Cookie policy.

Cookies are small text files written to your browser by the sites you visit. They allow a site to recognise your browser, store preferences, keep you securely signed in, and measure anonymous usage. validant.ai uses cookies sparingly. Strictly necessary cookies are written so the site can run securely and so we can prove your consent decision later on. Everything else is off by default.

Where we mention "cookies" in this policy we also mean equivalent client-side storage (localStorage, sessionStorage, IndexedDB). The same rules apply: nothing beyond strictly necessary storage runs until you say it can.

We rely on the following legal bases for the use of cookies and similar technologies:

• Strictly necessary cookies: we rely on our legitimate interest in running a secure, functioning site (Art. 6(1)(f) GDPR; corresponding bases under revFADP) and on Art. 5(3) ePrivacy Directive's exemption for "strictly necessary" storage.
• Functional, analytics and marketing cookies: we rely on your consent (Art. 6(1)(a) GDPR; Art. 5(3) ePrivacy Directive; Art. 6 revFADP). Consent is informed, specific, granular by category, and as easy to withdraw as to give.

Strictly necessary

Required to deliver the site. These cannot be switched off. They include the session cookie used for security, a consent identifier used to record what you decided and when, and a short-lived CSRF token set on the newsletter subscribe forms to protect those submissions.

Functional

Remembers your preferences (theme, language, dismissed-tooltip flags). Disabled by default. Switching this off means the site forgets your preferences between visits.

Analytics

Aggregated, pseudonymised usage data so we can understand what content is useful. Disabled by default. We use Google Analytics 4 (measurement id G-PQGQ69VDJQ, provided by Google Ireland Ltd.) with IP anonymisation and Google Consent Mode v2. We run Consent Mode in its "basic" form: the Google tag is not loaded at all until you grant analytics consent, so before then no request whatsoever is made to Google. Once you grant consent the tag loads and the _ga and _ga_PQGQ69VDJQ cookies may be written; withdrawing consent stops the tag and clears those cookies. Google may transfer data to the United States; we rely on the EU US Data Privacy Framework and Google's Standard Contractual Clauses for that transfer.

We also use Cloudflare Web Analytics for a simple, whole-site view of traffic. It is cookieless, stores nothing on your device, uses no cross-site identifiers and builds no profile of you, so under the ePrivacy rules it needs no consent and runs for every visitor; we rely on our legitimate interest in basic, privacy-preserving measurement (Art. 6(1)(f) GDPR). It is independent of the Google Analytics consent above and sets none of the cookies listed below.

Marketing

Used to measure the effectiveness of validant.ai campaigns. Disabled by default. We do not place advertising trackers on this site today; this category is reserved so that your consent maps cleanly to industry standards.

The complete list of cookies and similar technologies the site may set, the category each falls under, the purpose and how long they live:

We update this registry whenever we add or remove a cookie. The "Last updated" date at the top of this page reflects the most recent change.

You can change your mind at any time. The dialog below reflects the consent you have given right now in this browser. Buttons below let you update it without leaving this page.

Global Privacy Control & Do Not Track

If your browser sends a Global Privacy Control (GPC) or Do-Not-Track signal, we treat it as a rejection of all non-essential cookies automatically: nothing beyond strictly necessary storage runs, and we record that decision without interrupting you with the banner. You can still override it for this site from the cookie button at any time.

Browser controls

You can also block or delete cookies from your browser. Note that disabling strictly necessary cookies will break parts of the site. Helpful links:

• Chrome: Manage cookies
• Safari: Manage cookies
• Firefox: Manage cookies
• Edge: Manage cookies

Under GDPR Art. 7(1) (read with Art. 5(2)) we must be able to demonstrate that you consented. We keep two records of each decision, and neither identifies you:

• A pseudonymous consent receipt on our side. Each time you make a decision we store a short receipt: the random consent identifier, a server timestamp, the policy version, the categories you allowed, a one-way hash of your browser's user-agent, and the coarse country your request resolved to. It holds no email, no name, no account, and no raw IP address, and is never linked to any other data we hold. This is what lets us produce proof if a decision is ever questioned. We keep it only as long as we need it to demonstrate your consent and to defend against claims, then delete it.
• A local audit ledger in your own browser. The last twenty-five decisions you made are kept on this device so you also hold your own copy, carrying the same consent identifier you can quote back to us.

We record the receipt on the basis of our legal obligation to demonstrate compliance (Art. 7(1) with Art. 5(2) GDPR). The "Erase my consent record" button above wipes the local ledger and resets the banner; to have your server-side receipt erased as well, contact our privacy team and quote the consent id shown above.

If our cookie use changes materially: new categories, new providers, new purposes : we increment the policy version. Your previous consent decision is invalidated and the banner reappears so you can make a fresh, informed choice. We never silently re-classify cookies.