Cookie policy
Effective · Last updated
This Cookie Policy explains how Navos AI, Inc., trading as Pragmon AI ("we," "us," or "our") uses cookies and similar technologies on the pragmon.ai marketing website. It sits alongside and is incorporated into our Privacy Policy.
What are cookies?
Cookies are small data files a website can place on your device to remember things across page loads: your consent choices, an analytics ID, a booking session. They are widely used to make sites work and to understand how they are used. Cookies we set ourselves are first-party; cookies set by a third-party script loaded on our site (for example, Google Analytics or the Calendly booking widget) are third-party. We also use closely related technologies such as localStorage and sessionStorage, which are covered by the same consent rules under Art. 5(3) of the ePrivacy Directive.
Why we use cookies
On the marketing site we use cookies for five purposes:
- To remember your choices (your cookie choice and whether you closed the rename notice), so you are not asked on every visit.
- To count visits (analytics) if you accept.
- To replay sessions so we can fix what breaks (session recording) if you accept.
- To show the booking calendar on the start page (booking) if you accept.
- To identify the company you visit from (marketing, reverse-IP lookup) if you accept.
Three of these are active today: remembering your choices, analytics (Google Analytics) and booking (Calendly). Session recording (PostHog) and marketing (Apollo) are built but switched off. The banner does not show them, and nothing from either vendor loads. If we switch one on, it appears in the banner as its own category, we ask again, and it runs only if you accept it.
We do not use cookies for advertising, retargeting, or cross-site tracking.
Our consent model
The marketing site sets no non-essential cookies or storage, and sends no request to Google, PostHog, Apollo or Calendly, until you choose. Google Consent Mode v2 starts in the denied state: all four signals (analytics_storage, ad_storage, ad_user_data, ad_personalization) are set to denied by a short inline script that only queues commands in the page and contacts no server. The Google Analytics script is not loaded until you accept Analytics, and no cookieless ping is sent before then. If you reject, or have not chosen, nothing is sent to Google. The booking calendar loads only after you accept Booking. PostHog and Apollo load only if we have switched them on and you have accepted their category.
Banner design. Accept all, Reject all and Choose are three buttons of the same size, border, weight and colour, in line with EDPB Guidelines 03/2022 on deceptive design patterns. No switch is on until you turn it on. The site stays usable behind the banner.
Global Privacy Control. If your browser sends the Global Privacy Control signal, we treat it as a refusal of marketing. Marketing stays off even when you choose Accept all. You can still switch it on yourself in the panel.
Asked again. We ask again after six months, whether you accepted or rejected, and whenever we add, remove or change a category.
Proof of consent. Each choice you make is recorded so that we can demonstrate compliance with Art. 7(1) GDPR. A record holds a random identifier (the same one stored in your cc_cookie), the time, the banner version, the policy date, the categories you accepted and refused, how you chose (accept all, reject all, custom or withdraw), whether Global Privacy Control was on, and your browser family, operating system family and device type. It holds no IP address, and no name or email. Records are kept in a private store for 18 months, which is the six-month life of your choice plus 12 months, then deleted. To have a record found or deleted, send your identifier from cc_cookie to contact@pragmon.ai.
The five consent categories
The banner is built around five categories. Every category except Necessary is off until you turn it on, and you can grant or withdraw each one on its own. The table shows what each does, which cookies it sets and what is live now.
Not active means the vendor is off today, so nothing loads and the banner does not offer it.
- Necessary (active): two first-party cookies,
cc_cookie(your cookie choice) andpragmon_rename_notice(whether you closed the rename notice). Exempt from consent under ePrivacy Art. 5(3). - Analytics (active): Google Analytics 4 cookies for aggregate measurement. If PostHog is switched on, its page-view and form events sit in this category too.
- Session recording (not active): PostHog session replay. Kept separate from analytics because of CNIL's draft recommendation of February 2026 on session replay tools. The draft is not final.
- Booking (active): Calendly's embedded booking calendar on the start page. Calendly and the providers it loads set their own cookies.
- Marketing (not active): Apollo website tracker cookies, used to see which company a visit comes from.
Necessary
We set two first-party cookies without asking, because each is needed to do what you asked. Remembering a refusal is exempt from the consent requirement under ePrivacy Art. 5(3) ("strictly necessary for providing a service explicitly requested by the user"); so is remembering that you closed a notice.
Analytics (Google Analytics 4, requires consent)
The Google Analytics script loads only after you accept Analytics. If you accept, Google Analytics 4 sets the following first-party cookies on your device. We cap the lifetime of _ga and _ga_* at 13 months. Other names and lifetimes follow Google's defaults and can change with Google's configuration.
PostHog is off today. If we switch it on, accepting Analytics would also let PostHog (EU Cloud, Frankfurt) count page views and form submissions, and would set one first-party cookie of the form ph_<project-key>_posthog that lasts one year. Autocapture is off and no recording happens under this category.
Data transfer. Google Analytics data is sent to Google servers in the United States. The transfer relies on the EU-US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795). Google LLC is self-certified to the DPF; verify active certification at dataprivacyframework.gov. In the event the DPF is suspended or invalidated, transfers continue under Standard Contractual Clauses.
Data retention. The cookies above have lifetimes of 1 minute to 13 months as noted. Google keeps the event data on its servers for 2 months, the retention set in our Google Analytics property.
Session recording (PostHog, separate consent)
PostHog is built into the site but switched off today. The banner does not show this category and nothing from PostHog loads. If we switch it on, the category appears, we ask again, and PostHog session replay records your session for UX diagnostics only if you accept it. PostHog is hosted in the European Union (AWS eu-central-1, Frankfurt) and event data and recordings stay in the EU. All form inputs are masked by default. Recordings are retained for 30 days.
Why a separate category? CNIL's draft recommendation of February 2026, still out for consultation and not adopted, says session replay needs its own consent purpose, apart from general audience measurement. We follow the draft. Accepting "analytics" alone does not authorise screen recording.
Residual US touches. PostHog Inc. is a Delaware corporation. Event data and recordings stay in Frankfurt, but billing and support metadata transit US systems under Standard Contractual Clauses. Compliant under post-Schrems II SCC rules. We disclose this rather than claim "zero US transfer."
Booking (Calendly, separate consent)
If you accept the booking category, the start page embeds Calendly's booking calendar. Calendly loads its script and stylesheet from assets.calendly.com and shows the calendar from calendly.com in a frame. Nothing from Calendly loads before you accept.
What Calendly says. Calendly's privacy notice says that it and authorised third parties use cookies and local storage, and that some of its cookies are linked to a Calendly account and some are not. It says third parties on its site can include social media companies, advertising networks, analytics providers and security providers, and it names Google Analytics as one. It says it uses these under your consent or another legal basis where the law requires, and it offers its own cookie settings on its pages.
What we saw on 19 October 2026. With the booking calendar open on our start page, Calendly set the cookies __cf_bm and _cfuvid (Cloudflare) and one named m, loaded Stripe and Google Analytics inside its frame, and called a device-fingerprinting service at dfp.calendly.com. We do not control these, names and lifetimes are Calendly's to set, and they can change without notice. If you do not accept, no Calendly code loads and a plain link opens the calendar on Calendly's own site, which shows its own cookie notice.
What Calendly receives: if you book, your name, email and answers to the booking questions. Calendly LLC is a US company; see our sub-processor list for the transfer basis.
Marketing (Apollo website tracker, separate consent)
The Apollo tracker is built into the site but switched off today. The banner does not show this category and nothing from Apollo loads. If we switch it on, the category appears, we ask again, and the tracker runs only if you accept it. Global Privacy Control counts as a refusal. Apollo describes its website tracker as a way to match a visit to a company (for example, "a visitor from Acme Corp") and to pass that match to Apollo.io's CRM, where our sales prioritisation can see which target accounts are touching the site. The tracker sets cookies on your device.
What we do with it: internal prioritisation only. If your company matches our ideal customer profile, someone on our team may decide to do warm outreach, but only ever based on another signal (a LinkedIn connection, a referral, a conference conversation), never on the tracker visit itself. "I saw you visited our website" outreach is a dark pattern and we do not use it.
What we do not do: we do not use the tracker to identify or contact you as an individual. We have not confirmed what else Apollo's tracker is able to match, and we will not switch it on until we have.
Data transfer. Apollo is US-based; tracker data transits US systems under Standard Contractual Clauses, with DPF as a secondary basis where Apollo is certified.
Withdrawal limitation. Apollo does not provide a way to fully unload its tracker script once loaded. If you grant then revoke this consent mid-session, our consent banner clears Apollo cookies immediately and reloads the page, which ends the tracker script.
Global Privacy Control. If your browser sends the signal, Marketing stays off unless you switch it on yourself.
Cookieless measurement (Ahrefs and Vercel, no consent required)
Three tools measure traffic and speed without cookies or on-device storage: Ahrefs Web Analytics, Vercel Web Analytics and Vercel Speed Insights. Vercel's two tools count page views and report page load times, with no cookie and no identifier that follows you across sites. Ahrefs is described below.
We use Ahrefs Web Analytics for aggregate traffic measurement (pageviews, referrers, countries). It is designed to be privacy-friendly and runs without a consent gate: it does not set cookies, does not write to localStorage, and does not use browser fingerprinting. Because it does not place or read information on your device, it falls outside the consent requirement of ePrivacy Directive Art. 5(3) and analogous provisions in Quebec Law 25 and the UK DUAA. We still disclose it here for transparency.
What is collected: the URL visited, referrer, user agent, and truncated/anonymised IP used only to derive country. No persistent identifier links visits to a single user across sessions.
Provider: Ahrefs Pte. Ltd. (Singapore). Transfer mechanism: Standard Contractual Clauses for transfers outside the EEA/UK/Quebec.
Opting out. Because there is no cookie or on-device identifier to toggle, the primary opt-out is a browser-level block of the analytics.ahrefs.com domain (uBlock Origin, a Pi-hole, or equivalent). You can also request that we delete any aggregated records derived from your visits by contacting contact@pragmon.ai.
Withdrawing or changing consent
You can change your cookie preferences at any time by clicking "Cookie settings" in the footer of any page. This opens the same panel as Choose, so you can switch any category on or off. Withdrawing is as quick as agreeing. Withdrawal takes effect immediately: existing cookies for the withdrawn category are cleared from your device and no further data is sent. Withdrawal does not affect processing that already occurred while consent was in effect.
You can also clear cookies through your browser settings (see below) or use the official Google Analytics opt-out add-on to block GA across all sites.
Browser-level cookie controls
Every major browser lets you see, block, and delete cookies directly. The exact steps vary; the vendor guides are:
Other tracking technologies
We do not use web beacons, tracking pixels, Flash Local Shared Objects, or advertising cookies on this site. We do not serve targeted advertising and do not participate in advertising networks. If this changes we will update this policy and update the consent model accordingly.
Changes to this policy
We may update this policy when we change the cookies we use or when legal requirements change. The "Last updated" date at the top of this page reflects the most recent change. For material changes we will refresh the consent banner so you can review the new categories before continuing.
Contact
Questions about cookies on this site should be directed to contact@pragmon.ai. Postal address: Navos AI, Inc., trading as Pragmon AI, 1111B S Governors Ave, Ste 39989, Dover, DE 19904, United States.