Cookies

We use cookies and similar browser storage to keep our product working, improve performance, and keep your experience consistent.

This page explains what we store and how we handle consent.

In short

• We use first-party storage on your site domain.
• We store anonymous identifiers, not direct personal details like your name or email in these cookies.
• We read consent from your consent manager (for example GA4 Consent Mode, Shoptet, or Didomi).
• If consent is not granted, we use temporary storage instead of persistent cookies.

What we store

Depending on tenant setup, the product may use:

Cookie settings used by product code:

• First-party scope on your site domain (top-most accessible domain by default unless overridden).
• Path: / (unless overridden).
• SameSite: Lax.

Consent managers must not delete our cookies

Some consent managers, such as Cookiebot, delete cookies they don't recognize or that the visitor hasn't consented to. They may do this on every page load or whenever the visitor changes consent. The Data Collector can't tell a deleted cookie from a first visit, so it starts over:

• _sa deleted: the visitor gets a new zoeId. One visit is split across several anonymous visitors, recommendations lose the visitor's browsing history, and purchases can no longer be attributed to earlier clicks on Perselio widgets.
• _saexp deleted: the visitor is assigned an experiment group again at random. They can move between the control and treatment groups within one visit, so Perselio widgets appear on one page and are gone on the next, and their events end up in more than one group. That makes A/B test results unreliable.

Configure your consent manager to leave _sa and _saexp alone, including any tenant-specific names such as _saexpe. Most consent managers let you do this by assigning the cookies to a category or by excluding them from automatic deletion. You don't need your consent manager to remove _sa when consent is denied: the Data Collector already reads the consent state and switches _sa to temporary storage by itself (see What happens when consent changes). Which category fits is your call under your own privacy policy.

Reading _sa on your backend

_sa is not HttpOnly, so it is sent to your server with every request and can be read there. Its value is the zoeId verbatim — no decoding or mapping is needed — in the format <version>.<randomId>.<firstVisitTimestamp>, for example SA1.aB3xY7qZ.1755500000.

This matters when you call the Perselio API from your own backend: you pass that value through as the zoeId field. See User Identification for the full contract and the rules to follow (including what to do when the cookie is not there yet).

How we detect consent

Consent is detected through the consent platform configured for each tenant. The goal is to follow the consent signal already present on the website and apply that signal consistently to identifier storage behavior.

GA4 / Google Consent Mode

When Google Consent Mode is used, consent is read from updates pushed into window.dataLayer. The primary signal is analytics_storage, where a value of granted allows persistent analytics identifiers and a value of denied prevents that behavior.

Shoptet Consent

When Shoptet consent is available, consent is read from cookie_consent.analytics in window.dataLayer (or from another configured purpose key if a tenant uses one). This value is interpreted as the source of truth for analytics-related consent.

Didomi

We also support Didomi CMP to determine the current consent state. It also listens Didomi's events so any user update in the banner is reflected in product behavior without requiring a page reload.

What happens when consent changes

• If consent is granted, identifier storage can use cookies.
• If consent is denied (or unavailable after initialization timeout), storage falls back to session or memory.
• If consent is unknown at startup, a cached consent signal may be used briefly and then updated once CMP data is available.
• When consent changes, storage behavior updates automatically.

Your choices

• You can change consent anytime in your site's cookie banner / CMP.
• You can clear cookies and browser storage in browser settings.

Tenant note

Tenant configuration can change cookie names, domain/path, storage mode, and retention periods. Keep this document together with your tenant-specific legal/privacy cookie disclosures.