Cookie Policy

This policy should be read together with the Privacy Policy. It describes the technologies implemented by the current web application source. The optional Google Tag Manager container is configurable and may change the list of third-party tags; any new non-essential technology must be reflected in this policy before it is activated.

1. What cookies are

Cookies are small text files or similar identifiers stored on, or accessed from, your browser or device. Similar technologies include browser session storage and scripts that read or write identifiers without using a traditional cookie.

Cookies may be first-party, set by AskPAi, or third-party, set by a provider whose technology is loaded on the site. This policy identifies the first-party cookies currently implemented in the application and explains how optional third-party tags are handled.

2. Cookies used by AskPAi

The application uses first-party cookies for authentication, OAuth security and requested referral or invitation flows. These cookies are not used to create advertising profiles. Cookie names may receive the __Secure- or __Host- prefix when the site is served over HTTPS.

The session and security cookies are required for the requested sign-in or service functionality. The referral cookie is only created after a referral link supplies a valid ref value and is not needed to browse the site or use the core assistant. Where applicable law treats referral attribution as non-essential tracking, it is used only after the required consent has been obtained.

3. Browser storage and events

The login hand-off also uses the sessionStorage key pai_analytics_login_queued. It stores only a short-lived flag in the current browser tab so the login event can be sent after the one-time callback URL has been left. It is removed as soon as that event is dispatched and is not a persistent cookie.

When a Google Tag Manager container is configured for the deployment, the application can send limited events to its data layer, including page navigation, calls to action, sign-in start, login, assistant creation, provider-step completion and Telegram or onboarding completion events. The event payload is limited to the parameters needed for measurement, such as the action name, method or selected step.

The source code does not hard-code Google Analytics, Meta Pixel, advertising or session-replay scripts. Google Tag Manager is a tag-delivery layer; the cookies and recipients created by any downstream tags depend on the separately managed container configuration.

4. Optional analytics and marketing technologies

An optional GTM container may be disabled entirely. When it is enabled, analytics, advertising or other non-essential tags may be published only where they have the required consent and configuration. Depending on the tags enabled, they may set or read third-party or first-party identifiers such as Google Analytics cookies or advertising cookies.

Because the container is configurable outside this application repository, the exact name, provider, purpose and duration of an optional cookie may vary by deployment. The live consent interface and this policy must be kept aligned with the tags that are actually published.

5. Legal basis and consent

Strictly necessary cookies are used to provide a service explicitly requested by you, maintain security and complete authentication. They do not require prior consent where the applicable law recognises the relevant exemption, but we still provide this information.

Analytics, profiling, advertising and other non-essential cookies or tracking technologies are used only on the basis required by applicable law, normally after your prior, specific and informed consent. Refusing optional technologies does not prevent access to the public site or the core service, although some optional features may not work.

Consent must be as easy to withdraw as it was to give. We do not treat mere scrolling, continued browsing or a preselected option as consent.

6. How to manage cookies

You can delete or block cookies through your browser settings. Blocking strictly necessary cookies may prevent sign-in, OAuth security checks or other requested functionality from working correctly.

If the live site displays a consent banner or preference centre, you can use it to accept, reject or withdraw optional categories. Browser controls and the preference centre act independently: deleting a cookie does not necessarily withdraw a consent record, and withdrawing consent does not automatically delete every cookie already stored by your browser.

7. Third-party providers

Where optional tags are enabled, Google and any other provider configured in the GTM container may receive information from the browser or data layer and may process it under their own privacy notices. Review the provider information shown in the consent interface before accepting an optional category.

The authentication and referral cookies listed above are set by AskPAi or its backend on behalf of Exilon S.r.l.; they are not third-party advertising cookies.

8. Updates and contact

We may update this Cookie Policy when the application, the GTM container, the consent mechanism or applicable law changes. The effective date at the top of this page identifies the current version.

For questions about cookies, tracking or the exercise of your data-protection rights, contact privacy@askpai.com.

Exilon S.r.l., Italy. Website: askpai.com