legal
Cookie Policy
Last updated: 20 October 2026
1. What is a Cookie?
A cookie is a small text file placed on your device (computer, tablet, smartphone) when you visit a website. Cookies enable the website to recognise your browser on subsequent visits, to remember your preferences and to collect browsing data.
This policy also applies to similar technologies such as pixels, web beacons, local storage (localStorage) and tracking identifiers.
2. Management of Your Consent
On your first visit to enrow.io, a cookie consent banner enables you to choose the categories of cookies you wish to accept. You may change your preferences at any time by clicking the "Manage my cookies" link at the bottom of each page of the website.
Strictly necessary cookies do not require your consent.
All other cookies (analytics, marketing, preferences) shall only be placed after your express prior consent, in accordance with Article 82 of the Loi Informatique et Libertés and the CNIL recommendations of 17 September 2020. The only exception is the affiliate and referral programme cookies described in 3.5: they are placed without waiting for your choice in the banner, because these programmes need them to work, and refusing cookies in the banner does not remove them.
3. Categories of Cookies Used
3.1 — Strictly Necessary Cookies
These cookies are essential to the operation of the website and the Service. They cannot be disabled. They do not require your consent.
| Cookie / Service | Provider | Purpose | Duration | Type |
|---|---|---|---|---|
| enrow_consent | enrow (first-party) | Records the user’s consent status for the various cookie categories. | 12 months | HTTP cookie |
| enrow_ads_consent | enrow (first-party) | Shares your advertising consent choice with app.enrow.io, so that a single decision applies across the whole service. | 12 months | HTTP cookie |
| enrow_measurement_consent | enrow (first-party) | Shares your analytics (audience measurement) consent choice with app.enrow.io, so that a single decision applies across the whole service. | 12 months | HTTP cookie |
| Session cookie | ENROW | Maintenance of the authenticated user session (JWT). Identification and authentication. | Session | HTTP cookie |
| CSRF token | ENROW | Protection against Cross-Site Request Forgery attacks. | Session | HTTP cookie |
| Stripe cookies | Stripe | Required for the secure processing of card payments (3D Secure, fraud detection). | Session | HTTP cookie |
| Cloudflare Turnstile | Cloudflare | Bot protection of the rights exercise form and of the free email finder and verifier. Loaded when the rights exercise form page opens, and on the finder and verifier only once you start using it (first click, tap or keyboard focus on the tool); reads technical signals from your browser to tell a person from automated traffic. Never used for advertising. | Session | Script + challenge iframe (challenges.cloudflare.com) |
3.2 — Functional Cookies
These cookies enhance your experience by remembering your preferences. They are subject to your consent.
| Cookie / Service | Provider | Purpose | Duration | Type |
|---|---|---|---|---|
| Intercom cookies | Intercom | Support widget: user identification, conversation history, chat preferences. | 9 months | HTTP cookie + localStorage |
| HubSpot cookies (__hs*) | HubSpot | Contact forms, live chat. Stores interactions with forms and commercial support. | 13 months | HTTP cookie |
| Google Fonts | Loading of typefaces from Google servers (fonts.googleapis.com). Transmits the visitor’s IP address to Google upon loading. Subject to consent. | None (HTTP request) | External request | |
| YouTube (yt-*, VISITOR_INFO*, YSC) | Embedding of YouTube videos (privacy-enhanced mode youtube-nocookie.com where available). May place cookies to store playback preferences and track video interactions. | 6 to 18 months | HTTP cookie + localStorage | |
| Cal.com (embedded booker) | Cal.com | Demo booking widget on /book-demo. Loads an app.cal.com iframe when the form is submitted, and may set cookies to carry the booking session. | Session to 1 year | External request + HTTP cookie |
3.3 — Analytics Cookies (Audience Measurement)
These cookies enable us to measure website and Service traffic, to understand how visitors use ENROW and to improve our offering. They are subject to your consent.
| Cookie / Service | Provider | Purpose | Duration | Type |
|---|---|---|---|---|
| HubSpot analytics (__hstc, hubspotutk, __hssc) | HubSpot | Visit tracking, identification of returning visitors, traffic source attribution. | 13 months | HTTP cookie |
| Google Analytics (_ga, _ga_*) | Measurement of the audience of enrow.io: pages visited and how you browse them (scrolling, clicks on buttons and on links to other sites, searches on the site, interactions with forms, video plays, file downloads), traffic sources, demo bookings and use of the free tools, never what you type in forms or in the tools. Set on enrow.io only, once you have accepted analytics cookies (nothing is measured before); app.enrow.io reads their identifiers on its sign-up page and when you sign in with your Google account, and only uses them when an account is created (see below). Page and link URLs are sent to Google without the email addresses or identifiers they may contain. | 13 months | HTTP cookie |
If you create an account on app.enrow.io after accepting analytics cookies, the identifiers of the Google Analytics cookies are recorded with your account, together with the date and version of your consent (no Google tag is loaded on app.enrow.io). Our servers use them to send Google Analytics your sign-up (with the method used: password or Google account) and your first payment (amount excluding tax, currency and a technical reference of the payment), without ever sending your email address or your IP address. These identifiers are deleted from your account 90 days after sign-up, or earlier once our servers learn that you have withdrawn your consent (see 5.1) or if you request the deletion of your account. For Google Analytics, Google acts as our processor.
3.4 — Marketing and Advertising Cookies
These cookies are used to serve you relevant advertisements on third-party platforms and to measure the effectiveness of our campaigns. They are subject to your consent.
| Cookie / Service | Provider | Purpose | Duration | Type |
|---|---|---|---|---|
| Google Ads (_gcl_*, _gac_*) | Google Ads conversion tracking. Measurement of advertising return on investment. Retargeting. | 90 days | HTTP cookie + pixel | |
| Meta Pixel (_fbp, _fbc) | Meta | Facebook/Instagram conversion tracking. Creation of custom and lookalike audiences. Retargeting. | 90 days | HTTP cookie + pixel |
| LinkedIn Insight Tag (li_*, ln_or, bcookie) | LinkedIn Ads conversion tracking. Demographic analysis of visitors (sector, company size, role). Retargeting. | 6 months | HTTP cookie + pixel | |
| X Ads Pixel (muc_ads, personalization_id) | X (Twitter) | X (Twitter) Ads conversion tracking. Audience building and retargeting on X. | 13 to 24 months | HTTP cookie + pixel |
| enrow_click_id | enrow (first-party) | Stores the identifier of the ad click that brought you to the site (gclid, gbraid or wbraid for Google Ads, twclid for X) and the date of the click. Set on enrow.io, or on app.enrow.io when you arrive there from an ad, only once you have accepted marketing cookies. If you then create an account, the Google Ads identifier is recorded with it (see below). | 90 days from the click (30 days for twclid) | HTTP cookie |
Conversions reported by our servers to Google Ads: if you create an account on app.enrow.io after clicking one of our Google ads and accepting marketing cookies, the identifier of that click (gclid, gbraid or wbraid), the date of the click and the date and version of your consent are recorded with your account. Our servers then report your sign-up, your first use of the Service and your first payment (amount excluding tax, currency) to Google Ads with this identifier and a technical reference of each event, so that we can measure which ads bring sign-ups and customers. They never send your email address or your IP address. The identifier is deleted from your account 90 days after the click (90 days after sign-up if the date of the click is unknown), or earlier once our servers learn that you have withdrawn your consent (see 5.1) or if you request the deletion of your account. For Google Ads, Google acts as an independent controller.
Google’s tag is only loaded on enrow.io, and only once you have accepted marketing cookies (Google Ads) or analytics cookies (Google Analytics, 3.3); only the service you accepted is activated. Before you choose, or if you refuse both, it is not loaded and sends nothing to Google. When it loads, Google receives your IP address, as with any request to its servers; since August 2026, Google may use the IP address it receives through its tags to measure and personalise ads. To find out more, see Google’s page How Google uses information from sites or apps that use our services.
3.5 Affiliate (Partnero) and Referral Programme Cookies
These cookies are needed for ENROW’s affiliate programme and, for enrow_partner_ref, its referral programme to work: they credit your sign-up to the partner or the user who referred you to ENROW and, for a partner, allow their commission to be calculated. They are only set when you arrive through a partner’s link (an address containing ?aff= or /prt/ followed by the partner’s key or, on app.enrow.io, the ?partner_ref= parameter that our links add) or, for enrow_partner_ref, through a user’s referral link (see below), except partnero_session_uuid, which is set on every visit. The script of our provider Partnero is loaded from Partnero’s servers on every page of enrow.io and app.enrow.io: as with any resource loaded from a third-party server, Partnero then receives each visitor’s IP address and browser type. These cookies are set without waiting for your choice in the banner and are not removed if you refuse cookies; you can delete them at any time in your browser settings (section 5). They are not used for advertising or profiling. A visit that comes from a paid advertisement (utm_medium or medium parameter equal to cpc or ppc) is not credited. For ENROW’s referral programme, app.enrow.io sets the enrow_partner_ref cookie when you follow a user’s referral link (an address containing ?invite= followed by a code). This cookie keeps a single link, the last one followed, whether it comes from a partner or from a user: your sign-up is credited to one of the two programmes only.
| Cookie / Service | Provider | Purpose | Duration | Type |
|---|---|---|---|---|
| enrow_partner_ref | enrow (first-party) | Key of the partner or referral code of the last link you followed, and date of the click. Credits your sign-up on app.enrow.io to that partner or to the user who invited you (the last click counts), even when Partnero’s script is blocked. | 30 days | HTTP cookie |
| partnero_partner | Partnero | Key of the partner whose link you followed, set by Partnero’s script to count the click and credit it to that partner (the last click counts). | 30 days | HTTP cookie |
| referral_url | Partnero | Address of the page opened by the partner link, kept by Partnero’s script together with the key above. | 30 days | HTTP cookie |
| partnero_session_uuid | Partnero | Random identifier of your browser, set by Partnero’s script on every visit, even without a partner link, and sent to Partnero with clicks on a partner link. | 13 months at most (recalculated on each visit) | HTTP cookie |
When you follow a partner link, Partnero’s script sends Partnero the page address, the identifier above, your browser’s language and screen size, and the referring page. If you then create an account, ENROW sends Partnero your account’s Stripe customer identifier, your email address and the partner’s key, then, during the twelve-month commission period, the reference, date, type (for example subscription, renewal or purchase of credits), currency and amount excluding tax of your payments and of their refunds. For more information, see our privacy policy.
4. Cookie Lifespan
In accordance with CNIL recommendations, the lifespan of cookies shall not exceed thirteen (13) months. Information collected via these cookies shall be retained by ENROW for a maximum period of twenty-five (25) months. The only exception is the partner’s key or the referral code, and the click date, read from the affiliate and referral programme cookies (3.5): if you create an account, they are recorded with it and kept for as long as the account exists.
Your consent shall be renewed every twelve (12) months via the consent banner.
5. How to Manage Your Cookies
5.1 — Via Our Consent Banner
You may change your preferences at any time by clicking the "Manage my cookies" link at the bottom of the page. The consent banner enables you to accept or refuse each category individually. Your choice applies to both enrow.io and app.enrow.io: app.enrow.io also offers a "Manage my cookies" link on its sign-in and sign-up pages and, once you are signed in, in the Privacy section of your profile; this link opens these same preferences on enrow.io. When you withdraw your consent, the Google service concerned stops at once on enrow.io; our servers take the withdrawal into account the next time you open app.enrow.io in that browser while signed in, then stop sending Google the events of the category concerned and delete the corresponding identifier from your account. What Google Ads has already received is kept according to Google’s own retention rules; what Google Analytics has received is kept for 14 months (Privacy Policy, 8).
5.2 — Via Your Browser
You may also configure your browser to accept, refuse or delete cookies:
- Google Chrome: chrome://settings/cookies
- Mozilla Firefox: about:preferences#privacy
- Safari: Preferences > Privacy
- Microsoft Edge: edge://settings/privacy
Please note that disabling certain cookies may affect the operation of the website and the Service.
5.3 — Pixels and Advertising Signals
You may also exercise your choice directly with the advertising platforms:
- Google: https://adssettings.google.com
- Meta (Facebook): https://www.facebook.com/ads/preferences
- LinkedIn: https://www.linkedin.com/psettings/advertising
- YouTube / Google: https://myaccount.google.com/data-and-privacy
- European opt-out (YourOnlineChoices): https://www.youronlinechoices.eu
6. Data Transfers Relating to Cookies
Certain cookies and technologies involve a transfer of data to the United States (Google Ads, Google Analytics, Meta, LinkedIn, Google Fonts, YouTube). Such transfers are governed by the EU-US Data Privacy Framework and, where applicable, Standard Contractual Clauses (SCCs). Transfers to Google (Google LLC) rely on the Data Privacy Framework or, failing that, on the SCCs. These cookies and external requests shall only be triggered after your express consent, as shall the events our servers send to Google Analytics and Google Ads (3.3 and 3.4).
Cloudflare Turnstile, a strictly necessary security tool, involves a transfer to Cloudflare, Inc. (United States, EU-US Data Privacy Framework and SCCs). It is loaded without prior consent, only on the rights exercise form page and once you start using the free email finder and verifier.
Our consent banner is first-party and stores your choices locally in your browser (the date and version of your consent are also recorded with your account in the cases described in 3.3 and 3.4); HubSpot operates within the EEA. No transfer outside the EEA occurs for these services.
7. Legal Basis
In accordance with Article 82 of the Loi Informatique et Libertés and the ePrivacy Directive (2002/58/EC):
- Strictly necessary cookies: exempt from consent (Article 82, paragraph 2). They are essential to the provision of the Service requested by the user.
- Affiliate and referral programme cookies (3.5): placed without prior consent because these programmes need them to work; they are only used to credit a sign-up to the partner or the user who brought it.
- All other cookies: subject to the user’s prior, free, specific, informed and unambiguous consent (Article 82, paragraph 1). Consent is collected via our consent banner before any placement.
Refusing non-essential cookies shall not affect access to the website or the Service.
8. Amendments to This Policy
ENROW reserves the right to amend this cookie policy at any time, in particular to reflect the addition or removal of cookies or to comply with regulatory developments. The date of last update is indicated at the top of this document.
9. Contact
For any enquiry relating to cookies:
- DPO: Louis CONGARD — dpo@enrow.io
- Supervisory Authority: CNIL — www.cnil.fr