Cookie policy

Last updated: 2026-10-15.

We use a small number of cookies and two browser local-storage entries. The ones that are strictly necessary for the site to work and the ones used for aggregate measurement do not require your prior consent. The Meta pixel's advertising cookies (_fbp and _fbc) are different: they only exist if the pixel is active, outside the United States only if you accept them, and in the United States unless you opt out on the privacy choices page or your browser sends the Global Privacy Control signal. This policy is incorporated into our privacy policy by reference.

What a cookie is

A cookie is a small text file a website stores in your browser when you visit it, which that same site can read on later visits. It's how a site "remembers" something from one visit to the next: that you're already logged in, which campaign you came from, or your theme preference. Browser local storage ("localStorage") is a similar technology that doesn't automatically travel to the server with every request the way a cookie does; we use it for your theme preference and to recognize your conversation with the support chat.

First-party cookies and third-party services

The cookies we set ourselves are first-party cookies: they're only read on our own domain and no third party can read them. The exception is _fbp and _fbc: they are created by the Meta pixel, a third-party script, and Meta can read them. They only exist if the pixel is active. No advertising pixel is active on this site today. When it is active, the conditions in the "Advertising (Meta pixel)" section of this policy and on the privacy choices page apply.

Two more services load in your browser without setting cookies of ours. Turnstile, Cloudflare's anti-bot check, loads from challenges.cloudflare.com on the signup, contact and password-recovery forms, on login after several failed attempts and, if you aren't logged in, the first time you use the support chat; it reads signals from your browser to tell a person from a robot and we don't use it for advertising. The support assistant loads from soporte.ismiro.com, a subdomain of ours, and its only local-storage entry is soporte_anon (see the table).

Session cookies and persistent cookies

A "session" cookie deletes itself when you close your browser (for example, __Host-adm). A "persistent" cookie stays stored for a fixed period even after you close the browser, until it expires or you delete it yourself (for example, __Host-sid, attr, vid, and consent, each with the duration shown in the table below).

Cookie and storage table

Why we don't show a blocking cookie banner

Many sites show a banner that blocks content until you accept or reject cookies. We don't use that pattern for our own cookies because none of them requires your prior consent under applicable law: they are either strictly necessary to operate the site (__Host-sid, __Host-adm, lg_email, g_oidc, g_alta) or used for aggregate measurement that doesn't identify you individually to third parties (attr, vid, consent). A blocking banner would, in that context, be friction without real benefit to you. The Meta pixel's advertising cookies are different: No advertising pixel is active on this site today. When it's active, outside the United States you see a notice to accept or reject it before it loads, and in the United States it loads unless you opt out on the privacy choices page or your browser sends the Global Privacy Control signal.

Detail of each cookie

__Host-sid: your logged-in session

It's the site's most important cookie: without it, you can't stay logged in. It's httpOnly, meaning no script on the page (not even a malicious one injected by a third party) can read it from JavaScript. It expires after 30 days, or sooner if you manually log out from your security panel. The __Host- prefix in the name is a browser protection: the session cookie carries it so that it is only sent over a secure (HTTPS) connection, only to the exact site that set it, and is not shared with any subdomain, so no other subdomain can replace it. It was previously called sid.

__Host-adm: internal admin access

Only used by our own team's accounts to access the internal admin dashboard (/admin). If you don't work for us, this cookie is never set in your browser.

attr: which campaign you came from

Set on your first visit to the site and stores the utm_source, utm_medium, utm_campaign, utm_content, and utm_term parameters if you arrived from a link that included them, plus the referring page and your approximate country. If the Meta pixel is active and only if advertising is permitted for you (Section 15 of the Privacy Policy), it also stores the click identifier (fbclid) that Meta adds to its ads' links; if you accept advertising later, your next click from a Meta ad adds it to this same cookie. It's not overwritten on later visits: we care about knowing where you came from the first time, not updating it every time you come back.

vid: visitor identifier

A random, opaque value that contains no personal information on its own; it just lets us avoid counting you twice when measuring how many visitors reach each stage of the purchase process (view product, start checkout, sign up, purchase).

consent: your advertising choice

Stores whether you chose "allow personalized advertising" or "do not sell or share my data" on the privacy choices page or in the site notice. When the Meta pixel is active, this cookie decides whether it loads: with "do not sell or share my data" it never loads.

lg_email: the email from your last login attempt

When you try to log in, it stores the email you typed for 10 minutes, only for the login page. It serves two purposes: showing it again in the field if the attempt fails, and knowing whether you have already failed several times with that email so we then ask you for the anti-bot check. It's deleted when you log in.

g_oidc and g_alta: signing in with Google

They are only set if you choose to sign in with your Google account, and they only travel to /auth/google. g_oidc stores, signed and for 10 minutes, the one-time security values that check that whoever returns from Google is whoever started the sign-in. g_alta appears only if you don't have an account yet: it stores, signed and for 15 minutes, the email, name and Google account identifier that Google returned to us, while you enter your company name and accept the legal documents. Both are deleted when it's done.

theme: your visual theme

Not a cookie: it's a localStorage entry that lives entirely in your browser and is never sent to our servers. It remembers whether you chose light or dark theme.

soporte_anon: the support chat without a session

It isn't a cookie either: it's a localStorage entry in your browser. The support assistant creates it when you use the chat without being logged in: a random identifier that travels to our support server (soporte.ismiro.com) with your messages, to recognize your conversation. If you're already logged in, the chat uses your account and doesn't need it.

Cookies and the Offline Quoter

Only for whoever bought it before September 23, 2026, when we stopped selling it.

The Offline Quoter, once downloaded, is a file you open directly in your browser without going through our site: it doesn't set any of the cookies in this table, because it doesn't connect to our servers. It may use its own browser local storage to remember data you load inside the file yourself (for example, your price catalog), but that stays entirely on your device and isn't covered by this policy because it isn't part of this website.

Cookies if you sign up for the Sales Agent

The Sales Agent does not set additional cookies of its own beyond those in this table: it operates over the messaging platforms in your plan (Messenger or Instagram, and WhatsApp once it is available), which have their own policies. It is not offered today as a widget for your website; if it ever is, any cookies it needs will be documented here before it goes on sale.

Strictly necessary

These can't be turned off because the site doesn't work without them: __Host-sid (your session), __Host-adm (admin access, internal team only) and the short-lived login ones: lg_email, g_oidc and g_alta.

Purchase funnel measurement

attr and vid help us understand which campaign brought a visit and which part of the buying process works, without identifying you personally to third parties. You can block them from your browser's cookie settings; the site keeps working, we just lose attribution for that visit.

Preferences

consent stores your choice about personalized advertising, theme (local storage, not a cookie) your visual theme preference and soporte_anon (local storage, not a cookie) the identifier of your conversation with the support chat.

Advertising (Meta pixel)

No advertising pixel is active on this site today. When it's active, the Meta pixel uses its _fbp and _fbc cookies (table above) to measure our ads and show you relevant ads on other platforms. Outside the United States it only loads if you accept it in the site notice or on the privacy choices page. In the United States it loads unless you opt out on that page or your browser sends the Global Privacy Control signal, which we always honor.

How to control cookies

Besides the privacy choices page, you can delete or block cookies from your browser settings at any time. Blocking the strictly necessary cookies (__Host-sid, __Host-adm) prevents logging in or accessing the admin dashboard. Most modern browsers (Chrome, Firefox, Safari, Edge) have a "Privacy and security" or "Cookies and site data" section in their settings where you can view, delete, or block cookies by site; the exact menu name varies by browser and version.

Effect of blocking each category

If you block __Host-sid or __Host-adm, you won't be able to log in or access the admin dashboard: the public site (product pages, legal pages, contact) keeps working the same. If you block attr or vid, the site works exactly the same for you; we just lose the ability to know which campaign you came from or to count you once in our purchase funnel metrics. If you block consent, we'll ask you your advertising preference again on every visit to the privacy choices page, instead of remembering it. If you block g_oidc or g_alta, you won't be able to complete the Google sign-in; if you block lg_email, you just stop seeing your email filled in after a failed attempt. Blocking theme (local storage) means the site won't remember your preferred theme between visits, and blocking soporte_anon means the support chat won't recognize your earlier conversation.

Browser signals: GPC and Do Not Track

If your browser sends a Global Privacy Control (GPC) signal, we treat it as a valid request to not sell or share your personal data, with the same effect as choosing that option on the privacy choices page. The older "Do Not Track" (DNT) signal has no uniform industry standard for what it exactly means, so we don't respond to it automatically; see the full detail in the corresponding section of our privacy policy.

Relationship with the privacy policy and privacy choices

This cookie policy is part of our privacy policy by reference, as stated in its Section 5. The button to opt into personalized advertising or to opt out of selling/sharing your data lives on the privacy choices page, which also sets the consent cookie described in the table above.

Basis for these descriptions

Every name, purpose, and duration on this page was verified against the Platform's actual code at the time of writing, not against a generic list of cookies a SaaS site "usually" has. If the Service adds or removes a cookie, this page is updated alongside the corresponding code change, per the changes section below.

Technical durability and browser changes

Modern browsers keep tightening cookie rules over time (for example, attributes like SameSite, or the phased removal of third-party cookies in some browsers). Since the ones we set ourselves are first-party and either strictly necessary or used for aggregate measurement, those industry changes (mostly aimed at curbing cross-site advertising tracking) shouldn't affect the normal operation of __Host-sid, __Host-adm, attr, vid, or consent. If a browser change ever did affect them, you'd notice it as a session that doesn't stay logged in; email us at soporte@ismiro.com if that happens to you.

Frequently asked questions

Do I need to accept cookies to buy something?

Yes, you need the __Host-sid cookie to log in and complete a purchase within your account. You can browse product pages without it, but checkout requires a logged-in account.

Can I browse the site with no cookies at all?

You can block all cookies from your browser and still see the public pages (product, legal, contact), but you won't be able to log in, purchase, or access your dashboard.

Do these cookies identify me to other companies?

The cookies we set ourselves are first-party (see above): only we read them and we don't share their content with advertisers or third-party networks. The exception is _fbp and _fbc, which the Meta pixel creates: they only exist if the pixel is active and loaded for you, and Meta does read those.

What happens if I clear my browser's cookies?

You'll be logged out (__Host-sid), lose your saved campaign attribution (attr), your visitor identifier (vid), and your advertising choice (consent, which we'll ask you again). Your theme preference (theme) and the support chat identifier (soporte_anon) are also cleared if you clear the site's data, because they live in the browser's local storage.

Changes to this policy

If we add a new cookie or change the purpose or duration of an existing one, we update this page's table before the change takes effect. If the change adds a category that requires your prior consent depending on where you are (for example, advertising outside the United States), we don't turn it on for you until you grant it; in the United States, where opt-out applies, we notify you first and you can opt out on the privacy choices page.

Business Creatives LLC (Delaware, USA) · ISMIRO. Questions: soporte@ismiro.com.