Cookie Policy

Service: Cernio (getcernio.com, www.getcernio.com, app.getcernio.com) Controller: GADULABS YAZILIM LİMİTED ŞİRKETİ (a Turkish limited liability company), Mustafa Kemal Paşa Mah. Yalova-Bursa Yolu Cad. A Blok 1. Kademe No: 123/1 İç Kapı No: 10, Merkez / YALOVA, Türkiye; trade registry no. 14632; MERSIS no. 0388200542700001; tax office Yalova, tax ID 3882005427. Data protection contact: privacy@getcernio.com Effective date: 18 October 2026

In short

• We use necessary cookies and browser storage to sign you in, keep your settings, remember your cookie choice, protect the contact form and account forms against bots and diagnose application errors with masked error replay (see Section 2.1). They work without your consent.
• Optional analytics — Google Analytics on the website and in the application, PostHog product analytics in the application, and Microsoft Clarity session replay in the application only — run only after you choose to allow analytics. Nothing from these services is loaded in your browser before that choice. Separately, our servers send PostHog a small set of pseudonymous product events without using your browser; see Section 3.3 and the Privacy Policy.
• One choice covers all three sites: getcernio.com, www.getcernio.com and app.getcernio.com. You can change it at any time from "Cookie preferences" in the footer of either site.
• Creating an account or accepting the Terms of Service is not consent to analytics.

1. What cookies and browser storage are

A cookie is a small text record that a website asks your browser to keep and send back on later visits. Browser storage (local storage and session storage) is similar, but it stays in your browser and is not sent with every request. We list both here because both can remember something about you.

2. Necessary cookies and storage

These support sign-in, your settings, security and application error diagnostics, including masked error replay (see Section 2.1). They need no consent and cannot be switched off individually. Deleting sign-in or settings records in your browser can sign you out or reset your settings.

Browser storage used by the application, all first-party and never sent to an analytics provider: theme (your light/dark choice), cernio.auth.rememberEmail (your e-mail address, only if you tick "Remember me" on the sign-in form), cernio_onboarding_banner_dismissed (whether you closed the setup banner), gadulabs.auth-cache.v2 (a session-only cache of your workspace role), session-only working state for the current tab, and cernio_consent_changed (a timestamp that tells your other open tabs that your cookie choice changed).

The website (getcernio.com) sets no cookie and stores nothing until you make a cookie choice. The one exception is the contact page: when you submit a valid message, Google reCAPTCHA loads and Google sets the necessary _GRECAPTCHA cookie on www.google.com (see the table above).

2.1 Error diagnostics

Sentry error diagnostics. In the application, Sentry sends a session replay only when an error occurs; general session sampling is disabled. The purpose is to diagnose and fix application failures, independent of your optional analytics choice. All text and inputs are masked, and media are blocked before transmission. The browser buffers browser interactions before an error; if an error occurs, that context is sent and Sentry continues recording after the error until the replay session ends. Technical context includes page addresses, navigation and network metadata; we filter secrets from URLs and scrub error data. Replays are stored in the EU (Germany). Retention follows the Sentry plan in effect when the replay is received: Sentry documents default replay retention of 30 days on the Developer plan and 90 days on paid plans (Sentry retention periods).

3. Optional analytics (only after you allow them)

3.1 Google Analytics — website and application

• Provider: Google Ireland Limited / Google LLC (USA). See Google's privacy and cookie documentation for how Google processes the data.
• Cookies on our domain: _ga and _ga_ followed by our property identifier. Google documents both with a lifetime of 2 years (Google cookie reference, checked 18 September 2026).
• What we send: fixed page names (for example "pricing" or "companies list"), your language, and a small number of named clicks such as a signup or contact-channel click. We do not send URL query strings, record identifiers, company or contact names, e-mail addresses, form contents or any free text. Screens that handle sign-in, account settings, billing or administration are reported only as a fixed category, never with their content.
• Advertising: our tag configuration denies advertising storage and advertising personalisation. We do not use Google Analytics for advertising.
• A click on a signup link is recorded as a click, not as a completed registration or purchase.

3.2 Microsoft Clarity — application only, ordinary product screens

• Provider: Microsoft Corporation (USA). See Microsoft Clarity's cookie list and privacy documentation.
• Where it runs: only in the application, only on ordinary product screens (dashboard, companies, contacts, leads, discovery, products and segment settings), and only after you allow analytics. It is not loaded on sign-in, password, account and security settings, pricing and billing, or administration screens, and it is never loaded on the website.
• What it does: records how the interface is used (clicks, scrolling, page movement) so that we can find usability problems. Text shown on the screen and anything you type are masked in recordings. The address of the page you are on and the destination of a link you click are sent with the recording; on a company, contact or lead detail screen that address contains the record's name or identifier.
• Cookies on our domain: _clck (persists a pseudonymous Clarity user identifier and preferences) and _clsk (links page views into one session). Microsoft may additionally set CLID, ANONCHK, MR, MUID and SM on its own domains; these are third-party cookies that Microsoft controls (Microsoft cookie list, checked 18 September 2026).

3.3 PostHog — application only, product analytics

• Provider: PostHog Inc. (USA); data stored in PostHog's EU region (Frankfurt). See PostHog's privacy documentation.
• Where it runs: only in the application, and in your browser only after you allow analytics. It is never loaded on the website. It does not record sessions or heatmaps.
• What your browser sends after you allow analytics: fixed screen names (the same fixed names as Google Analytics, never page addresses with record names or identifiers), the time until search results first appear, whether you leave a page while a search is running, and the pseudonymous identifiers of your user account and organization with your role and language. It does not send what you type, text on the screen, company or contact names, e-mail addresses or free text.
• How it reaches PostHog: through a first-party subdomain of getcernio.com operated by PostHog for us. Your sign-in cookies are never sent to it, because they are set only on app.getcernio.com.
• Browser storage, no cookies: PostHog keeps its state in your browser's local and session storage, under ph_<project-token>_posthog, ph_<project-token>_posthog__*, ph_<project-token>_window_id, ph_<project-token>_primary_window_exists, ph_<project-token>_session_registered_properties and __ph_opt_in_out_<project-token> keys (a pseudonymous PostHog identifier and settings). It sets no cookie on our domain.
• Server events are separate: our servers send PostHog a small, fixed set of pseudonymous product events for every user (for example "discovery search finished"), under our legitimate interest and without any browser storage. Your cookie choice does not control them; you can object to them as described in Section 4 of the Privacy Policy. The send filter keeps only the approved event properties, our account and organization IDs, role and language, plus technical event identifiers and the public project token. It removes page addresses, referrers, browser and device properties.

4. Making and changing your choice

• First visit. A bar at the bottom of the page offers Accept all, Reject optional and Manage preferences. Until you choose, optional analytics stay off. Closing the bar, scrolling, continuing to browse, switching language or waiting is not a choice and grants nothing.
• One choice for all three sites. Your choice is stored once for getcernio.com, www.getcernio.com and app.getcernio.com. A tab that is already open on the other site picks it up when you return to it, or within a few seconds while it is visible.
• Changing your mind. Open "Cookie preferences" in the footer of the website or the application. Saving a new choice replaces the old one immediately on that page.
• Withdrawing. When you switch analytics off, optional services are not started again, and we delete the analytics cookies and browser storage we control on our domain (_ga, _ga_…, _clck, _clsk and the PostHog ph_… storage keys). We cannot delete cookies that Google or Microsoft set on their own domains, and withdrawing does not delete data those providers already received; see Section 10 of the Privacy Policy for the rights you can exercise, and the providers' own tools for their cookies.
• When you are asked again. Your choice expires after 365 days. If this Policy changes in a way that matters — a new optional purpose or provider — we ask again; wording corrections do not.
• If storage is unavailable. If your browser refuses cookies or storage, we cannot remember your choice. We tell you so, and optional analytics stay off.

5. Changes to this Policy

We may update this Policy when the cookies or providers change. The "Effective date" indicates the latest version. A material change resets your stored choice so that you can decide again.

6. Contact

• Data protection: privacy@getcernio.com
• Controller: GADULABS YAZILIM LİMİTED ŞİRKETİ, Mustafa Kemal Paşa Mah. Yalova-Bursa Yolu Cad. A Blok 1. Kademe No: 123/1 İç Kapı No: 10, Merkez / YALOVA, Türkiye

This Policy is provided for transparency and does not constitute legal advice.