Cookie Policy

We use cookies and similar technologies (collectively, "cookies") to operate our websites and app, keep sessions secure, remember preferences, and—if you allow—understand usage to improve features. Some cookies are provided by third parties we use to deliver services.

Cookies are small files placed on your device that a website can read or write on subsequent visits. They can be "first-party" (set by us) or "third-party" (set by someone else).

Scripts are pieces of code that help our site and app work properly and interactively. They may run on our servers or on your device.

Web beacons (also called pixel tags) are tiny images or code fragments used to measure usage or deliver certain features. They often work together with cookies.

5.1 Strictly necessary (functional)

Required for core functionality (e.g., security, session continuity, load balancing, remembering your cookie choices). These do not require consent and cannot be turned off in our systems.

We use Cloudflare Turnstile (a third-party bot protection service by Cloudflare, Inc.) on public forms including newsletter sign-up, contact, and email preference management. Turnstile collects browser signals (such as User-Agent, screen size, timing, and IP address) to distinguish humans from bots. It may set strictly necessary cookies or use browser storage for this purpose. No personal data collected by Turnstile is used for advertising. Cloudflare acts as a data processor under a data processing agreement. See Cloudflare's privacy policy at cloudflare.com/privacypolicy.

5.2 Statistics (analytics)

Help us understand how features are used so we can improve them. As of 11 June 2026, we do not set analytics cookies by default. If you enable analytics, we use PostHog for product analytics and sampled session replay; PostHog is activated only after you opt in via the cookie banner. We request your consent first and you can withdraw it anytime from the cookie preferences.

5.3 Marketing / tracking

Used to build profiles, show ads, or track you across sites. We do not use advertising cookies in the app.

5.4 Similar technologies (e.g., localStorage)

We may use browser storage such as localStorage or sessionStorage for strictly necessary purposes (for example, session/auth state). These are governed like cookies when used for similar purposes.

5.5 Social media and social login

Our app may link to platforms like LinkedIn, Instagram, TikTok, Facebook, or X (Twitter). We do not embed their trackers by default. If we embed content in the future, those providers may set non-essential cookies—these will be blocked until you consent and will be listed in the Cookie Register.

Social login: You may sign in to Utably using Facebook or LinkedIn. When you click "Sign in with [Provider]", you are redirected to the provider's authentication page. This redirect uses standard OAuth 2.0 / OpenID Connect protocols and may involve cookies set by the social provider on their own domain during the authentication flow. We do not control those cookies. On our domain, the social login flow uses only strictly necessary authentication cookies (session tokens) that are already covered in section 5.1 above. No additional tracking or non-essential cookies are set by Utably as a result of social login.

5.6 Embedded third-party content (maps) — app.utably.com only

We embed map tiles from Google Maps in the application detail and interview calendar pages so you can see the location of an office, an interview venue, or a company headquarters. Google Maps loads only within the app (app.utably.com) and never runs on the marketing website utably.com. Loading the embed transmits your IP address, request data, and basic device signals to Google LLC in the United States. Google may set its own cookies on its domain via this iframe.

Legal basis: your consent under Art. 6(1)(a) GDPR and §25(1) TDDDG. The embed only loads after you opt in to "Embedded maps & content" in the cookie preferences (or click the per-map "Load this map" button). You can withdraw consent at any time by re-opening the cookie preferences from the footer or your account settings.

Transfer to the US: Google LLC is certified under the EU-US Data Privacy Framework, which the European Commission has recognised as providing an adequate level of protection. We do not control which cookies Google sets in this context — see Google's privacy policy at policies.google.com/privacy and the Maps Service Specific Terms.

If you decline this category, we display a click-to-load placeholder and a fallback link that opens Google Maps in a new tab — no data is sent to Google until you actively click.

Strictly necessary (first-party)

Name	Provider	Purpose	Lifespan	Type
cookieconsent_status	Utably (first-party)	Stores your cookie consent choice (allow/deny) so the banner respects your decision.	12 months	First-party cookie
cookieconsent_meta	Utably (first-party)	Records the timestamp and policy version of your consent choice (proof of consent).	12 months	First-party cookie
utably_theme	Utably (first-party)	Stores your chosen colour theme (light/dark/system). Set with Domain=utably.com, so it is readable by both utably.com and app.utably.com to keep your setting consistent.	12 months	Cookie with Domain=utably.com (shared between utably.com and app.utably.com)
utably_lang	Utably (first-party)	Stores your chosen language. Set with Domain=utably.com, so it is readable by both utably.com and app.utably.com to keep your setting consistent.	12 months	Cookie with Domain=utably.com (shared between utably.com and app.utably.com)
theme, utably-lang	Utably (first-party)	Local mirrors of your theme and language preference in the browser.	Persistent	localStorage
contact_cooldown_until	Utably (first-party)	Short-lived rate-limit hint after you submit the contact form.	Short-lived	localStorage

These entries are strictly necessary and exempt from consent. They are set only when you actively choose a theme or language, save a consent choice, or submit the contact form — never on mere page load. This is the justification under §25(2) TDDDG. The utably_theme and utably_lang cookies are stored at the utably.com domain level and are therefore readable by both the marketing site and the app, keeping your settings consistent; no third party receives them, and the same controller is involved.

Strictly necessary (third-party)

Name	Provider	Purpose	Lifespan	Type
cf_turnstile_*	Cloudflare, Inc. (third-party)	Bot and abuse protection on public forms (newsletter sign-up, contact, email preferences). Collects browser signals to distinguish humans from automated requests. No advertising use.	Session / short-lived	Third-party

Strictly necessary third-party technologies active on our public forms.

Non-essential

Name	Provider	Purpose	Lifespan	Type
PostHog cookies and local storage identifiers	PostHog	Usage analytics and sampled session replay to improve product quality. Activated only after you opt in via the cookie banner (accept Analytics cookies).	Up to 1 year	Third-party
Google Maps embed cookies (NID, OTZ, etc.) — app.utably.com only	Google LLC (third-party)	Renders interactive map tiles for office locations and interview venues on the application detail and calendar pages. Runs only within the app (app.utably.com), never on the marketing site. Activated only after you accept Embedded maps & content (or use the per-map "Load this map" button). Transfers to the US under the EU-US Data Privacy Framework.	Up to 6 months	Third-party

Non-essential cookies used after you give consent.

We do not set non-essential cookies until you choose Accept all or Save preferences in our banner. You can Reject all non-essential cookies just as easily. You can withdraw consent any time via the Cookie Settings link in our footer. We aim to honor recognized browser privacy signals where technically feasible; please also use our cookie preferences for the most reliable opt-out.

You can use your browser to block or delete cookies. Doing so may impact functionality. If you delete cookies, we will respect your preferences the next time you visit and ask for consent again where required.

For U.S. state privacy laws (e.g., CCPA/CPRA) that refer to "Do Not Sell or Share My Personal Information": Utably does not sell personal information or share it for cross-context behavioral advertising in the CPRA sense. However, you can manage your analytics preferences using the link below:

Analytical data

Help improve Utably by allowing collection of pseudonymous usage data. We collect aggregated metrics and apply hashing/tokenization to remove direct identifiers. Because absolute anonymization cannot be guaranteed, we treat this data as personal data under the GDPR and process it only with your consent. No document contents are stored in analytics. You can opt out anytime in Settings.

Joshua Sievert (Utably)

Landsbergerstraße 46, 04157 Leipzig, Germany

Website: https://utably.com

Email: support@utably.com

When we change the cookies we use or introduce new vendors, we will update this policy and the Cookie Register. Material changes will be reflected in the "Last updated" date above.