Legal
Cookie policy.
The cookies the elenn.ai marketing site and the authenticated dashboard set, what each one does, and how to change your choice. The chat widget you embed on your own site sets no cookies; its optional, opt-in analytics uses browser localStorage (elennai:analytics-id, elennai:analytics-consent) only after consent and is documented in the widget guide, not here.
The four categories
- Strictly necessary - always on. Covers the consent cookie itself and the dashboard session token. Cannot be turned off; without these the site does not work. "Always on" means we never ask before writing one, not that one is always there: each is written only when you do the thing that needs it.
- Functional - off by default. Reserved for UI-state cookies (sidebar collapse) when introduced. No functional cookie is wired today. The site does remember a handful of UI choices in your browser's own storage - light or dark mode, which filter you last picked, how many rows to sketch while a list loads - and those are listed in the browser-storage table below. They are written by the action you just took, stay on your device and are never sent anywhere, so the toggle above does not gate them; it governs cookies and anything that could leave your browser.
- Analytics - off by default. Gates our first-party product analytics on the elenn.ai domains: when you opt in, the page sends page views, clicks and scroll depth to our own
/api/eventsendpoint on the same domain. No third party is involved, and the beacon itself sets no cookie and no browser storage of any kind. On our servers each event is stored with your IP address and browser user-agent for 14 days; after that only identifier-free aggregates remain. Opting in also allows theel_abcookie in the table below, which is set only while we are testing two wordings of a page you visit, and only to keep you on the same version and see which one led to a sign-up. - Marketing - off by default. No retargeting pixel, ad network or third-party marketing tag is wired, here or anywhere else on the site. One marketing-purpose value is kept on your device:
el-newsletter-seen, the flag that stops the newsletter card being offered to you twice. It holds no email address, it is never sent anywhere, and it exists only so we ask once - see the browser-storage table below.
Cookies we set today
| Cookie | Category | Purpose | Lifetime | Set when | Provider | Set by |
|---|---|---|---|---|---|---|
el_ab | Analytics | Assigns this browser to one version of a page when Elennai is testing two wordings, so the same visitor keeps seeing the same version, and lets us tell which version led to a sign-up. It is a random identifier we generate; it holds no name, email or anything you typed, and it is never shared with anyone else. | 90 days | When you allow analytics cookies and Elennai is testing a page you visit | Elennai | first-party |
cookie_consent | Strictly necessary | Stores the visitor's cookie-consent choice (which categories are allowed) in a first-party cookie scoped to elenn.ai, so one decision applies across the marketing site and the dashboard. | 12 months | When you make a cookie-consent choice | Elennai | first-party |
That is the whole cookie list, and neither one is there until you make a consent choice. cookie_consent records that choice, and it is not there until you make a consent choice either; clicking "Withdraw all" deletes it again, which is why the banner reappears afterwards. el_ab is set only if you allow Analytics AND you land on a page we are currently testing, so most visitors who opt in never receive it either. No functional or marketing provider is wired today. What the site keeps in your browser by other means is listed in full in the next table - it is not a cookie, but you should still know it is there.
Browser storage we use
Not everything a site keeps in your browser is a cookie. The entries below live in localStorage: they stay on your device, are never attached to requests automatically, and no server - ours or anyone else's - can read them. We list them here anyway, because what matters to you is what is stored, not which browser API stores it. This is the complete list, and it is kept complete by a test that reads our own source code and fails the build if anything writes a key that is not described here. A key ending in * is a family of entries - one per list or per workspace - written the same way and holding the same kind of value.
| Key | Stored in | Category | Purpose | Lifetime | Set when | Provider |
|---|---|---|---|---|---|---|
elennai:auth-token | localStorage | Strictly necessary | Authenticated dashboard session token. Read by the app to authorise API calls; it is not attached to requests automatically and no server can read it. | Until you sign out (or 30 days when "Remember me" is selected) | Only after you sign in | Elennai |
el-newsletter-seen | localStorage | Marketing | A single flag recording that the newsletter card has already been offered to this browser, so you are asked at most once. It holds no email address and nothing about you - only that the card was shown and closed. | Until you clear your browser storage - it does not expire | When you close the newsletter card or subscribe from it, on the public site, before any sign-in | Elennai |
elennai:theme | localStorage | Functional | Which colour scheme you picked. It records the single word "light" for this browser so pages do not flash the wrong colours on the way in. It identifies nobody, holds nothing else, and is never sent anywhere. | Until you clear your browser storage - it does not expire | Only when you use the light/dark switch, on the public site or in the dashboard | Elennai |
elennai:prompt-updates:addressed | localStorage | Functional | The list of prompt-update suggestions you have already applied or dismissed, so the dashboard stops showing them. Stores the suggestions' ids, nothing you typed. | Until you clear your browser storage - it does not expire | When you apply or dismiss a prompt update in the signed-in dashboard | Elennai |
elennai:feature-requests:last-seen:* | localStorage | Functional | When you last opened the feature-request board, so the sidebar can show how many arrived since. One entry per workspace (the key ends with the workspace id) - a value is a timestamp. | Until you clear your browser storage - it does not expire | When you open the feature-request board in the signed-in dashboard | Elennai |
el-skeleton-count:* | localStorage | Functional | How many rows a list held the last time you looked, so its loading placeholder draws roughly the right shape instead of guessing. One entry per list (inbox threads, feature-request board, feature-request signals); each value is a small number, never any content. | Until you clear your browser storage - it does not expire | When one of those lists finishes loading in the dashboard | Elennai |
el:conv-excl-test | localStorage | Functional | Your "hide test chats" choice on the Conversations screen, so the filter survives a reload. Stores true or false. | Until you clear your browser storage - it does not expire | When you toggle "hide test chats" on Conversations | Elennai |
el:admin-conv-excl-test | localStorage | Functional | The same "hide test chats" choice on the internal Elennai support console, kept separately from the one above so the two screens do not overwrite each other. Stores true or false. | Until you clear your browser storage - it does not expire | When an Elennai operator toggles "hide test chats" in the support console | Elennai |
elennai:tester-session | localStorage | Functional | A random id for the chat tester inside the bot editor, so the messages you send while testing stay in one conversation instead of starting a new one on every reload. Not linked to a visitor of your own site. | Until you clear your browser storage - it does not expire | The first time you open the chat tester for a bot | Elennai |
elennai:ghost-session:* | sessionStorage | Strictly necessary | A random id that keeps one Elennai operator's support session with an agent together across turns, so their follow-up questions land in the same thread instead of starting a new one each time. One entry per agent (the key ends with the agent id); it holds nothing but the random id. | Until the browser tab is closed - it is kept in sessionStorage, so it never survives the tab | The first time an Elennai operator opens the support console's chat panel for an agent | Elennai |
elennai:widget-preview-session | localStorage | Functional | The same idea for the widget preview in the bot editor: a random id that keeps the preview conversation together across reloads. | Until you clear your browser storage - it does not expire | The first time you open the widget preview for a bot | Elennai |
Two entries can be written before you sign in: el-newsletter-seen, the once-only flag behind the newsletter card on this site, and elennai:theme, but only if you use the light/dark switch. Everything else in the table needs a signed-in dashboard session, so if you never sign in it is never written. Clearing site data in your browser removes all of them, and the only consequence is that the site forgets a few display preferences. The chat widget you embed on your own site uses its own localStorage keys, listed in the widget guide rather than here.
How to change your choice
Open the cookie banner at any time:
- From the marketing footer, click .
- From the authenticated dashboard, press Cmd+K and run "Cookie settings".
Inside the Customise modal, toggle each category and click "Save preferences", or click "Withdraw all" to clear every non-essential category at once. Your choice is stored in a first-party cookie_consent cookie scoped to elenn.ai - no third party is involved - so one decision applies across the marketing site and the dashboard, and is recorded in a server-side audit log (hashes only - no raw IP, no raw user-agent, no email).
Audit log + retention
Each consent decision (accept all, reject all, save preferences, withdraw) is POSTed to /api/consent/record and appended to consent_events. The row stores only salted SHA-256 hashes of the visitor's IP and user-agent, plus the country code, the categories chosen, the banner version, and the action. Raw IP, raw user-agent, and email are never stored.
Consent records are kept as proof that a choice was made, so they are retained for the life of that legal obligation rather than pruned on a fixed schedule, and they are kept even after the related account is closed. Because each row holds only the salted hashes above and no raw identifiers, it cannot be used to re-identify a visitor.