Cookie Policy
Version July 2026
1. Introduction
This Cookie Policy explains how Cardo AI uses cookies, trackers and similar technologies, including browser local storage, across:
- our website at cardoai.com; and
- the Cardo AI platform, the authenticated application used by our clients.
These are covered separately below, because they use different technologies for different purposes. This processing is carried out by the Cardo AI group as data controller.
What are cookies?
Cookies are small text files stored on your device by your browser, which may contain certain information, sometimes including personal data. Alongside cookies, applications may use other technologies that read or write information on your device, most commonly browser local storage, which serves a similar purpose but is not a cookie. Where this policy refers to “trackers”, it means cookies and these similar technologies together.
2. Types of trackers we use
We categorise trackers according to their purpose:
- Necessary (technical and operational): required to operate and deliver the service and to keep you signed in securely. These are strictly necessary and cannot be switched off.
- Preference: remember your settings, such as language preferences.
- Statistical / analytical: help us understand how our website and platform are used so that we can improve them. In the platform tables below, these are identified by their consent group, either Analytics / Performance or Analytics / Functional.
- Marketing: used in connection with our marketing activities.
We also distinguish trackers we manage directly (first-party trackers) from those that enable services provided by a third party (third-party trackers). Unless otherwise stated in this policy, third-party providers may access the trackers they manage.
Because the use of third-party trackers cannot be fully controlled by Cardo AI, any specific references to them should be considered indicative. For complete information, please consult the privacy policies of the third-party services named in this policy.
3. Cookies on our website (cardoai.com)
Our website uses necessary, preference, statistical and marketing cookies.
A full and current list, showing each cookie’s name, category, purpose and duration, is available through the cookie preferences button in the bottom-left corner of any page on this website. You can grant or withdraw your consent for non-essential categories there at any time.
4. Cookies and similar technologies on the Cardo AI platform
The Cardo AI platform is the authenticated application used by our clients. It uses a narrower set of technologies than our website, and does not use any advertising or marketing trackers.
4.1 Necessary: authentication
| Name | Type | Purpose | Duration |
|---|---|---|---|
| AUTH_SESSION_ID | Cookie | Identifies the current authentication session, including cluster-routing information. | Session (deleted when the browser is closed) |
| KC_AUTH_SESSION_HASH | Cookie | Detects changes to the authentication session during login. | Approximately 60 seconds |
| KC_RESTART | Cookie | Allows an interrupted login to be restarted. | Session |
| KEYCLOAK_IDENTITY | Cookie | Single sign-on identity cookie that keeps you signed in across the platform. | Session |
| KEYCLOAK_SESSION | Cookie | Supports single sign-on session-status checks between the application and the identity provider. | Up to 10 hours (bounded by the maximum single sign-on session) |
The platform’s authentication tokens are held in the application’s memory for the duration of your session. They are not written to browser local storage or to any other persistent storage on your device.
4.2 Statistical / analytical: Pendo
We use Pendo to understand how the platform is used so that we can improve it. Pendo acts as a processor on our behalf.
Pendo stores information in your browser’s local storage rather than in cookies.
| Name | Consent group | Purpose | Duration |
|---|---|---|---|
| _pendo_visitorId | Analytics / Performance | Identifies you as a visitor so that usage activity can be attributed consistently across visits. | Approximately 100 days |
| _pendo_accountId | Analytics / Performance | Associates usage events with your organisation’s account. | Approximately 100 days |
| _pendo_meta | Analytics / Performance | Stores a metadata hash used to detect changes to visitor and account information. | Approximately 100 days |
| _pendo_sessionId | Analytics / Performance | Groups usage events into a single analytics session. | Session |
| _pendo_utm | Analytics / Performance | Records the channel through which a visitor arrived, for attribution purposes. | Persists with the visitor record |
| _pendo_guides_blocked | Analytics / Functional | Caches whether an ad-blocker is preventing in-app guides from displaying correctly. | Approximately 30 minutes, up to 4 hours |
The names above are shown in base form; as stored, each key also carries a suffix identifying our Pendo subscription. These items are scoped to the cardoaiapps.com origin. Browser local storage is partitioned by origin, so information written here cannot be read by Pendo, or by any other party, on a different website. Consent given for analytics on the Cardo AI platform does not extend to Pendo’s use on any other site.
Consent
If you have not yet set your cookie preferences, a consent banner is shown within the platform. You can choose to accept only necessary cookies, or to accept optional cookies as well. Pendo is not loaded and nothing is written to your device unless you have explicitly given consent. You can change your choice at any time, as described in section 5.
Personal data
The visitor identifier used by Pendo is your platform account identifier, which is your email address. Pendo therefore processes personal data on our behalf. Pendo also receives technical information such as your browser type and version, operating system, and approximate location derived from your IP address. Pendo’s own cookie policy is available at www.pendo.io/legal/cookie-policy.
4.3 Error monitoring: Sentry
We use Sentry for front-end error monitoring and performance reporting. The Sentry software does not store anything on your device: it sets no cookies and writes nothing to browser local storage or session storage. Session replay is not enabled. Error and performance events are transmitted to Sentry, which acts as a processor on our behalf. Sentry’s privacy policy is available at sentry.io/privacy.
4.4 What we do not use
The Cardo AI platform does not use advertising cookies, marketing or tracking pixels, cross-site tracking, session-replay recording, or device fingerprinting.
5. How to manage your preferences
Website
Use the cookie preferences button in the bottom-left corner of any page on cardoai.com to grant or withdraw consent for non-essential categories.
Cardo AI platform
Where you have not yet set a preference, a consent banner is shown within the platform, allowing you to accept only necessary cookies or to accept optional cookies as well. You can change your choice at any time from your account page at id.<tenant>.cardoaiapps.com, using the Consent Optional Cookies setting. You can also contact our Data Protection Officer at dpo@cardoai.com.
Browser and device settings
You can block or delete cookies, and clear local storage, through your browser or device settings. Please note that blocking necessary cookies will prevent you from signing in to the platform.
You can find guidance on managing cookies for the most commonly used browsers at the following addresses:
- Google Chrome
- Mozilla Firefox
- Apple Safari
- Microsoft Edge
- Brave
- Opera
You may also be able to manage certain categories of trackers through your device settings, for example the tracking or advertising settings on a mobile device.
6. Consent
Necessary trackers do not require your consent, as the service cannot be provided without them.
Where consent is required, it can be freely withdrawn at any time using the methods described in section 5. You are free to decide whether or not to give consent. Where you do not, some features that rely on those trackers may be unavailable. Declining analytics trackers will not affect your access to the platform or the core functionality of the service.
7. Contact
This policy is issued by Cardo AI Corporation, 4 World Trade Center, Suite 2909, New York, NY 10007, United States, acting as data controller.
If you have questions about this policy, or about how we use cookies and similar technologies, you can contact our Data Protection Officer at dpo@cardoai.com.
8. Change register
- 07/2026: Trackers used by the Cardo AI platform documented
- 11/2025: Version issued.
- 11/2024: Complete revision of the previous policy.
COOKIE LIST
Necessary
Necessary cookies are required to enable the basic features of this site, such as providing secure log-in or adjusting your consent preferences.
| Cookie | Duration | Description |
|---|---|---|
| cookieyes-consent | 1 year | CookieYes sets this cookie to remember your consent preferences so they are respected on subsequent visits. It stores a consent identifier and your accept or reject choice for each cookie category on this site |
Analytics
Analytical cookies are used to understand how visitors interact with the website. These cookies help provide information on metrics such as the number of visitors, bounce rate, traffic source, etc.
| Cookie | Duration | Description |
|---|---|---|
| ajs_anonymous_id | 1 year 1 month 4 days | This cookie is set by Segment to count the number of people who visit a certain site by tracking if they have visited before. |
| ajs_user_id | Never Expires | This cookie is set by Segment to help track visitor usage, events, target marketing, and also measure application performance and stability. |
Uncategorised
Other uncategorised cookies are those that are being analysed and have not been classified into a category as yet.
| Cookie | Duration | Description |
|---|---|---|
| loom_anon_comment | 1 year 1 month 4 days | No description available. |
| loom_referral_video | session | Description is currently not available. |
| __Host-psifi.analyticsTrace | 6 hours | Description is currently not available. |
| _Host-psifi.analyticsTraceV2 | 6 hours | Description is currently not available. |