Every document, published in full

What these technologies are

A cookie is a small text file a website asks your browser to store and send back on later visits. A first-party cookie is set by the site you are visiting; a third-party cookie is set by another domain whose content the page loads.

Related technologies include local storage and session storage, which hold data in your browser but are not sent automatically with every request. We use local storage for one important thing, described below.

Cookies we set ourselves

These are first-party cookies, set by us, on our own domains.

Analytics, and what it takes to switch it on

We use Google Analytics 4 to understand how the website and the application are used, as two separate properties measuring two different things.

Where you are decides how it starts. In the United Kingdom, the European Union, the rest of the European Economic Area (Iceland, Liechtenstein and Norway) and Switzerland, analytics, website session recording and advertising are off until you accept them in our cookie banner. Everywhere else — including the United States, Canada and Australia — they are on by default, no banner is shown, and you can switch them off at any time with the Cookie Settings and "Do Not Sell or Share My Personal Information" controls in our footer, or with a Global Privacy Control signal from your browser. In this policy, "allowed for you" means accepted where you are asked, or not switched off everywhere else. We tell which rule applies from your browser's time zone; Google's tag decides for itself from the location of your connection.

Google's script loads for every visitor, before anyone has answered anything — there is one script, shared by the measurement tag and the advertising tag described in the next section. Where analytics is not allowed for you, the tag writes no cookie and stores no identifier on your device, but it still sends Google a signal for each page you open and each action we measure, without a cookie or an identifier, which Google uses to estimate the visits it cannot count. In the UK and the EU that is the case before you answer the banner and after you decline it. Once analytics is allowed, the tag uses its cookies as described below.

Measurement and advertising are honoured separately. Where analytics is allowed and advertising is not — because your browser sent a Global Privacy Control signal, because you accepted under an earlier edition of this page that never put the advertising question, or because you used the "Do Not Sell or Share My Personal Information" control — advertising storage stays denied and no advertising cookie is written; what that means for advertising signals is set out in the next section.

Session recordings, on our public website only. Where analytics is allowed for you we also use Smartlook to record how visitors use the pages of our public website — the pages you open, where you click, move the mouse and scroll, and each page as it appeared on your screen — so that we can see where a page confuses people. What you type into a form is not recorded: every form field is masked, and so are email addresses and numbers shown on the page, before anything leaves your browser. Your IP address is not recorded; Smartlook may record your approximate location (country and city), your browser, operating system, device type and screen size. Each page address is recorded without its fragment and with any sensitive value in it — an email address, a token — replaced, and no network traffic is recorded. Nothing is recorded in the signed-in application, in our non-production environments or on the public certificate verifier, and nothing is requested from Smartlook unless analytics is allowed for you. Unlike Google's tag, Smartlook sends nothing at all where it is not. Switching analytics off stops the recording at once and deletes what Smartlook stored in your browser. Smartlook has announced that it will close its service on 30 September 2027 and delete every recording it holds then.

• —What is sent: the page viewed and the action taken. Page addresses are rewritten before they leave your browser, so an identifier in a path — a team member, a certificate reference — is replaced with a placeholder, and query strings and fragments from the signed-in application are removed entirely rather than filtered.
• —What is never sent: names, email addresses, organization names, and any captured activity or screenshot data.
• —Advertising and personalization storage are granted only where advertising is allowed for you, and stay denied for everyone else. What the advertising tag does with them is a separate matter, described in the next section rather than folded in here, because it deserves its own answer.
• —Analytics is not loaded in our non-production environments, and not on the public certificate verifier.
• —Google acts as our sub-processor for this and is listed, with what it receives and where, in our Sub-processor list.

Advertising and conversion measurement

We advertise WorkMonitor on Google, and we measure which advertisements led to a sign-up, a demo request or a download. That measurement is the reason for every advertising cookie on this page, and it is a purpose of its own in law, which is why it is recorded as its own answer.

Where advertising is allowed for you — accepted in the UK or the EU, or not switched off everywhere else — everything in this section applies. Where it is not, no advertising cookie is written and no click identifier is stored. In the UK and the EU, before you accept and after you decline, Google's tag still sends the advertising account a signal when you open a page or complete a conversion, without a cookie or a click identifier and not usable to personalize advertising, which Google uses to estimate the conversions it cannot count. Everywhere else, switching advertising off — "Do Not Sell or Share My Personal Information", Decline in Cookie Settings, or a Global Privacy Control signal — stops advertising signals from your browser altogether. A decision holds for 180 days; in the UK and the EU we then ask again rather than assume the answer has not changed.

What the permission covers, rather than a running commentary on what is switched on today. Advertising covers two things: the remarketing described further down, which happens as soon as it is allowed for you; and conversion reporting, which is the reason for it. A conversion is only ever reported for a conversion action that has been created in our advertising account, and those are created one at a time, so at any given moment some of the actions listed here report and others do not yet. We would rather describe the permission accurately than describe a stream of conversions as though all of it were already flowing, because the second version stops being true in whichever direction the account changes next. Switching one on changes nothing about the data, the cookies or the limits set out here.

When you arrive from one of our advertisements the address carries a click identifier — gclid, gbraid or wbraid, depending on the campaign. Until advertising is allowed for you that identifier is held in the page's memory for the length of the visit, which is not storage and needs no permission, and it is discarded if you refuse or navigate away. Where advertising is allowed, it is written to the wm_gclid cookie described above so that a sign-up in the following 90 days can be matched to the advertisement that brought you.

Enhanced conversions, in plain terms, and there is one way an email address of yours can reach Google as a hash: in your browser. Where advertising is allowed for you and you then type an email address into our demo request or sign-up form, that address — that one, at the moment you submit that form — is hashed in your own browser with SHA-256, so that Google can match the conversion to an advertisement click without ever receiving the address itself. The digest goes out attached to the conversion report and to nothing else, so where no conversion is reported it is never sent at all, and it never reaches our analytics property. It is only ever the address you just typed, never one we hold for somebody else and never one read out of a link.

Separately, one report is made from our servers, and it is the one no amount of watching your own browser would show you, so it is written down here. A purchase usually happens days or weeks after the advertisement was clicked, often in a different browser, where no cookie can still connect the two. So where an organization was created from a visit that carried a click identifier and for which advertising was allowed, and that organization later pays its first invoice, we report that payment once to our advertising account — through a conversion action created in that account, on the same footing as any other, so the paragraph above applies to it too. What that report carries is the click identifier, an internal reference that stops the same payment being reported twice, the amount and currency of the invoice, when it was paid, and a consent signal stating that the visitor allowed advertising measurement and that the report may not be used to personalize advertising. It carries no email address and no hash of one, and nothing is sent at all for an organization whose visit did not allow advertising.

In neither case is a raw email address sent, in neither case do we build a list from it, and in neither case is the address of a person monitored through the platform hashed or sent. That last limb is absolute: the only address involved is the one a visitor typed into our own form, and no monitored worker's address can enter it.

Be clear about what advertising being allowed means, because we would rather you knew than found out. With advertising storage granted we do build remarketing audiences — groups such as "read our pricing and did not sign up" — and Google may use what the tag sends to select our advertisements for you on other sites. California law calls that sharing personal information for cross-context behavioural advertising; our US State Privacy Rights Notice says so in those words and explains how to opt out. You can switch it off at any time, in the ways described below.

• —What is sent from your browser: the full address of the page you are on, including its query string, and its title; the kind of page it is as a coarse bucket; the conversion action taken where one is reported; the click identifier of the advertisement you arrived through; and — only on a form you submitted — a SHA-256 hash of the email address you typed into it.
• —And one thing worth naming rather than burying: Google's advertising tag sends the full address of the page and its title with every advertising page view and conversion, together with the address of the page that sent you there where your browser provides one, and no setting we can give the tag changes that. On our public website that address names a public page, and the query strings it carries are things such as a search you typed into our blog or resource library, a campaign tag, an affiliate's referral code and the click identifier above. We add a coarse bucket for the kind of page it was — pricing, comparison, integrations, legal, and nine others. The pages you read and that bucket are what make a remarketing audience possible, so with advertising accepted you may later be shown our advertisements elsewhere because of what you read here.
• —What is sent from our servers, separately and only after a purchase: the click identifier, an internal account reference, the amount and currency of the first invoice, when it was paid, and a consent signal stating that the visitor allowed advertising measurement and that the report may not be used to personalize advertising, as described above — no email address and no hash of one.
• —What is never sent: names, organization names, raw email addresses, and any captured activity, window title, screenshot or other data belonging to a customer's workforce. Nothing the monitoring software records about anyone reaches Google, through this tag or any other. A person who signs in and browses the application is a website visitor for this purpose like anyone else, and what they chose about cookies governs — but the two are entirely separate paths and they do not meet.
• —Where it runs: our public website, and in the signed-in application only on the pages where an account is created — the sign-up form, the email confirmation page and first-time setup — on production hosts only. On those pages it is there to report that an account was created: it sends no page views of its own and asks for no advertising personalization, though Google's tag still sends the address and title of the page it starts on, as described above. Those addresses name the page and nothing else — an email address handed to the sign-up form in its link is removed from the address before the tag reads it. No other page of the application configures the tag, and leaving those pages withdraws it. The advertising tag is not loaded in our non-production environments, on the public certificate verifier, or in embedded views.
• —Google acts as our sub-processor for this and is listed, with what it receives and where, in our Sub-processor list.

Advertising in ChatGPT

We also advertise WorkMonitor in ChatGPT, through OpenAI's advertising platform, and measure which of those advertisements led to a demo request, an account or a purchase. It is the same advertising permission as in the previous section — one answer covers both — and it is refused in the same ways: Decline in the cookie banner or Cookie Settings, "Do Not Sell or Share My Personal Information", or a Global Privacy Control signal.

On our public website, and only where advertising is allowed for you, we load OpenAI's measurement script. Unlike Google's tag it has no cookieless mode, so where advertising is not allowed — in the UK or the EU before you accept or after you decline, after an opt-out anywhere, or under a Global Privacy Control signal — it is not loaded at all and OpenAI receives nothing from your browser. It is never loaded in the signed-in application, in our non-production environments or on the public certificate verifier. The script can read form fields and send OpenAI a hash of any email address, phone number or name it finds there. Our site checks that setting before loading the script and does not load it while the setting is on, so no form field on our site is ever read this way.

When you arrive from one of our ChatGPT advertisements the address carries a click identifier, oppref. As with Google's, it is held in the page's memory until advertising is allowed for you, which is not storage and needs no permission, and is then written to the wm_oppref cookie so that an account created in the following 30 days can be matched to the advertisement.

Two reports are made from our servers, and only for an organization created from a visit that carried that click identifier and for which advertising was allowed: once when the organization is created, and once if it pays its first invoice. Each carries the click identifier, the random browser identifier described above where there is one, when it happened, the page it belongs to and, for the payment, the plan, the amount and the currency. Neither carries an email address or a hash of one, a name, an IP address, or anything the platform captures.

• —What is sent from your browser: each page view and each conversion on our site — such as a demo request, a click on a sign-up button, a plan picked or a newsletter sign-up — with the kind of page it happened on as a coarse bucket; the address of the page and of the page that sent you there, each without its query string or fragment; the click identifier and the random browser identifier. As with any request, it reaches OpenAI with your IP address and browser details.
• —What is sent from our servers: the two reports above, and nothing else.
• —Every report, from your browser or from our servers, tells OpenAI that it may not be used to personalize advertising.
• —What is never sent: email addresses, in the clear or hashed; names and organization names; and any captured activity, window title, screenshot or other data belonging to a customer's workforce. Nothing the monitoring software records about anyone reaches OpenAI.
• —Switching advertising off stops the script at once, deletes the wm_oppref, __oppref and __obref cookies, and tells our servers to delete the stored click identifier and cancel any report not yet sent.
• —OpenAI acts as our sub-processor for this and is listed, with what it receives and where, in our Sub-processor list.

Your session is not a cookie

When you sign in to the WorkMonitor dashboard, your session is held as a token in your browser's local storage rather than in a cookie. It is sent as an authorization header on requests to our API.

That is a deliberate design choice, and it has a consequence worth stating: clearing site data signs you out, and a browser configured to block all storage for our domain cannot keep you signed in at all.

Signing out, or closing your account, removes the token from your browser.

Third-party cookies

Some third-party services we use set their own cookies when their content loads.

• —These providers act as our sub-processors and are listed, with what each is engaged to do and where it processes data, in our Sub-processor list. Their own privacy policies describe the cookies they set: Intercom at https://www.intercom.com/legal/privacy, Stripe at https://stripe.com/privacy, Google at https://business.safety.google/privacy/ and Smartlook at https://help.smartlook.com/docs/privacy-policy.
• —Our public API reference page loads its viewer and fonts from a content delivery network. That sends your IP address and browser details to those hosts, but sets no cookie and carries no account data. It is described in the Sub-processor list.

Consent, and changing your mind

Strictly necessary cookies are set without asking, because the site and the sign-in process cannot function without them. Every privacy law we are subject to permits this.

In the UK, the EU, the rest of the European Economic Area and Switzerland, everything else waits for you. When you first arrive the banner asks about two things in one question — analytics with website session recording, and advertising with the conversion measurement that goes with it — and offers one Accept and one Decline, each covering both. Until you answer, no cookie of either kind is set: Google's Consent Mode defaults every storage category to denied there, so a visitor who never answers is treated as a visitor who declined, with the cookieless signals described above.

Everywhere else there is no banner on arrival: analytics, website session recording and advertising are on, and the two footer controls below are how you switch them off.

The two answers are recorded separately, in wm_consent and wm_consent_ads, because they are separate permissions in law even where they are asked together. That separation does real work in one case: if you accepted analytics under an earlier edition of this page, you were never asked about advertising, so advertising is treated as refused for you and the banner opens once more to put the question properly. Your analytics choice is not disturbed while that happens, and measurement keeps running on the answer you already gave.

If your browser sends a Global Privacy Control signal, we do not ask about advertising at all. It is recorded as refused, no advertising cookie is written, and the banner tells you that your browser's signal was honoured rather than quietly acting on it. The signal also overrides an advertising acceptance already recorded in that browser: turning it on withdraws that acceptance rather than being ignored because an answer was already on file. Analytics may still be offered, because that signal is an opt-out of sale and sharing rather than a refusal of measurement.

There are two controls in our footer and they do two different things, so it is worth being exact about which is which. Cookie Settings opens the banner, wherever you are, which asks both permissions together: Accept there grants analytics and advertising, Decline refuses both, and it cannot be used to keep one and drop the other. "Do Not Sell or Share My Personal Information" beside it is the advertising-only control: one click records a refusal of advertising, leaves your analytics decision exactly where it was — including leaving it unanswered if you have not answered it — and asks nothing further.

What a withdrawal actually removes. Switching analytics off stops any session recording, deletes the analytics cookies already set together with what Smartlook stored in your browser, and stops the tag storing anything new; in the UK and the EU the cookieless signals described above continue. Switching advertising off stops advertising storage immediately — and, outside the UK and the EU, every advertising signal from your browser — deletes the advertising cookies already set — wm_gclid, and Google's _gcl_au, _gcl_aw, _gcl_dc, _gcl_gb, _gcl_gs and _gac_* cookies — and sends a request to our own servers to delete the click identifier stored against your account, along with any conversion that has been queued and not yet reported. That last part matters: the cookies are the half of a withdrawal you can check for yourself, and the stored record is the half you cannot. Switching off takes effect immediately, and the site behaves exactly as it does otherwise.

The attribution cookie is set only when you follow a referral link, and only records a code the partner already published. You can remove it with your browser's controls, which affects nothing except whether that partner is credited.

How to control cookies in your browser

Every major browser lets you see the cookies stored for a site, delete them, and block new ones. The controls are usually under Settings, then Privacy.

You can also browse in a private or incognito window, which discards cookies and local storage when you close it.

Blocking strictly necessary cookies will stop single sign-on from working, and will mean we ask about analytics on every visit because the record of your answer cannot be kept. Blocking local storage for our domain will stop you from staying signed in. Neither will stop you reading the public parts of our website.

Browser-level signals: we honour the Global Privacy Control signal, and since version 3.1 of this policy it does something concrete rather than something notional — it refuses advertising and conversion measurement for you, without asking and without a click. We do not respond to Do Not Track, because no common standard exists for what a site should do with it, and we would rather say so than imply a response we do not make.

Changes to this policy

We will update this policy whenever we add, remove or change a cookie, and always before a new non-essential cookie is set. That is a sequencing commitment rather than a formality, and the advertising cookies added in version 3.1 are where it was tested: they are described here in the same release that carries the tag, and none of them can be written until you have accepted a banner that names advertising and conversion measurement in terms.

The effective date at the top shows when the current version took effect, and every change is recorded in our Legal Change Log.

Questions: privacy@workmonitor.ai.