Effective date: 13.04.2026 · Last updated: 01.11.2026
1. What Are Cookies
Cookies are small text files stored on your device by your web browser. They are used to remember preferences, maintain login sessions, and ensure proper service operation.
Guardiso uses cookies mainly to the extent necessary for platform operation. Only with your consent do we store two more things: your appearance and language settings (sections 2b and 2c) and the Google Ads advertising cookies (section 3a). We do not build user profiles.
2. Essential Cookies
These cookies are required for proper service operation and cannot be disabled. They include:
Name
Purpose
Duration
__Secure-authjs.session-token
Authentication session: keeps the user signed in (Auth.js v5, HttpOnly, Secure)
Until sign-out / 30 days
__Host-authjs.csrf-token
CSRF protection: guards against cross-site request forgery
Session
__Secure-authjs.callback-url
Temporary return path after the OAuth sign-in flow completes
Auditor session: links the sign-in to the auditor access link, read-only access. Page scripts cannot read it (HttpOnly). It is set only when entering from the auditor portal.
Until the auditor access ends, at most 8 hours
guardiso-auditor
Auditor session marker with no data in it. It tells the page that an auditor is working, so the page keeps the portal language. It is set only when entering from the auditor portal.
Until the auditor access ends, at most 8 hours
guardiso-auditor-lang
Language of the auditor portal, set from the link in the invitation so that the following portal pages use the same language. Page scripts cannot read it (HttpOnly). It is set only in the auditor portal.
Session
dev_access
Password gate for the development environment (only on dev.guardiso.com, never set on production)
Session
Some of the items above (for example temporary OAuth flow parameters from GitHub or Slack when connecting integrations) are set only briefly and removed automatically once the operation completes.
2a. Bot protection (Cloudflare Turnstile)
The demo booking form (the “Book a call” page) is protected against automated abuse using Cloudflare Turnstile. This is a security mechanism necessary for the form to work. It protects against spam and abuse. To verify that a submission comes from a human, Cloudflare may set its own short-lived cookies:
Name
Purpose
Duration
__cf_bm
Cloudflare Bot Management: distinguishes human traffic from bots; set by Cloudflare during Turnstile verification
up to 30 minutes
cf_clearance
Confirmation that a Cloudflare security challenge was passed. It may be set under heightened protection
up to 1 year
These files serve security purposes only and fall under the strictly necessary category. They are not used for tracking, profiling or advertising. They are subject to Cloudflare's privacy policy. The Turnstile script is loaded only on the form page, not across the rest of the site.
Beyond cookies, the site uses your browser's local storage to remember your display preferences. This is technical data. It is not sent to the server or used for tracking.
Key
Purpose
guardiso-landing-theme
Light or dark theme preference for the landing page and the demo booking form
guardiso-theme
Interface theme preference in the authenticated part of the platform
guardiso-theme-czas, guardiso-landing-theme-czas
When the light or dark theme was chosen, so that the latest choice applies in other tabs too
guardiso-theme-explicit
Marks that the theme was chosen by a person rather than set by default
guardiso-wybor-motywu
Your choice of the light or dark look, together with the time you made it. The latest choice applies, also in other open tabs. It is created only when you click the switch.
How far the side menu is scrolled and which of its groups are open, so the menu stays in place and does not jump when you move to another screen. The record in the tab memory is removed when the tab is closed, and the cookie with the open groups when the browser is closed
guardiso-okienko-dokumentacji-zamkniete
Records that the window about preparing the documentation was closed, so it does not come back on every page. Removed when the tab is closed
We store the look only when you click the switch. On a public page without consent to remember settings, the choice stays only in that tab and disappears when you close it. Refusing in the consent window does not delete a choice you have already made with the switch.
2c. Interface language
We remember the language in two separate records, and each one answers a different question. The first says which language to show as soon as you arrive. The second says that a person picked the language by clicking the switch. Without that second record the platform would fall back to your company language after every sign-in and discard your choice.
Name
Type
Purpose
Duration
guardiso-lang
Cookie
Interface language (PL, EN, NL, DE, FI). The platform also writes it on its own, when it infers the language from your browser settings or takes your company language.
1 year
guardiso-lang
Browser storage
The same value, in case the cookie is lost.
Until you clear site data
guardiso-lang
Cookie
The language from the page address when you open a page in another language, for example with ?lang=en added. This keeps the following pages of the visit in the same language. It is not set if you refuse preference storage in the consent window.
Until you close the browser
guardiso-lang
Cookie
Platform language for an auditor. The auditor sign-in from the auditor portal writes it, with Polish as the language. It is not set outside the auditor sign-in.
Until the auditor access ends, at most 8 hours
guardiso-wybrany-jezyk
Cookie
Your own language choice, together with the time you made it. It is created only when you click the language switch. It is never created on its own.
1 year
guardiso-wybrany-jezyk
Browser storage
The same value, so your choice survives even if the cookie disappears, and other open tabs switch to the chosen language right away.
Until you clear site data
guardiso-wybor-jezyka
Cookie and browser storage
An older record of the language choice. The platform no longer uses it and deletes it if you refuse preference storage.
At most 1 year
guardiso-last-org-lang-sync
Browser storage
The company for which the platform last set the language. After you switch to another company, the platform shows that company's language until you pick another one with the switch.
Until you clear site data
Each of these records belongs to the “Preferences” category in the consent window. If you refuse that category on a public page, we delete the records the platform makes on its own and stop making them. Your own choice made with the switch stays, because we store it at your request. You can remove it by picking another language or by clearing the site data in your browser.
3. Analytics Cookies
Currently, Guardiso does not use any analytics cookies (e.g., Google Analytics, Plausible, Mixpanel).
We also do not use Real User Monitoring tools (for example Cloudflare Web Analytics). Our typefaces are served from our own server, so loading a page does not send your network address to Google Fonts.
In the future, we may introduce anonymous usage analytics to improve service quality. In that case, we will update this policy and notify users with 30 days' advance notice.
3a. Advertising Cookies (Google Ads)
On the public pages of guardiso.com we load the Google Ads tag, but only if you switch on the “Marketing” category in the consent window. The tag has one job: it checks whether someone who came from our Google ad sent the trial account form and whether they created the account. It also records the visit from the ad itself. When a page loads, it sends Google the page address without extra parameters. The one exception is the ad click identifier when the visit started from our ad. Google also sees your device's network address. We have switched off counting moves between pages and collecting email addresses from forms. We do not tailor ads to a specific person. The tag does not run in the signed-in part of the platform. The only exception is the moment right after a trial account is created, when it sends Google one message about that event.
Name
Purpose
Duration
_gcl_au
Google Ads. Links a visit to the ad it came from.
90 days
_gcl_aw
Google Ads. Stores the ad click identifier. Created only when you arrive from an ad.
90 days
_gcl_gb
Google Ads. The same as above for clicks from iOS devices.
90 days
_gcl_ag
Google Ads. Stores the ad click identifier from Google apps on a phone. Created only when you arrive from such an ad.
90 days
_gcl_ls
Google Ads. A copy of the ad click identifier in browser storage, not in a cookie. We delete it when you withdraw consent.
Until you withdraw consent
_gcl_gs
Google Ads. Stores ad click data needed to count the account creation.
90 days
guardiso_konto_probne
Guardiso. A one-time note that a trial account has just been created. Removed once it has been passed to Google.
Up to 30 minutes
Google may also store its own cookies on its own domain, for example doubleclick.net. Google processes the ad click data as a separate controller, under the terms of its own privacy policy. You can withdraw your consent at any time in the cookie settings. After you withdraw it, we delete the cookies listed above and reload the page.
4. Third-party Cookies
During Google OAuth login, Google may set its own cookies as part of the authentication process. These cookies are subject to Google's privacy policy: