This website
One cookie, xalios_consent, holding the choice you made and when you made it. Kept for twelve months, then we ask again. No consent is needed for it because it exists only to record your consent.
Google Analytics, so we can see which pages are read and where visitors come from. It sets _ga and _ga_* cookies, kept for up to two years, with IP addresses shortened before storage. Data goes to Google under its privacy policy. Nothing loads until you accept, and withdrawing consent stops it and removes the cookies we can reach.
The calendar on the demo page is provided by Calendly and sets cookies of its own under Calendly’s privacy policy. It loads only when you ask for it there or allow it here, and the demo page offers a plain link to Calendly if you would rather not.
Typefaces are served by Google Fonts, so your browser requests the files from Google. Standard server logs of IP address, request and user agent are kept briefly to keep the site up and block abuse, and are not used to build a profile of you. No advertising cookies, pixels or social embeds are used.
Inside the product
Different from this website, and worth separating because the answer is different.
Session cookies
Strictly necessary: they keep you signed in and protect against cross-site request forgery. There is no consent option because the application does not function without them, and they carry no tracking purpose.
Preferences
Small amounts of local storage for interface state: which view you had open, what you had filtered. Held in your browser and never sent anywhere for analysis.
Audit records
Sign-ins, approvals and configuration changes are recorded, but server-side and as part of the decision record, not through cookies. That exists so actions are attributable, which is the point of the product. The privacy notice covers it.
Controlling cookies
Cookie settings in the footer reopens the choice at any time, with a working reject button. Your browser can also block or clear cookies for any site, including this one, and nothing on this website breaks if you do. Blocking them for the application will stop you staying signed in.
The lawful basis for analytics and the booking calendar is your consent, which is why nothing in those categories runs before you give it. The strictly necessary cookie is set because you cannot make and keep a choice without it.