1. The short version
Our website and the application use a small number of first-party cookies and local storage. What keeps the site working and remembers the choices you make is always on. Analytics (our own measurement of how people use the website and the application, to improve them) runs only if you say yes, separately on the website and in the application, and you can withdraw at any time. On the website you can also switch on session recordings, a second and separate yes, in the cookie settings. We use no advertising or marketing cookies, and no third-party analytics or tracking tools.
2. On our website (sena.systems)
| Name | Type | Category | Purpose | Kept |
|---|---|---|---|---|
sena-consent | Local storage | Strictly necessary | Your answers to the cookie notice (analytics, and session recordings, yes or no) and the notice version, so you are not asked again | Until you clear it, or until we change the notice version and ask again |
sena-landing-theme | Local storage | Functional (a preference you set yourself) | Light or dark mode | 12 months |
sena-landing-language | Local storage | Functional (a preference you set yourself) | Your language (EN/RO/DE/FR/ES) | 12 months |
sena_vid | Cookie, set for sena.systems and its subdomains | Analytics (only if you accept) | A random visitor number, so that visits by the same browser can be counted as one visitor, and linked to your use of the application if you also allow analytics there | 12 months from when it is set, not renewed |
sena_sid | Cookie, sena.systems | Analytics (only if you accept) | A random visit number, so the pages of one visit are counted together | 30 minutes after your last page view |
sena_ft | Cookie, set for sena.systems and its subdomains | Analytics (only if you accept) | Where your first visit came from: the referring site's name, the campaign tags, the first page and the day, so a later sign-up can be credited to it | 90 days from your first visit, not renewed |
sena_exp | Cookie, set for sena.systems and its subdomains | Analytics (only if you accept) | Which version of a page you were shown while we compare two versions, such as pricing-walkthrough-cta:control, so you see the same one every time. Set only while such a comparison runs | 90 days |
sena_rec | Cookie, sena.systems | Session recordings (only if you switch them on) | Whether this visit is one of the 1 in 4 that are recorded | 30 minutes after the last recorded moment |
We remember your theme and language because you asked for them by clicking; the picker says "remembered on this device". Clearing them in the settings panel resets the site. Fonts are served from our own servers; the website loads nothing from Google Fonts or any other third-party server.
3. In the application
The application (app.sena.systems and each customer's own address on sena.systems) uses:
| Name | Set by | Category | Purpose | Kept |
|---|---|---|---|---|
__session (cookie, the application's address) | Our identity provider, Clerk | Strictly necessary | Your session token, renewed while you use the application | Session |
__client_uat and __client_uat_<suffix> (cookies, .sena.systems) | Clerk | Strictly necessary | When your sign-in was last confirmed; set when you open the sign-in page | Set by Clerk for 10 years; Chrome and Edge keep a cookie for at most 400 days |
__client (cookie, clerk.sena.systems or the customer's own Clerk address) | Clerk | Strictly necessary | Identifies this browser to Clerk and keeps you signed in between visits; set when you open the sign-in page | Set by Clerk for 10 years; Chrome and Edge keep a cookie for at most 400 days |
__clerk_handshake (temporary cookie) | Clerk | Strictly necessary | Completes sign-in; deleted immediately after | Seconds |
__cf_bm (cookie, the Clerk address) | Cloudflare, which Clerk uses to protect its sign-in service | Strictly necessary | Tells people from automated traffic, to protect sign-in | 30 minutes |
_cfuvid (cookie, the Clerk address) | Cloudflare, for Clerk | Strictly necessary | Applies rate limits fairly to visitors who share an address | Until you close the browser |
sessionid, csrftoken (cookies, the application's address) | The application | Strictly necessary | A server-side session and protection against cross-site request forgery, where a feature needs them | Session: 24 hours. Anti-forgery token: up to 12 months |
__Host-sena-support-session (cookie) | The application | Strictly necessary | Set only in the browser of a SENA support engineer during a support session your organisation allowed | Until that support session ends |
| Interface state and preferences (theme, language, sidebar, the workspace you selected, drafts, dismissed hints) | The application (local and session storage) | Functional | Remember your layout and what you were doing | Local storage until cleared; session storage until the tab is closed |
sena_vid, sena_sid (cookies) | The application | Analytics (only if you allow usage analytics) | The same random visitor and visit numbers as on the website (section 2). When you sign up, the application also reads sena_ft, if the website set it, to credit the sign-up to where your first visit came from | 12 months and 30 minutes, as above |
sena.ua.queue (session storage) | The application | Analytics (only if you allow usage analytics) | Usage events not yet accepted by our server, so a reload does not lose them | Until the tab is closed |
The Clerk cookies are set on our domains; their contents are sent to Clerk, Inc. in the United States (Privacy Policy, section 5). The sign-in page also loads Clerk's own scripts and images from Clerk's servers (clerk.sena.systems, img.clerk.com). Payment pages hosted by Stripe set Stripe's own cookies under Stripe's cookie policy; we do not embed Stripe scripts on our pages.
Usage analytics in the application is a separate question from the website's, asked once after you sign in and changeable at any time in Settings → Privacy. Your answer is stored with your account on our servers, so it applies wherever you sign in.
4. Categories and defaults
| Category | Default | In use |
|---|---|---|
| Strictly necessary | Always on | Yes (the items marked so above) |
| Functional | On for choices you make yourself; no consent needed because you set them | Yes |
| Analytics | Off until you say yes | Yes: our own website analytics and in-app usage analytics, each with its own yes or no |
| Session recordings | Off until you switch them on in the website's cookie settings, and only together with analytics | Yes: on the website only, never in the application |
| Marketing | Off | None |
5. Your choices
On the website, the notice on your first visit asks whether you accept analytics; "Reject" is as easy as "Accept". Session recordings are not in the notice: you can switch them on, and off again, in the cookie settings. Change your answers at any time from the footer link "Cookie settings" or the "Open cookie settings" button on this page, which also lets you clear stored preferences. In the application, use Settings → Privacy → Usage analytics.
If your browser sends Global Privacy Control, we treat it as a no on the website and in the application, and do not ask.
When you withdraw your consent, the analytics cookies are deleted from your browser and we delete the analytics data recorded under them. Switching session recordings off stops the recording and deletes your recordings. Blocking strictly necessary storage will break sign-in, and the notice will reappear.
6. What analytics records, where it goes and how long we keep it
With your consent we record: the pages you view (on the website their path; in the application the type of page, such as "a customer record", never the record itself, and never anything you type), how long each page was visible, the site or campaign that brought you (the referring site's name and the utm_ tags in the link, never the full referring address), goals such as sending the contact form, where on a page you click (which element, never its text, and where on the page) and how far you scroll, clicks that suggest something did not work (several quick clicks on one spot, or a click on something that does nothing), which version of a page you saw while we compare two versions, how fast pages loaded, your type of device, browser and operating system, screen size, language and time zone, and your country, region and city.
With your consent, we also measure how much of a story film you actually play (seeking does not count), how long each major page section is on screen while the tab is visible, and whether a walkthrough was booked. Booking analytics contains no name, email address or time slot.
We work out the country, region and city from your IP address when your visit reaches us, using a location database we keep on our own servers (no one else is asked), and then discard the address: we do not store it. We read the browser name from your browser's user-agent string and do not store that string either. In the application we record your user number and your organisation's number, not your name or email address.
The data is processed by SENA's own systems in our OVHcloud environment in France. It is not shared with anyone and not sold, and it is not used for advertising. We keep it for 13 months after the visit and then delete it; individual clicks we keep for 30 days, and after that only click maps that add up everyone's clicks per page and hold no identifier, for 25 months. When you accept, the first analytics message records that you did and which version of this notice you saw; it is deleted with the rest of your analytics data.
If you also switch on session recordings, 1 in 4 of your visits to the website is recorded: how the page's content and layout changed and where your pointer moved and clicked, which lets us replay the visit to see where the site is confusing. It is not a video of your screen. Everything you type into a field is hidden in your browser before anything is sent, forms (such as the contact form) are left out entirely, and we record no network requests and no console output. A visit is recorded for at most 30 minutes. Recordings are stored with the rest of your analytics data, kept for 30 days and then deleted, and can be watched only by SENA staff who operate our systems. They are never recorded in the application.
7. Legal basis
Strictly necessary storage is exempt from consent under Law 506/2004 art. 4(6)(b) (storage strictly necessary to provide a service you explicitly requested) and Directive 2002/58/EC art. 5(3). For analytics and for session recordings we ask for your prior consent, separately, under Law 506/2004 art. 4(5) and the equivalent rules where you are, to the standard of GDPR art. 4(11) and art. 7, and process the resulting data on the basis of GDPR art. 6(1)(a).
8. Contact
Thoth AZ Solutions S.R.L. · privacy@sena.systems · Related: Privacy Policy (sena.systems/privacy).