, or by choosing “Reject all” in the banner. Doing so tells the Pixel at once to stop sending events, stops it from loading on your next page view, and deletes the _fbp and _fbc cookies. If your browser sends a Global Privacy Control (GPC) signal, Marketing stays off, wherever you are, unless you turn it on yourself in “Cookie settings.”

Meta’s role. The Meta Pixel is provided by Meta Platforms Ireland Limited and by Meta Platforms, Inc. in the United States. Unlike Google Analytics, Meta does not act only on our behalf: under Meta’s Business Tools Terms, Meta processes the data the Pixel sends for its own purposes as well as to measure and report on our ads for us. For its own purposes, Meta is a recipient that acts as an independent controller. Senitix is responsible, jointly with Meta as those terms describe, for collecting this data on our website and transmitting it to Meta. Meta may transfer the data to the United States, under Meta’s own terms and the safeguards it describes. Meta explains how it uses the data in its Privacy Policy and Cookies Policy.

U.S. state privacy laws. Because Meta, Google and LinkedIn may use the data for their own purposes, some U.S. state privacy laws may treat sending it to Meta as a “sale” or “sharing” of personal information, or as targeted advertising, and give you the right to opt out of it. The same applies to the Google Ads tag and the LinkedIn Insight Tag described below. If you visit our English site from the United States, you can opt out in three ways: choose “Reject all” in the banner; turn Marketing off in “Cookie settings,” which the “Your Privacy Choices” link in the footer of every page opens; or use a browser that sends a Global Privacy Control signal, which we treat as an opt-out and which keeps the Pixel, the Google Ads tag and the LinkedIn Insight Tag from loading at all. A choice made in the banner or in “Cookie settings” is saved in the sx_consent cookie for 180 days in that browser, so if you clear your cookies or use another browser or device, make it there again; a GPC signal is read on every visit. For every other visitor, the Pixel and the LinkedIn Insight Tag are off, and so are the Google Ads tag’s cookies and enhanced conversions, unless you turn Marketing on. The Meta Pixel, the Google Ads tag and the LinkedIn Insight Tag are the only technologies on our website that work this way.

The Google Ads tag. The Google Ads tag (a Google tag, conversion ID AW-18501219935) is Google’s ad measurement tool. We use it only to measure whether our own ads on Google led to a free-trial sign-up; Google also uses that measurement to improve who our ads are shown to and how they are bid. Its cookies and enhanced conversions follow the same rule as the Meta Pixel: until Marketing is on, no Google Ads cookie is set and no enhanced conversion data is sent. Unlike the Pixel, the tag itself loads before that, in the cookieless mode described in section 4.5.

What Google receives. Your browser loads the tag’s script from www.googletagmanager.com (not at all if your browser sends a GPC signal), and the tag sends measurement requests to Google’s advertising domains (such as www.googleadservices.com, googleads.g.doubleclick.net and www.google.com). Before Marketing is on, these are the cookieless pings described in section 4.5. While Marketing is on, Google receives the address of the page you view (which can include campaign parameters beginning with utm_ and, if you arrived from one of our Google ads, Google’s click identifier), the page you came from, your IP address, details of your browser and device, and the identifiers in the _gcl_au and _gcl_aw cookies.

The one event we report. We report a single conversion to Google, “Trial sign-up,” when you start a free-trial sign-up. It carries a random event identifier so the same sign-up is not counted twice, and nothing else you typed, such as your name or phone number. Before you make a choice, and if you refuse, it goes to Google as a cookieless ping (section 4.5). We use the Google Ads cookies and enhanced conversions for it only if you have turned Marketing on yourself; Marketing being on by default for a U.S. visitor to our English site is not enough.

Enhanced conversions. Google’s enhanced conversions feature is turned on in our Google Ads account. While Marketing is on, it may take the email address you type into the sign-up form at the moment of the “Trial sign-up” conversion, turn it in your browser into an irreversible SHA-256 hash, and send that hash to Google; your email address itself is not sent. Google uses the hash only to match the conversion to a person who clicked the ad while signed in to a Google account, so the conversion is measured more accurately. If Marketing is off, no email hash is sent.

Telling Google from our server that a trial started. If you arrived by clicking one of our Google ads and have turned Marketing on, we also tell Google from our server when your free-trial account has been created. That notice contains only Google’s click identifier (gclid, gbraid or wbraid), the time the account was created and a random sign-up code that does not identify you; we do not send your name, email address, phone number or organization name. It also tells Google explicitly that you have not consented to ads personalization. If Marketing is off, we send no such notice.

Telling Meta from our server about a sign-up, a trial and a first payment. If Marketing is on when you start a free-trial sign-up, our server reports to Meta, through Meta’s Conversions API: that the sign-up started (with the same event identifier as the Pixel’s Lead, so Meta counts it once), that your account was created, that your trial started (with the plan’s monthly list price) and, once, your first payment (its amount net of tax and its currency). These notices carry the _fbc and _fbp values passed with your sign-up, your IP address, your browser details, your country and a random sign-up code, the last two as one-way hashes. So that Meta can match them to a Meta account, the notice that the sign-up started also carries a one-way hash (SHA-256) of the email address you verified with the sign-up code, and the notices sent once your account is created carry one-way hashes of your email address, phone number (if you gave one), first and last name; we never send these details in clear. So that we can report the first payment, we keep an encrypted copy of these values apart from your account until 30 days after your trial ends (30 days after the account was created if no trial started) and then delete it. If Marketing is off when you sign up, we send no such notice. To stop the server notices after you have signed up, write to privacy@senitix.com and we will delete the encrypted copy we keep for them.

Cookies. While Marketing is on, the Google Ads tag may set two first-party cookies on senitix.com, both listed in section 4.8: _gcl_au, which identifies your browser for ad conversion measurement, and _gcl_aw, which is set only when you arrive by clicking one of our Google ads and keeps that click’s identifier. Each lasts 90 days. Google may also set or read its own cookies on its own domains, under its own policies. Google’s ad_personalization signal stays denied whatever you choose: we do not remarket or personalize ads through Google, and we do not build Google advertising audiences from our website’s visitors.

Turning Marketing off. When you turn Marketing off, Google’s ad_storage and ad_user_data signals change back to denied on the same page, the Google Ads tag stops using cookies and enhanced conversions from your next page view (it keeps loading in cookieless mode, section 4.5) and the _gcl_au and _gcl_aw cookies are deleted. Withdrawing consent does not affect processing that took place on the basis of your consent before you withdrew it.

Google’s role. The Google Ads service is provided by Google Ireland Limited and, in the United States, by Google LLC. Under the Google Ads Controller-Controller Data Protection Terms, Google processes conversion measurement data both to measure and report on our ads for us and for its own purposes (such as providing, maintaining and improving its services); for those purposes Google is a recipient that acts as an independent controller, under its own privacy policy. The hashed email address sent with enhanced conversions is processed by Google on our behalf, as our processor, under the Google Ads Data Processing Terms. We are responsible for collecting this data on our website and transmitting it to Google, which is why we use the Google Ads cookies and enhanced conversions only with your consent, given by turning Marketing on yourself, and send the cookieless pings, which carry no cookie identifier, on the basis of our legitimate interest (section 4.5). Google may transfer the data to the United States and other countries where it has data centers; section 9 says more about where information is processed. Google explains how it uses the data in its Privacy Policy and in How Google uses information from sites or apps that use our services.

The LinkedIn Insight Tag. The LinkedIn Insight Tag (partner ID 11072769) is LinkedIn’s tool for ad measurement and retargeting. We use it for two things: to measure, in aggregate reports, whether our own ads on LinkedIn led to a visit or to a free-trial sign-up; and to build LinkedIn website audiences, so that our ads on LinkedIn can be shown to LinkedIn members who visited our website. LinkedIn itself matches visits to its members; we see only the approximate size of an audience, never who is in it, and we use these audiences only for our own ads on LinkedIn. We do not upload contact lists or email addresses to LinkedIn. A visitor stays in our website audiences for at most 30 days after their last visit. If you turn Marketing off, no new visits are added; an existing membership ends when that period runs out. Because we cannot see who is in an audience, we cannot remove you from it ourselves; you can stop these ads at any time in your LinkedIn ad settings. It follows the same rule as the Meta Pixel, not the cookieless rule of Google’s tag: until Marketing is on, the tag does not load, nothing is requested from LinkedIn (neither snap.licdn.com nor px.ads.linkedin.com) and no LinkedIn Insight Tag cookie is set. For U.S. visitors to our English site, it starts on and runs until you turn Marketing off, exactly like the Pixel and the Google Ads tag.

What LinkedIn receives. While Marketing is on, your browser loads the tag’s script from snap.licdn.com and the tag reports to px.ads.linkedin.com. With them LinkedIn receives the address of the page you view and the page you came from, your IP address, details of your browser and device, the time of your visit, which buttons you click (their labels) and how long you stay on the page, together with LinkedIn’s own identifiers. If you arrived by clicking one of our LinkedIn ads, LinkedIn also receives its click identifier (li_fat_id). If you are signed in to LinkedIn, LinkedIn can link your visit to your LinkedIn account. We never send LinkedIn your name, email address or anything you type into a form, and we do not send LinkedIn hashed email addresses.

The one conversion we report. When you start a free-trial sign-up successfully, the website reports a single conversion to LinkedIn, “Free trial signup” (conversion ID 31746425). Only the conversion event is sent, with nothing about you. We send it only if Marketing is on; for a U.S. visitor to our English site, that includes Marketing being on by default.

Cookies. While Marketing is on, the LinkedIn Insight Tag may set two first-party cookies on senitix.com, both listed in section 4.8: li_fat_id (30 days), which indirectly identifies LinkedIn members for conversion tracking; and li_giant (7 days), which indirectly identifies groups of LinkedIn members for conversion tracking. Our LinkedIn website audiences rely on LinkedIn’s own cookies to recognize its members. LinkedIn also sets or reads cookies on its own domain, linkedin.com, such as ar_debug (attribution reporting), bcookie, bscookie, lidc, li_sugr, UserMatchHistory and AnalyticsSyncHistory, under its own policy; LinkedIn’s cookie table describes them.

Turning Marketing off. When you turn Marketing off, the page reloads so the LinkedIn Insight Tag stops at once, it does not load again, and the first-party li_fat_id and li_giant cookies are deleted. We cannot delete the cookies LinkedIn sets on linkedin.com; you can delete them in your browser or manage them in your LinkedIn settings. Withdrawing consent does not affect processing that took place on the basis of your consent before you withdrew it.

LinkedIn’s role. The LinkedIn Insight Tag is provided by LinkedIn Ireland Unlimited Company (Wilton Plaza, Wilton Place, Dublin 2, Ireland), and LinkedIn may process the data in the United States (LinkedIn Corporation). Unlike Google Analytics, LinkedIn does not act only on our behalf: it also processes the data the tag collects for its own purposes, as an independent controller, under its own privacy policy. For the collection of this data on our website and its transmission to LinkedIn, we may be joint controllers with LinkedIn. LinkedIn may transfer the data to the United States, under LinkedIn’s own terms and the safeguards it describes. LinkedIn explains how it uses the data in its Privacy Policy.

Where you came from (sx_attr). If you have turned on Analytics or Marketing, we keep where your first and latest visits came from in a first-party cookie, sx_attr, for 90 days: the campaign parameters in the address (those beginning with utm_), the ad platform’s click identifier if you arrived from an ad (gclid, gbraid or wbraid for Google; fbclid for Meta; li_fat_id for LinkedIn), the path of the page you landed on, the domain of the site that referred you, and the time. Only we read this cookie; nothing is sent to an ad platform through it. When you start a free-trial sign-up, we pass it to the Senitix application with your sign-up: the campaign parameters, landing path and referring site only if you have accepted Analytics; the click identifiers, and Meta’s _fbp and _fbc cookie values, only if you have turned Marketing on. Meta cookie values are deleted from the sign-up details within 24 hours after the sign-up is completed (the encrypted copy we keep to report to Meta, with the hashes sent to Meta, is deleted 30 days after your trial ends, 30 days after the account was created if no trial started, or within 72 hours if the sign-up is not completed); the click identifiers, campaign parameters, landing path and referring site are kept with your account’s sign-up details so we can tell which campaign brought the sign-up. If the sign-up is not completed, all of it is deleted within 72 hours. If you withdraw both Analytics and Marketing, the sx_attr cookie is deleted on your next page view.

4.7 Live chat (Crisp)

We use Crisp, a live chat service provided by Crisp IM SAS, based in France, so that you can write to our team from any page of our website. Unlike Google Analytics and the Meta Pixel, the live chat is not one of the consent categories: it loads with every page of our English and Turkish sites, for every visitor, without waiting for a cookie choice, and it cannot be turned off in “Cookie settings,” where it appears as an always-on “Live chat” row (section 7). It runs only on our website, never in the Senitix application.

How it loads. After a page has finished loading, at most about 2.5 seconds later, your browser requests Crisp’s script, styles, fonts, sounds and settings from client.crisp.chat, and avatars from image.crisp.chat. The chat button then appears at the bottom right of the page, in English on our English site and in Turkish on our Turkish site. If you open the chat and write to us, your messages travel through Crisp’s servers (addresses ending in crisp.chat, including a continuous connection that carries messages as they are sent) and are read by members of the Senitix team in Crisp’s inbox.

What Crisp receives. Whenever the chat loads, Crisp receives your IP address, details of your browser and device, the address of the page you are viewing and of the page you came from (so our team can see which page you are on), and your chat session identifier. If you write to us, Crisp also receives the text of your messages, any files you send and, only if you type them, your name or email address. Our website passes no name, email address or other personal detail to Crisp.

What it stores in your browser. As soon as it loads, Crisp’s script sets two first-party cookies on senitix.com, both listed in section 4.8 and each named after our Crisp website ID: crisp-client/session/*, which lasts about 6 months (182 days), and crisp-client/socket/*, which lasts about 2 days. It also keeps entries with the same crisp-client/session/* names in your browser’s local storage. They identify your chat session, so that a conversation can continue on later pages and later visits. You can delete them in your browser at any time (section 7).

Crisp’s role and why we use it. Crisp processes this information as our service provider (in EU and UK terms, our processor), to provide the chat for us. We rely on our legitimate interests in offering visitors a direct way to reach us and in keeping a chat session working, not on your consent; we process the content of your messages because you choose to write to us. We keep chat conversations as long as needed to answer and follow up on your request and to keep a record of it, and until you ask us to delete them at privacy@senitix.com. Because Crisp acts as our service provider, the live chat is not a sale or sharing of personal information. Crisp describes its own practices in its privacy policy.

4.8 Website cookie list

Cookie	Set by	Purpose	Duration	Category
__cf_bm	Cloudflare, for Senitix (first party)	Set only on senitix.com, during the redirect to www.senitix.com, to help tell people apart from automated bots. It is not set on www.senitix.com.	30 minutes	Strictly necessary
cf_clearance	Cloudflare, for Senitix (first party)	Set only on senitix.com, and only if your browser is asked to complete a security check; records that you passed it so you are not asked again. It is not set on www.senitix.com.	30 minutes by default	Strictly necessary
sx_consent	Senitix (first party)	Records the cookie choice you made, one answer for each optional category (analytics and marketing), so we do not ask again and so analytics and marketing cookies are used only as you chose. Written only when you make a choice. Holds no personal data.	180 days	Strictly necessary
sx_lang	Senitix (first party)	Set only when you choose a language in the site’s language menu; remembers that choice so the home page opens in the language you picked rather than the one suggested by your location. Holds no personal data.	1 year	Strictly necessary
Named by the provider	Google (YouTube) or Vimeo (third party)	Set only after you press play on a video; used by the provider to play the video and for the purposes described in its own privacy policy.	Set by the provider	Loads only at your request
crisp-client/session/*	Crisp, for Senitix (first party)	Set by the live chat’s script as soon as it loads, on every page; identifies your chat session so a conversation can continue on later pages and visits (section 4.7). The name ends with our Crisp website ID.	About 6 months (182 days)	Live chat, loads with the page
crisp-client/socket/*	Crisp, for Senitix (first party)	Set by the live chat’s script as soon as it loads, on every page; used with the cookie above to identify your chat session (section 4.7). The name ends with our Crisp website ID.	About 2 days	Live chat, loads with the page
crisp-client/session/* (local storage entries)	Crisp, for Senitix (first party)	Kept in your browser’s local storage by the live chat’s script as soon as it loads; identify your chat session, like the cookie of the same name (section 4.7).	Until removed from your browser	Live chat, loads with the page
_ga	Google Analytics, for Senitix (first party)	Set only if you accept analytics; distinguishes one visitor’s browser from another.	2 years	Analytics, only with consent
_ga_JQ32B8VWLV	Google Analytics, for Senitix (first party)	Set only if you accept analytics; stores session state for Google Analytics.	2 years	Analytics, only with consent
_fbp	Meta Pixel, for Senitix (first party)	Set only while Marketing is on; identifies your browser so Meta can measure our ads (section 4.6). Deleted if you turn Marketing off.	90 days	Marketing: with consent, or until you opt out for U.S. visitors to our English site
_fbc	Meta Pixel, for Senitix (first party)	Set only while Marketing is on, and only when you arrive from a Meta ad link that carries a click identifier; keeps that identifier so Meta can measure the ad (section 4.6). Deleted if you turn Marketing off.	90 days	Marketing: with consent, or until you opt out for U.S. visitors to our English site
_gcl_au	Google Ads tag, for Senitix (first party)	Set only while Marketing is on; identifies your browser so Google can measure our ad conversions (section 4.6). Deleted if you turn Marketing off.	90 days	Marketing: with consent
_gcl_aw	Google Ads tag, for Senitix (first party)	Set only while Marketing is on, and only when you arrive by clicking one of our Google ads; keeps that click’s identifier so the “Trial sign-up” conversion can be matched to it (section 4.6). Deleted if you turn Marketing off.	90 days	Marketing: with consent
li_fat_id	LinkedIn Insight Tag, for Senitix (first party)	Set only while Marketing is on; indirectly identifies LinkedIn members for conversion tracking, and keeps the click identifier when you arrive from one of our LinkedIn ads (section 4.6). Deleted if you turn Marketing off.	30 days	Marketing: with consent, or until you opt out for U.S. visitors to our English site
li_giant	LinkedIn Insight Tag, for Senitix (first party)	Set only while Marketing is on; indirectly identifies groups of LinkedIn members for conversion tracking (section 4.6). Deleted if you turn Marketing off.	7 days	Marketing: with consent, or until you opt out for U.S. visitors to our English site
ar_debug	LinkedIn (third party, linkedin.com)	Set by LinkedIn on its own domain only while Marketing is on; supports attribution reporting (section 4.6). We cannot delete it; delete it in your browser or manage it in your LinkedIn settings.	Session	Marketing: with consent, or until you opt out for U.S. visitors to our English site
bcookie	LinkedIn (third party, linkedin.com)	Set by LinkedIn on linkedin.com only while Marketing is on; a browser identifier (section 4.6). We cannot delete it; delete it in your browser or manage it in your LinkedIn settings.	1 year	Marketing: with consent, or until you opt out for U.S. visitors to our English site
bscookie	LinkedIn (third party, linkedin.com)	Set by LinkedIn on linkedin.com only while Marketing is on; a secure browser cookie (section 4.6). We cannot delete it; delete it in your browser or manage it in your LinkedIn settings.	1 year	Marketing: with consent, or until you opt out for U.S. visitors to our English site
lidc	LinkedIn (third party, linkedin.com)	Set by LinkedIn on linkedin.com only while Marketing is on; used for data-centre selection (section 4.6). We cannot delete it; delete it in your browser or manage it in your LinkedIn settings.	24 hours	Marketing: with consent, or until you opt out for U.S. visitors to our English site
li_sugr	LinkedIn (third party, linkedin.com)	Set by LinkedIn on linkedin.com only while Marketing is on; used for probabilistic matching (section 4.6). We cannot delete it; delete it in your browser or manage it in your LinkedIn settings.	90 days	Marketing: with consent, or until you opt out for U.S. visitors to our English site
UserMatchHistory	LinkedIn (third party, linkedin.com)	Set by LinkedIn on linkedin.com only while Marketing is on; used for LinkedIn Ads ID syncing (section 4.6). We cannot delete it; delete it in your browser or manage it in your LinkedIn settings.	30 days	Marketing: with consent, or until you opt out for U.S. visitors to our English site
AnalyticsSyncHistory	LinkedIn (third party, linkedin.com)	Set by LinkedIn on linkedin.com only while Marketing is on; records the time of the last sync (section 4.6). We cannot delete it; delete it in your browser or manage it in your LinkedIn settings.	30 days	Marketing: with consent, or until you opt out for U.S. visitors to our English site
sx_attr	Senitix (first party, .senitix.com)	Set only if you have turned on Analytics or Marketing. Keeps where your first and latest visits came from (campaign parameters, ad click identifier, landing page, referring site, time); at a free-trial sign-up only the part your consent allows is passed to the application (section 4.6). Deleted if you withdraw both.	90 days	Analytics or Marketing, with consent
wordpress_logged_in_*, wordpress_sec_*	Senitix (first party)	Keep a website editor signed in. Editors only.	Until the browser closes, or 14 days if the editor chooses “Remember me”	Strictly necessary
wordpress_test_cookie	Senitix (first party)	Checks that an editor’s browser accepts cookies on the sign-in page. Editors only.	Until the browser closes	Strictly necessary
wp-settings-*, wp-settings-time-*	Senitix (first party)	Remember an editor’s screen settings in the editing tools. Editors only.	1 year	Preference

5. The Senitix application

The application uses a small number of cookies and browser storage entries to work. Senitix sets them on senitix.com domains, except the Cloudflare and Amazon Web Services cookies noted below, which those providers set for us on our domains. None of them is used for advertising or to track you on other websites.

5.1 Cookies

Some of these cookies are set for senitix.com and all of its subdomains, so that signing in to your account also signs you in to Senitix CRM. Your browser may therefore send them when you visit our website as well; the website does not read or use them. Cookies that carry sign-in secrets are marked HttpOnly, so scripts on the page cannot read them, and Secure, so they are sent only over encrypted connections.

Cookie	Set by	Purpose	Duration	Category
crm_session, app_session	Senitix (first party)	Keeps you signed in while you use Senitix CRM and, where enabled, your account, by linking your browser to a secure session held on our servers.	Until you close your browser; the session behind it ends after 2 hours without activity and after 24 hours at most	Strictly necessary
refresh_token	Senitix (first party)	Signs you back in when your short-lived access expires, so you do not have to re-enter your password each time. Deleted when you sign out.	7 days	Strictly necessary
sx_auth	Senitix (first party)	Set and deleted together with refresh_token. Holds no personal data, only a random value; it tells our website that someone may be signed in, so the site’s header asks the application who it is (section 4.1) instead of asking on every visit.	7 days	Strictly necessary
senitix_launch_verifier	Senitix (first party)	A one-time security value used when you open Senitix CRM from your account, so the hand-off between the two cannot be intercepted.	10 minutes	Strictly necessary
XSRF-TOKEN	Senitix (first party)	Helps protect you against cross-site request forgery, in which another website tries to send requests to Senitix in your name.	Up to 2 hours	Strictly necessary
senitix-language	Senitix (first party)	Remembers the language you chose in your account.	Until you close your browser	Preference
AWSALB, AWSALBCORS	Amazon Web Services, for Senitix (first party)	May be set when the application opens its real-time connection, to keep that connection on the same server so live updates and notifications keep arriving.	1 day	Strictly necessary
__cf_bm, cf_clearance	Cloudflare, for Senitix (first party)	May be set for security, as described in section 4.2.	30 minutes	Strictly necessary

5.2 Browser storage

The application also keeps some information in your browser’s local storage and session storage. This information stays on your device and, unlike a cookie, is not sent to our servers automatically with every request.

Purpose	Examples	Storage	How long
Sign-in state	senitix-auth, which records only whether you are signed in, not your name or email address; senitix-current-tenant, the workspace you are using	Local storage	Until the application removes it or you clear your browser’s site data
Returning you to the right page after you sign in	sso_auth, senitix-bff-redirect	Session storage	Until you close the tab
Language	senitix-language, senitix-locale	Local storage	Until you change the language or clear your browser’s site data
Interface settings	senitix-ui, tcl-right-open, senitix-setup-checklist, senitix-email-account (the connected email account you selected), and column and panel layouts	Local storage	Until you change the setting or clear your browser’s site data; some are removed when you sign out
Unsaved drafts	form-draft:* in Senitix CRM; senitix:draft:* in your account	Session storage in Senitix CRM; local storage in your account	In Senitix CRM, until you save the form, close the tab or sign out; in your account, until you submit the form or clear your browser’s site data
Recently viewed records and your first setup conversation	senitix-recently-viewed, senitix-onboarding-chat	Session storage	Until you close the tab; recently viewed records are also removed when you sign out
Error monitoring	sentryReplaySession	Session storage	Until you close the tab (see section 5.3)

A draft can include personal information you typed into a form, such as a contact’s name or email address. It stays in your browser and is not sent to us until you save the form. If you use a shared computer, sign out and close the browser when you finish.

5.3 Error and performance monitoring

To find and fix problems, the application and our status page use Sentry, an error-monitoring service provided by Functional Software, Inc. Sentry sets no cookies. When an error occurs, it records technical details about the error and may record a short replay of the screen leading up to it, with all text masked and images and media blocked. Replays are turned off on payment screens. While a replay is being recorded, Sentry keeps an identifier in your browser’s session storage, which is deleted when you close the tab. Sentry also measures page-load performance for a sample of visits. We use this information only to operate, secure and improve the service; see section 9 for where Sentry processes it. Sentry runs only in the application and on the status page. Our website, www.senitix.com, does not use it.

5.4 Connected accounts and single sign-on

When you sign in with a Google, Microsoft or GitHub account, connect a Google or Microsoft account to Senitix CRM, or sign in through your organization’s single sign-on provider, you are taken to that provider’s own pages to approve the connection or sign in. The provider sets and controls its own cookies there, under its own policies. We do not receive or control those cookies.

6. Emails

Emails from Senitix. We send account, security and billing emails through Twilio SendGrid. To confirm that important notices arrive, SendGrid records whether each email was delivered and, where tracking is enabled, when it was opened or a link in it was clicked, using a pixel and links that pass through SendGrid. This tracking does not rely on cookies.

Emails our customers send with Senitix CRM. Senitix CRM does not track whether an email a customer sends to one of its own contacts is opened or whether a link in it is clicked. It adds no tracking pixel and does not rewrite links. Emails sent before September 27, 2026 may still contain a pixel or rewritten links; these still open and redirect, but we no longer record anything when they are used. The email and its content are processed on the customer’s behalf under our Data Processing Addendum. If you received such an email and have questions, please contact the company that sent it.

7. How to control cookies and browser storage

The cookie banner. The first time you visit www.senitix.com, a banner appears in one of two versions. Both offer “Accept all” and “Reject all,” shown with equal prominence, and “Cookie settings,” which opens a panel with three categories: Strictly necessary, which is always on because the website cannot work as intended without it; Analytics (Google Analytics); and Marketing (the Meta Pixel, the Google Ads tag and the LinkedIn Insight Tag). The panel also shows an always-on “Live chat” row, which says that our live chat loads with the page so you can write to us. It has no switch, because the live chat is not one of the consent categories (section 4.7).

• A question, for most visitors. On our Turkish site, and on our English site for visitors outside the United States or whose country we cannot determine, the banner first says that some cookies are needed for this site and its live chat to work, then that, with your permission, we also use analytics cookies and marketing cookies to measure our ads and show them to people who visited this site, and that optional cookies stay off until you choose. In its panel, the Analytics and Marketing switches start on for a visitor who has not answered yet (an earlier refusal stays off), but nothing is granted until you press “Accept all” or “Save choices”; “Reject all” refuses both.
• A notice, for U.S. visitors to our English site. The banner tells you that some cookies are needed for this site and its live chat to work, that, where the law allows, marketing cookies, which measure our ads and show them to people who visited this site, are on until you turn them off, and that analytics cookies stay off until you accept them. “Reject all” turns Marketing off at once: the Pixel, the Google Ads tag and the LinkedIn Insight Tag stop and their cookies are deleted. “Accept all” turns Analytics on and keeps Marketing on. In the panel, both switches start on, as for every visitor: Marketing is already in effect, while Analytics is not granted until you press “Accept all” or “Save choices.” If you ignore the notice, Marketing stays on and the notice appears again on the next page you open.

Nothing is written to your browser to record a choice until you make one. Your choice is then saved in the sx_consent cookie described in section 4.8, for 180 days, so we do not ask again on your next visit in the same browser. If you made your choice before we added the Marketing category on September 30, 2026, or before we extended it on October 11, 2026 to the Google Ads tag, to the LinkedIn Insight Tag and then to LinkedIn website audiences (when the consent cookie moved to version 5), an earlier Marketing answer no longer counts and the banner asks you once more about Marketing; your Analytics answer stays as you gave it.

Changing your choice. The “Your Privacy Choices” link in the footer of every page of our English site (on our Turkish site, the equivalent link in its footer) reopens the “Cookie settings” panel at any time, so you can turn analytics or marketing on or off. Withdrawing your consent to analytics stops Google Analytics from using its cookies from your next page view and deletes the _ga cookies described in section 4.8. Turning marketing off tells the Meta Pixel at once to stop sending events, stops it from loading on your next page view and deletes the _fbp and _fbc cookies described in section 4.8; it also stops the Google Ads tag from using cookies and deletes the _gcl_au and _gcl_aw cookies, and stops the LinkedIn Insight Tag and deletes the li_fat_id and li_giant cookies (the cookies LinkedIn sets on linkedin.com can be deleted only in your browser or managed in your LinkedIn settings). We also honor the Global Privacy Control (GPC) browser signal, described in section 8, as a request to keep analytics and marketing off, and under it Google’s tag does not load at all (section 4.5).

The live chat. The live chat loads with every page and cannot be turned off in “Cookie settings” (section 4.7). When it loads, Crisp receives the information section 4.7 describes, whether or not you write to us. You can delete its cookies and local storage entries in your browser at any time; if you block them, the chat may not be able to continue a conversation from one page or visit to the next.

Browser settings. Every major browser, including Chrome, Safari, Firefox and Edge, lets you see, block and delete cookies and clear the information a site keeps in local and session storage, usually in its privacy or site data settings. A private or incognito window discards cookies and storage when you close it. Blocking cookies on our website mainly means the choice you make in the cookie banner is not remembered between visits, so the banner reappears; the site otherwise keeps working. The application cannot keep you signed in without its cookies, so blocking them will prevent you from using it, and clearing its site data will sign you out and delete any unsaved drafts.

Signing out. Signing out ends your session, removes your sign-in cookies, and clears the drafts and recently viewed records that Senitix CRM keeps in your browser.

Videos. If you do not want a video provider to receive information about you, do not press play. You can delete a provider’s cookies at any time in your browser and manage your settings with the provider directly.

Your privacy rights. To learn about your rights to know about, delete or correct your personal information, and how to exercise them, see our Privacy Policy.

8. Do Not Track and Global Privacy Control

Do Not Track. Some browsers can send a “Do Not Track” (DNT) signal. There is no common industry standard for how a website should respond to it. Our website does not change its behavior when it receives a DNT signal; whether analytics or marketing cookies are set for your browser is controlled by the cookie choice described in section 7 and, for marketing, by where you are (section 4.6), and whether Google’s cookieless tag loads is controlled by GPC (section 4.5), not by DNT.

Tracking by third parties. Apart from the exceptions below, each under your control, we do not allow third parties to collect personal information about your online activities over time and across different websites when you use our website or the application. Google, our analytics provider, is one exception: if you accept analytics, Google processes your visit as our service provider to measure how the website is used, as section 4.5 describes, and because Google Signals and ads personalization are off, it does not use that data to build cross-site advertising profiles. Before you choose, and if you refuse, Google’s tag sends Google only the cookieless pings described in section 4.5, and nothing at all under GPC. Meta is another: while Marketing is on (section 4.6 explains when it starts on), the Meta Pixel sends Meta information about your visit, which Meta may use for its own purposes under its own policy, as section 4.6 describes. Google Ads is another: besides the cookieless pings of section 4.5, while Marketing is on the Google Ads tag sends Google information about your visit and, if you sign up for a free trial, the “Trial sign-up” conversion, which Google may use for its own purposes under its own policy; it does not use it for ads personalization (section 4.6). LinkedIn is another: while Marketing is on, the LinkedIn Insight Tag sends LinkedIn information about your visit and, if you sign up for a free trial, the “Free trial signup” conversion, which LinkedIn may use for its own purposes under its own policy; we also use it to show our ads on LinkedIn to people who visited our website (section 4.6). The last exception is a video: if you press play on an embedded video, the video provider receives information from your browser and may use cookies under its own policy, as described in section 4.3. Amazon Web Services, Amazon CloudFront, Google and our other service providers process information about your visit on our behalf, to provide their services to us; Cloudflare does so for senitix.com and for the application, Sentry for the application and the status page, and Crisp, our live chat provider, on every page of our website, where the chat loads with the page outside the consent categories (section 4.7).

Global Privacy Control. Global Privacy Control (GPC) is a browser setting that tells websites you want to opt out of the sale or sharing of your personal information and of targeted advertising. We treat a GPC signal from your browser as a refusal of both optional categories, Analytics and Marketing, the same as choosing “Reject all” in the cookie banner (section 7), wherever you are and on both our English and Turkish sites: the banner is not shown, and neither category runs unless you later turn it on yourself in “Cookie settings.” Google’s tag does not load at all under GPC, so not even its cookieless pings (section 4.5) are sent. The Meta Pixel, the Google Ads tag and the LinkedIn Insight Tag in the Marketing category are the only technologies on our website that some U.S. state privacy laws may treat as a sale or sharing of personal information, or as targeted advertising (section 4.6). For a U.S. visitor to our English site, a GPC signal is what keeps all three from loading at all: without one, they run from your first page view until you opt out with “Reject all” or in “Cookie settings.” Otherwise, we do not sell or share personal information and do not use it for targeted advertising, as those terms are defined in the California Consumer Privacy Act and other U.S. state privacy laws. A GPC signal does not stop the live chat, which is not one of the consent categories and, because Crisp acts as our service provider, is not a sale or sharing (section 4.7). You can learn more at globalprivacycontrol.org.

9. Where this information is processed

Senitix is based in Türkiye. Our website runs on a single server hosted by Amazon Web Services in the European Union, in Frankfurt, Germany, and is delivered by Amazon CloudFront, which handles each request at the AWS edge location nearest the visitor; there is no disaster-recovery copy of the website in a second region. The Senitix application is hosted by Amazon Web Services in Frankfurt, Germany, with disaster recovery in Ireland. Cloudflare provides the DNS for our domains and protects senitix.com and the application from its global network, so those requests may be handled at a location near you. Google Analytics is provided by Google Ireland Limited for visitors in the EEA, the UK and Türkiye, and by Google LLC in the United States for other visitors, and processes information there and, for transfers to the United States, under the safeguards section 4.5 describes. The cookieless pings that Google’s tag sends before you choose (section 4.5) go to Google as well and may be transferred to Google LLC in the United States. While Marketing is on, the Meta Pixel is provided by Meta Platforms Ireland Limited and Meta Platforms, Inc., and Meta may transfer the data to the United States under its own terms and the safeguards it describes (section 4.6). The Google Ads tag is provided by Google Ireland Limited and Google LLC, and Google may transfer the data to the United States and other countries where it has data centers; for visitors whose data Senitix transfers from Türkiye, the transfer of the data collected while Marketing is on rests, like the Meta Pixel’s, on the explicit consent given by turning Marketing on, and, for the cookieless pings, on the standard-contract commitment that also covers Google Analytics (section 4.6). While Marketing is on, the LinkedIn Insight Tag is provided by LinkedIn Ireland Unlimited Company, and LinkedIn may process the data in the United States (LinkedIn Corporation), under LinkedIn’s own terms and the safeguards it describes; for visitors whose data Senitix transfers from Türkiye, this transfer rests, like the Meta Pixel’s, on the explicit consent given by turning Marketing on (section 4.6). Our live chat is provided by Crisp IM SAS, a company based in France, in the European Union (section 4.7). Email delivery information is processed by Twilio SendGrid in the United States, and our error-monitoring provider, Sentry, may process information in the United States or the European Union. Video providers process information under their own policies and may do so in the United States and other countries. Our Privacy Policy explains how we protect personal information that is transferred between countries.

10. Changes to this policy

This policy is effective as of September 12, 2026. We added the Marketing category and the Meta Pixel on September 30, 2026, and on the same day made Marketing start on, until they turn it off, for U.S. visitors to our English site. Also on September 30, 2026, we added our live chat, provided by Crisp, which loads with every page (section 4.7). On October 11, 2026, we added the Google Ads tag to the Marketing category, together with the “Trial sign-up” conversion reported from our server and the sx_attr cookie (section 4.6). Also on October 11, 2026, we added the LinkedIn Insight Tag to the Marketing category and, the same day, LinkedIn website audiences (section 4.6). On October 14, 2026, we added the notices our server sends Meta about a sign-up, a trial and a first payment. On October 17, 2026, we added to them one-way hashes of the email address verified at sign-up and, once the account is created, of the phone number, first and last name. Also on October 11, 2026, Google’s tag began to load in cookieless mode before a choice is made (GPC keeps it off), and the switches in “Cookie settings” began to start on for a visitor who has not answered (section 4.5 and section 7). We will update it when the technologies we use change, and always before we add any further optional technology. The date at the top of this page shows when the policy was last updated. If we make a material change, we will post a notice on our website and, for customers, notify account administrators by email or in the application before the change takes effect.

11. Contact us

If you have questions about this policy or our use of cookies and similar technologies, email privacy@senitix.com or write to us at Senitix Teknoloji LTD. ŞTİ., Cevizli Mah. Zuhal Cad. A Blok No:46 İç Kapı No:50, Maltepe, İstanbul, Türkiye. For anything else, use our contact page.