Cookie policy
Effective 27 October 2026
This policy explains which cookies and similar technologies Kandaro uses on our website, kandaro.com, and in the Console, app.kandaro.com, what they do, how long they are kept and how you can control them. It applies together with our privacy policy, which explains how we handle personal data in general.
What cookies and similar technologies are
A cookie is a small text file that a website stores in your browser and reads back on later visits. Local storage is a similar store in your browser that only the website itself can read; it is never sent to our servers on its own. The law treats both the same way: storing or reading information on your device needs your consent, unless it is strictly necessary for a service you asked for.
First-party cookies are set by Kandaro on our own domain. Third-party cookies are set by another company, here Cloudflare, CookieYes and Google, under that company’s responsibility for its own use.
Which cookies we use
On the website
The website loads Google Tag Manager on every visit, to show our cookie banner from CookieYes. Google Tag Manager itself sets no cookies; to load it, Google receives only the technical data any website receives, such as your IP address and browser type. Until you make a choice, every analytics and marketing category is switched off, and no analytics or marketing cookies are set. Only if you accept do Google Analytics and Google Ads set the cookies listed below. If you choose a light or dark theme, we remember that in your browser.
In the Console
The Console uses only strictly necessary cookies and preference storage: to keep you signed in, to protect sign-ins and connections with other services, and to remember choices you make on screen. It has no analytics, advertising or tracking cookies, and does not load Google Tag Manager. We never keep sign-in tokens in local storage.
The full list
Strictly necessary
Needed to keep the site secure, keep you signed in and remember your cookie choice. They are always on.
__Host-kandaro_rt
Keeps you signed in to the Console. It holds a random sign-in token that only our servers can read (scripts on the page cannot), is sent only over a secure connection and only to the Console itself. It changes each time it is used and is deleted when you sign out.
- Set by
- Kandaro
- Where
- Console
- Type
- Cookie
- Kept for
- Up to 30 days; it stops working sooner after 7 days without use or when you sign out
__Host-kandaro_sso
When you sign in or sign up with GitHub, Google or Microsoft, ties the return from that sign-in page to the browser that started it, so nobody else can finish your sign-in.
- Set by
- Kandaro
- Where
- Console
- Type
- Cookie
- Kept for
- 10 minutes, deleted as soon as the sign-in completes
__Host-kandaro_coauth
When you connect one of your own security tools to Kandaro through that vendor’s approval page, ties the return from that page to the browser that started it.
- Set by
- Kandaro
- Where
- Console
- Type
- Cookie
- Kept for
- 10 minutes, deleted as soon as the connection completes
__cf_bm
Set by our network provider to tell people from automated traffic and keep attacks away from the site. It does not identify you and is not used for analytics or ads.
- Set by
- Cloudflare
- Where
- Website and Console
- Type
- Cookie
- Kept for
- 30 minutes
cf_clearance
Set only if our network provider asks your browser to pass a security check, so it does not ask again on every page.
- Set by
- Cloudflare
- Where
- Website and Console
- Type
- Cookie
- Kept for
- 30 minutes
cookieyes-consent
Remembers which cookie categories you accepted or rejected, so the banner does not ask again and your choice is respected on every page.
- Set by
- CookieYes
- Where
- Website
- Type
- Cookie
- Kept for
- 1 year
Preferences
Stored only when you choose something, so we remember what you asked for.
kandaro-theme
Remembers whether you chose the light or dark theme. Stored only when you pick one yourself.
- Set by
- Kandaro
- Where
- Website and Console
- Type
- Local storage
- Kept for
- Until you change the theme back or clear your browser data
kandaro-status-dismissed
Remembers which service status notice you closed, so it is not shown again until there is a new one.
- Set by
- Kandaro
- Where
- Console
- Type
- Local storage
- Kept for
- Until you clear your browser data
kandaro-bait-explainer-hidden
Remembers that you hid the explanation of how bait works in the Deception pages.
- Set by
- Kandaro
- Where
- Console
- Type
- Local storage
- Kept for
- Until you show the explanation again or clear your browser data
Analytics
Used only if you accept analytics cookies. They help us count visits and improve pages.
_ga
Tells visits from the same browser apart with a random number, so we can count visitors and see which pages are read.
- Set by
- Google (Google Analytics)
- Where
- Website
- Type
- Cookie
- Kept for
- 2 years
_ga_<ID>
Keeps track of the current visit for the same counts. <ID> stands for our Google Analytics property code.
- Set by
- Google (Google Analytics)
- Where
- Website
- Type
- Cookie
- Kept for
- 2 years
Marketing
Used only if you accept marketing cookies. They help us see which of our ads work.
_gcl_au
Links a visit that started from one of our Google ads to a later sign-up or request, so we can tell which ads work.
- Set by
- Google (Google Ads)
- Where
- Website
- Type
- Cookie
- Kept for
- 90 days
Legal basis
Under the Dutch Telecommunications Act (article 11.7a) and the GDPR, strictly necessary cookies and storage need no consent: they are needed to deliver the website or Console you asked for, to keep it secure, or to remember your consent choice. Preference storage is set only when you make the choice yourself and is used only to remember it, so it also needs no consent. Where these involve personal data, we rely on our legitimate interest in a secure, working service (article 6(1)(f) GDPR) or on our contract with you (article 6(1)(b) GDPR).
Analytics and marketing cookies are used only with your consent (article 6(1)(a) GDPR). Nothing in those categories is set before you accept. Rejecting is as easy as accepting, and the website works the same either way.
Changing your choice
You can change or withdraw your consent at any time with the Cookie settings link at the bottom of every page of the website. Withdrawing is as easy as giving consent and takes effect straight away; it does not affect the lawfulness of use before you withdrew. We then stop using analytics and marketing cookies. Cookies already set stay in your browser until they expire or you delete them, but are no longer used.
You can also block or delete cookies and local storage in your browser settings. Most browsers explain how in their help pages. If you block strictly necessary cookies, the Console cannot keep you signed in and some security checks may not work. Deleting site data also removes your theme and other on-screen choices.
Third-party cookies
Some cookies in the list are set by other companies. They decide how they use the information from their own cookies, as described in their privacy policies:
- Cloudflare, our network provider: Cloudflare privacy policy, and its list of Cloudflare cookies.
- CookieYes, our cookie banner: CookieYes privacy policy.
- Google, for Tag Manager, Analytics and Ads: Google privacy policy and how Google uses information from sites that use its services.
The companies that process personal data for us are listed on our subprocessors page.
Bot check on forms
Our forms on the website and in the Console (contact, waitlist, integration request, sign-in, sign-up and password reset) use Cloudflare Turnstile to check that a person, not a bot, is sending them. The check runs in a small frame served by Cloudflare. It sets no cookies on kandaro.com or app.kandaro.com. Cloudflare processes technical information about your browser and the request, such as your IP address, only to run the check and keep its service secure. It is not used for advertising. The check is strictly necessary to protect our forms from abuse, so it needs no consent.
Error monitoring
When something breaks in your browser, the website and the Console send us a short error report through our own servers, so we can fix it. These reports leave out cookies, personal details and form contents. Error monitoring sets no cookies and stores nothing in your browser.
Changes to this policy
We update this policy when we change the cookies or storage we use. The date at the top shows when it last changed. If a change means we need your consent for something new, we ask for it before using it.
Contact
For questions about cookies or your personal data, use our contact form and choose the topic “Privacy or data request”. You also have the right to complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens, or to the authority where you live. More about your rights is in our privacy policy.