Last updated: October 2026
Cookies are small text files a website stores in your browser. This policy also covers similar technologies that do the same job, such as the scripts (often called tags or pixels) that set cookies and send information about your visit to the company that provides them.
These make sign-in, security and your cookie choice work. They are set by Sentsai itself, are never shared with anyone, and cannot be turned off without breaking the service. Under the GDPR, the UK PECR and similar laws they do not need consent.
sentsai_session_idStrictly necessary8 hoursAn opaque, cryptographically random session identifier (256 bits of entropy). The browser holds only this ID - the actual Microsoft access token and your tenant identity are stored server-side in a Redis session store. Set as HttpOnly and Secure; expires after 8 hours or on logout, whichever is sooner.sentsai_tenant_idStrictly necessary30 daysA reference to your organization used to identify your account in the browser for UI purposes. Your identity is always re-verified against the server-side session on protected requests - this cookie alone cannot authenticate any API call. Set as HttpOnly and Secure.oauth_stateStrictly necessary10 minutesA short-lived CSRF protection token (256-bit random value) set during the OAuth login flow and scoped to the /auth/callback path. Verified via constant-time comparison on callback, then immediately deleted. Prevents cross-site request forgery during the Microsoft authentication redirect.sentsai_consentStrictly necessary6 or 12 monthsRemembers your choice about the optional cookies below (accepted, rejected, or which kinds), when you made it, and a random identifier for the record of that choice, so the banner does not ask on every page and our sign-in can tell whether you refused advertising. Set by the public website (readable by script, so not HttpOnly), never by the app. Kept six months where we ask first, a year in the United States; then we ask again.Signing out clears the session cookies. You can also clear cookies in your browser settings at any time; doing so signs you out.
These are set only on the public website, only as described under “When we ask first” below, and never in the signed-in app. Most are set on our own domain (sentsai.com); the rows marked “on its own domain” are set on Google’s or Microsoft’s domains, which we can neither read nor delete.
_gcl_auGoogle Ads (advertising)90 daysLinks a later sign-up on this site to the Google ad that brought you, to measure which ads work._gcl_aw, _gcl_gb, _gcl_gs, _gcl_agGoogle Ads (advertising)90 daysHolds the identifier of the Google ad click that brought you, so a sign-up days later can still be credited to it.IDE, DSID, test_cookie, ar_debugGoogle (advertising), on its own domainUp to 13 months (EEA and UK), 24 months elsewhereSet on Google's own advertising domains (such as doubleclick.net) to show and measure ads, including ours to past visitors, and to check that cookies work._ga, _ga_<id>Google Analytics (analytics)2 yearsTells one browser from another and keeps a visit together, to count visits and pages read. Used only if Google Analytics is enabled._uetsidMicrosoft Advertising (advertising)1 dayKeeps the pages of one visit together, to measure ads and build audiences of past visitors. Also copied to your browser's local storage (_uetsid_exp)._uetvidMicrosoft Advertising (advertising)13 monthsRecognizes a returning browser across visits, to measure ads and show our ads to past visitors. Also copied to local storage (_uetvid_exp)._uetmsclkidMicrosoft Advertising (advertising)90 daysHolds the identifier of the Microsoft ad click that brought you, so a sign-up days later can still be credited to it._clckMicrosoft Clarity (session recording)1 yearKeeps a random Clarity identifier and settings for this browser, so later visits by the same browser are recognized._clskMicrosoft Clarity (session recording)1 dayJoins several page views into one recorded visit.MUID, MSPTCMicrosoft (advertising and session recording), on its own domain13 monthsSet on Microsoft's own domains (bing.com, clarity.ms). Identifies the browser to Microsoft across the sites that use its advertising and Clarity services.CLID, ANONCHK, MR, SMMicrosoft Clarity (session recording), on its own domainUp to 1 yearSet on Clarity's and Microsoft's own domains to recognize the browser and route data to Clarity.Advertising: Google Ads and Microsoft Advertising. These tags tell Google or Microsoft which of our pages you viewed and whether you arrived from one of our ads. We use this to measure which ads lead to sign-ups and to build audiences of past visitors, so our ads can be shown to them again on other websites and in search results. Third-party vendors, including Google and Microsoft, use cookies to serve ads based on your prior visits to this website or other websites; their use of advertising cookies lets them and their partners show you ads based on your visits to this and other sites. You can turn personalized advertising off with each company using the links below.
Analytics: Google Analytics, if we turn it on. Counts visits and shows which pages are read. If we use it, it runs with Google signals and data sharing off, and keeps data for two months.
Session recording: Microsoft Clarity. Only if you switch it on, in every country. We partner with Microsoft Clarity and Microsoft Advertising to see how you use and interact with our website, through usage statistics, heatmaps and session replay (a reconstruction of your clicks, scrolling and mouse movement on our pages), so we can find what is unclear and improve and market our service. Anything you type into a field on our website is masked before it leaves your browser. Website usage data is captured using first- and third-party cookies, and Microsoft also uses it for its own purposes, including site optimization, fraud and security, and advertising. For more about how Microsoft collects and uses your data, see the Microsoft Privacy Statement.
Microsoft collects personal data through the Microsoft Advertising and Clarity tags on our site. Google collects personal data through the Google tag; see how Google uses information from sites that use its services.
What the tags collect: the pages you view and the page that referred you, the ad click identifier if you came from an ad, your browser and device type, cookie identifiers, whether you pressed a sign-in, approval or “email your admin” button (with a fixed label for where it sits, such as “home-hero”), your interactions with our pages (Clarity), and your IP address, which the providers use to estimate an approximate location. They receive nothing from inside the signed-in app.
Google and Microsoft decide for themselves how to use what their tags collect, under their own privacy statements, and for that use each acts as an independent controller. For visitors in the EEA and the UK, Sentsai and each provider are jointly responsible for the collection itself on our pages and its transmission to them; Sentsai is your point of contact for that part, and you can exercise your rights with us or with them.
Outside the United States (including the EEA, the UK, Switzerland and all of Canada), no optional tag loads and no optional cookie is set until you press Accept, or switch a category on under Choose. This is what the GDPR and the ePrivacy rules, the UK PECR and Quebec’s Law 25 require, and we apply it to every visitor outside the US. We tell where you are from the time zone and languages your browser reports, which never leave your browser; we do not look up your IP address. If either looks non-US, or we cannot tell, we ask first. Google additionally applies its own “denied unless accepted” default to visitors whose IP address is in the EEA, the UK, Switzerland or Canada.
In the United States, where our advertising runs, advertising and analytics cookies are on from your first page, and the banner tells you so with a Reject button. Session recording still waits for you to switch it on. If your browser sends a Global Privacy Control signal, we treat it as Reject and load nothing unless you later choose otherwise.
Your choice is stored in the strictly necessary sentsai_consent cookie, for six months where we ask first and a year in the United States. After that, or if we change what the optional cookies are used for, we ask again. To be able to show what you agreed to, we also keep a record of each choice: a random identifier, what you chose, the version of the banner, whether your browser sent Global Privacy Control, and the time. It holds no IP address and nothing else about you, and we delete it after two years.
Use Cookie settings at the bottom of our pages (or in the corner, on pages without a footer) at any time. When you turn a category off, we tell its tags that consent is withdrawn, delete the cookies and local-storage entries they set on our domain, and reload the page without them. Withdrawing consent does not affect anything collected while it was given. You can also block or delete cookies in your browser, and turn off personalized ads with Google and Microsoft directly using the links above, or across many advertisers at once through the NAI, the DAA (United States) and DAAC (Canada) opt-out pages. Any advertising audience we create from visitors to this site keeps people for no more than 90 days after their last visit. Google Ads also keeps one audience it creates automatically, of people who reached us from Google Search or a Google ad, for up to 540 days under Google’s own rules; Google does not let us change or close it, and we do not use it to target ads.
Payments are processed by Stripe. When you click through to Stripe’s checkout, Stripe’s own cookie policy applies to that session. We do not control Stripe’s cookies.
We update this page whenever we change the cookies we use. If we add a new purpose for optional cookies, the banner asks you again before it applies.
Questions about cookies or privacy? Email us at privacy@sentsai.com. Our Privacy Policy explains the rest of what we do with personal data.