1. The short version
This website sets two cookies with our own measurement tag, and in Europe only if you agree, to tell which of our campaigns brought you here. Opening the support chat sets one more, to keep your conversation. The application sets one cookie, to keep you signed in. The measurement tag sets two on your own domain, to tie a page view to the click that produced it. There are no advertising cookies, no third-party cookies and no third-party tracking pixels anywhere in any of the three.
| Where | Cookie | Purpose | Life |
|---|---|---|---|
| utmcap.com | _utmcap_cid, _utmcap_src | Our own measurement tag. Which of our campaigns brought you here. In Europe, only if you agree. | 30 days |
| app.utmcap.com | utmcap_session | Keeps you signed in. Strictly necessary. | 30 days |
| Your tracking domain | _utmcap_cid | The click id, so a page view finds the click that paid for it | 1 or 30 days |
| Your tracking domain | _utmcap_src | Whether that id arrived by redirect or from the tag | 1 or 30 days |
2. This website
utmcap.com runs our own UTMCAP measurement tag — the same one our customers use — from datacap.utmcap.com, which we run ourselves. It sets two cookies, _utmcap_cid and _utmcap_src, for 30 days, so we can tell which of our campaigns brought you here and which pages lead to a demo request. It also runs the window that offers a demo when you go to leave. There are no third-party analytics or trackers, and typefaces, styles and scripts come from our own origin.
Two things are kept in local storage, never sent anywhere: utmcap-ads-consent, your answer to the consent question, so you are not asked again; and utmcap-demo-popup, so the demo window never shows twice.
The one exception is the support chat, and only if you open it. Pressing “Chat with us” loads it from chat.utmcap.com, which we run ourselves, and it sets one cookie, cw_conversation, for up to a year, so your conversation is still there when you come back. Deleting the cookie starts a new conversation.
In the EEA, the UK and Switzerland a banner asks first, and the tag does not load until you agree; say no and it never loads. Everywhere else it loads straight away. The chat’s cookie is set only when you ask for the chat.
3. The application
Signing in at app.utmcap.com sets one cookie, utmcap_session. It holds a signed session token and nothing else — no name, no email address, no account details. It is HttpOnly, so no JavaScript on the page can read it, and Secure, so it is never sent over an unencrypted connection. It lasts 30 days, and signing out deletes it immediately.
It is strictly necessary: without it there is no way to stay signed in between requests, so it is not one you can refuse and still use the application. It is not used for analytics or advertising, and it does not follow you to any other site.
4. The measurement tag
The tag you place on your own landing pages sets two cookies, on your domain rather than ours:
_utmcap_cid— the identifier of the click that brought the visitor to the page._utmcap_src— whether that identifier came from a redirect or from the tag itself. Kept beside the id rather than appended to it, so both stay readable.
Both are first-party, SameSite=Lax, and Secure on an HTTPS page. They live for one day when the visitor arrived through a tracking link, and 30 days when the tag set them itself — long enough for a conversion that happens days after the click to find the advertising that caused it.
Neither contains personal data. The click id is a random identifier that means something only inside your own account; it is not shared with anyone, not matched against any other site, and not used to build a profile. Attribution can also work without them, from the identifier in the URL — the cookies are what makes it survive a visitor moving between pages.
5. Consent, and whose job it is
On your landing pages, you are the controller and the cookie notice is yours to show. We cannot show it for you: it is your domain, your page and your decision about what else runs on it. Where consent is required in your visitors’ jurisdiction, place the tag so that it runs after that consent is given.
The relationship this creates between us is set out in the Data Processing Addendum, and what we do with the data in the Privacy Policy.
6. Refusing and clearing them
Every browser can block or delete cookies for a given site, usually under Settings → Privacy. Deleting utmcap_session signs you out of the application. Deleting the tag’s two cookies costs nothing except the attribution of a visit already in progress.
Blocking cookies for this website has no effect at all, because there are none to block.
Questions about any of this: [email protected]. To have data removed rather than blocked, see Data Deletion.