Cairn Cookie and Storage Policy

Version: cookies-1.0.0. Effective date appears with the published release.

Cairn LLC uses functional storage to operate its business service. The portal and marketing applications may set a session cookie and XSRF-TOKEN for secure sessions and request validation. Sessions expire according to the application settings (normally two hours) and sign-out invalidates the active session. Cloudflare may set __cf_bm for edge bot/security protections, normally for 30 minutes. These cookies are not an advertising profile.

The embedded widget may retain its visitor/session identifier and selected UI or experience state in browser storage to preserve support continuity. Browser storage can remain until cleared, expiry or a workspace/widget reset, depending on the item. Signed identity comes from the customer's backend and must be cleared on sign-out or account changes. Capture extension tokens live in extension storage, not a visited page, and sign-out removes them.

Optional experience enhancements, analytics/event tracking, campaign open/click tracking and recording are separate capabilities. The embedding customer must map each to its applicable notice and consent controls, including withdrawal, rather than treating Terms acceptance as consent. For the business pilot, chat is the disclosed support function; tours require experience-enhancement permission. Optional event/analytics tracking must remain off until the governance decision and implementation support it.

You may clear cookies/storage or configure your browser to block them, but functional sign-in, continuity and security can stop working. Contact privacy@cairn.how for privacy requests. We do not use these functional mechanisms to sell personal data or conduct cross-context behavioral advertising. The release evidence should be rechecked when introducing an external script or changing a storage purpose.