Cookie Policy

This Cookie Policy is a user-facing transparency notice. It does not replace your contract terms, and it should be read together with our Privacy Policy and applicable Terms and Conditions. It is interpreted in line with applicable data protection and cookie laws, including the GDPR, the Dutch Telecommunications Act (Telecommunicatiewet, including Article 11.7a), and other mandatory local privacy laws where they apply.

1. Who We Are (Controller Context)

Controller: Autonomyware B.V., the company operating Autonomyware and this website and related product interfaces, as identified in your invoice, order confirmation, and account legal notice.

Registered Office: 9035GG, Dronryp, Friesland, The Netherlands

Chamber of Commerce number: 42037699 and VAT number: NL869420446B01

Privacy Contact: privacy@autonomyware.ai

2. What Cookies and Similar Technologies Are

Cookies are small text files placed on your device when you use a website or web application. We also use similar technologies such as local storage, pixels, server-side identifiers, and telemetry markers. In this policy, we refer to these collectively as "cookies" unless a distinction is needed.

Cookies may be first-party (set by us) or third-party (set by providers we use). They may be session cookies (expire when your session ends) or persistent cookies (remain for a defined period).

3. Cookie Categories, Purposes, and Legal Basis

A. Strictly Necessary Cookies

These cookies are required for core service operation, such as authentication, session continuity, security protection, load distribution, and storing your cookie preferences. Legal basis: exemption from consent where a cookie is strictly necessary for the service you explicitly requested, in accordance with applicable law. Typical retention: session duration to 12 months, depending on function and security requirements.

B. Analytics Cookies

This category covers only analytics that rely on cookies or similar device storage to understand service usage, performance, and reliability. Legal basis: consent. These stay blocked by default and are used only after you allow the analytics category where consent is required. We use Google Analytics 4 (provided by Google Ireland Ltd.) for this purpose; it sets the _ga and _ga_<id> cookies to distinguish visitors and persist session state, and it loads only after you opt in. Typical retention: up to 24 months, subject to tool configuration and legal requirements.

C. Functional Cookies

These cookies remember your choices, such as language, region, accessibility settings, and interface preferences. Legal basis: consent unless the functionality is strictly necessary for a feature you explicitly requested. Typical retention: session duration to 12 months.

D. Marketing Cookies

These cookies support campaign measurement and, where permitted, personalization of outreach and advertising. Legal basis: consent. Marketing cookies are configured to remain blocked by default and are activated only after your explicit consent where required by law. Typical retention: up to 13 months, unless a shorter period is required by law or platform policy.

Cookieless Performance Analytics (No Consent Required)

Separately from the cookie categories above, we use a privacy-friendly, cookieless performance monitoring service (Cloudflare Web Analytics / Real User Monitoring) to measure aggregate site performance, such as page load speed and Core Web Vitals. It does not set cookies, does not read or store information on your device, and does not create a persistent identifier or track you across websites. Because it relies on no device storage and has minimal privacy impact, it operates without cookie consent and is not governed by the Analytics category, which applies only to analytics that require cookies.

4. Cookie Inventory and Transparency

We maintain a current cookie inventory in our cookie preferences interface, including cookie name, provider, category, purpose, and retention period. The live inventory may evolve as tools change. We update disclosures and re-prompt consent where legally required for material changes.

5. Consent, Withdrawal, and Preference Controls

When required by law, we ask for consent before placing non-essential cookies. You can accept all, reject non-essential cookies, or choose by category. You can change your preferences at any time through the Cookie Settings link on the website or in product settings where available.

Withdrawing consent is designed to be as easy as giving consent. Withdrawal applies to future processing and does not affect prior processing already performed on a lawful basis.

We do not condition basic access to the Services on acceptance of non-essential cookies, except where a specific function inherently requires a particular technology to operate.

6. Browser, Device, and Global Privacy Controls

Most browsers allow you to block or delete cookies. If you block strictly necessary cookies, parts of the Services may not work correctly.

Where applicable law requires browser-based opt-out signal recognition (including Global Privacy Control), and where technically supported in the relevant browser/device context, we treat those signals as opt-out requests for relevant non-essential tracking.

Do Not Track (DNT) signals are not yet governed by a universal technical standard; our consent controls remain the primary preference mechanism unless local law requires otherwise.

7. Third-Party Cookies and Providers

Some cookies are delivered through third-party services (for example analytics, security, support, payments, and campaign tools). Third-party providers may change their technical cookie behavior over time. We remain responsible for consent gating, provider due diligence, and updating our disclosures when material changes are identified.

Third-party providers process data under their own terms and, where required, under contractual safeguards with us.

8. Autonomyware and AI-Related Processing Context

Certain service technologies used by Autonomyware, including any AI-related workspace state, real-time session identifiers, and event continuity markers, may be classified as strictly necessary where they are required to deliver requested functionality.

We prohibit and technically restrict use of cookie-related data and AI interaction metadata for training, retraining, or fine-tuning general-purpose AI models. We also restrict disclosure of such data to third-party AI providers for model training. Any exception requires your explicit prior consent or must be strictly required by mandatory law.

9. International Data Transfers

Cookie-related data may be processed outside your country, including outside the EEA/UK. Where required, we apply lawful transfer mechanisms and supplementary safeguards, such as adequacy decisions, Standard Contractual Clauses, the UK International Data Transfer Addendum, or equivalent legal mechanisms.

10. Retention and Deletion

Cookie retention periods depend on cookie category and purpose. We periodically review retention settings and remove or anonymize data when no longer needed for the documented purpose.

We may retain limited data longer where required or permitted by law, including legal obligations, fraud/security investigation, legal claims, dispute handling, or backup/archival cycles.

11. Consent Records and Accountability

Where consent is required, we keep evidence of consent status, timestamp, and policy/banner version. If you are not signed in, this evidence is stored on your device (in your browser's local storage) so we can honour your choices, and it is not linked to any account. For logged-in users, consent records are additionally recorded on our backend and associated with your account; a choice made before logging in is linked to your account when you sign in. Backend consent records are retained for compliance and legal-defense purposes for a period that is proportionate to legal requirements.

12. Children

Our Services are not intended for children under the minimum age required by applicable law for digital consent. We do not knowingly use non-essential cookies for children in violation of applicable law.

13. Regional Information (Including California)

Depending on your jurisdiction, you may have specific rights related to tracking technologies. For example, California residents may have rights regarding the sale or sharing of personal information. We do not sell personal information for monetary consideration. Where a disclosure through advertising technologies is classified as "sharing" under applicable law, we provide legally required opt-out controls.

14. Your Rights

Where cookie data is personal data, you may have rights under applicable law, including rights to access, correction, deletion, restriction, objection, portability, and complaint to a supervisory authority. Rights and limits depend on your jurisdiction and the legal basis used.

15. Changes to This Cookie Policy

We may update this policy to reflect legal, technical, or business changes. For material changes, we provide notice as early as reasonably practicable and re-request consent where legally required. The Effective Date and Last Updated fields indicate the current policy version.

16. Governing Law and Complaints

This policy is prepared under Dutch-law compliance principles while honoring mandatory local rights for global users. You may lodge a complaint with your local supervisory authority. If you are in the Netherlands, you may contact the Autoriteit Persoonsgegevens.

17. Contact

Privacy Team: privacy@autonomyware.ai

Legal Contact: legal@autonomyware.ai

Support Contact: support@autonomyware.ai