1. Your choice comes first.
Necessary storage supports sign-in, request security and remembering your cookie choice. Analytics and marketing remain disabled until you explicitly accept the respective category. Ignoring or closing the settings is not consent. You can reject optional cookies and still use the site, scanner and portal.
Your selection lasts 180 days or until the policy or configured providers change. You can withdraw it at any time below or in the footer. Withdrawal stops subsequent tracking and removes known optional first-party cookies; it cannot erase information already received by a provider.
2. Necessary storage.
Django uses sessionid for your login session, csrftoken to protect forms and django_language if a language preference is stored. Their expiry follows the application settings (normally 14 days for a session, approximately one year for CSRF and language). Logging out ends the authenticated session.
The signed xrenn_consent cookie records your choices for 180 days. The server keeps a receipt containing a random identifier, timestamp, policy version and selected categories. The browser also uses xrenn_optional_block and xrenn_consent_changed in local storage to block tracking after withdrawal and synchronize tabs. These contain no advertising profile and remain until replaced or cleared.
The session-only xrenn_consent_refresh reference prevents an older tab from showing a stale choice during synchronization.
The necessary xrenn_optional_block cookie contains only a blocking flag for up to 180 days. It prevents further internal measurement after withdrawal even if saving the choice fails. It is removed after a choice is successfully saved.
3. Optional providers.
With analytics consent, our signed xrenn_entry cookie remembers for seven days that you arrived through a shared report. It contains only the category shared_report, without the report link, token, domain or visitor identity. We use this category when you continue to presentation pages or submit an inquiry. Rejecting or withdrawing analytics consent disables this attribution and removes the cookie.
Google Analytics 4 measures visits to public pages after analytics consent. It may use cookies such as _ga and _ga_*; their duration is controlled by the configured Google property. Google advertising consent signals remain denied unless marketing is accepted.
Meta Pixel and OpenAI Ads support advertising attribution and campaign measurement after marketing consent. Meta may use _fbp and _fbc; OpenAI may use __oppref for referral attribution. Provider configuration determines their duration and behavior. No client report or form values are deliberately sent by this integration.
Google Tag Manager manages configured tags and is loaded only if both analytics and marketing are accepted. A container must still enforce category-specific consent. Additional third parties require disclosure and configuration review before activation; your choice is not an unlimited authorization for unnamed services.
Configured measurement services on this deployment: GA4
Google reCAPTCHA protects sign-in, PIN verification, scan requests and inquiries against automated abuse. When you interact with a protected form, Google receives technical browser and connection information for security assessment. We verify the result on our server. Rejected requests may generate a security email to support@xrenn.ai containing the time, connection IP address, action and reason; form contents and verification tokens are excluded.
With analytics consent, we measure visits, scan starts, verified contacts, completed scans and inquiries inside this platform. Our staff confirms qualified consultations and signed contracts. A consent reference links these stages internally; the measurement records contain no email, domain, PIN, report token, IP address or raw URL. They retain only approved campaign labels and stages for up to 180 days. Withdrawal stops further recording. Aggregate reports contain counts, not client identifiers.
4. Where tracking is excluded.
Third-party analytics and advertising scripts load only on selected public presentation pages after consent. They remain disabled for authenticated visitors, forms, the scanner, dashboards and all reports. Only approved campaign parameters and fixed navigation anchors are permitted; other queries and fragments block these integrations.
Fonts and icon resources used by the template can still contact Google Fonts and jsDelivr without optional cookies. Browser settings can remove stored cookies, but blocking necessary storage may prevent sign-in or form submission. For data rights and international transfers, read Security & Privacy.
