Small pieces of storage, used for clear reasons.

The “__Host-sairo_session” cookie keeps an authenticated browser signed in. It is HTTP-only, Secure, uses SameSite=Lax, and is limited to the host and root path. Its maximum lifetime is 12 hours; the server ends an idle session after 30 minutes. Privileged accounts have an 8-hour maximum and 15-minute idle limit. The server stores only a hash of the token and lets you revoke active sessions.

The “__Host-sairo_auth_flow” cookie holds an opaque reference while you sign in, connect a provider or verify an email. It is HTTP-only and Secure, lasts 10 minutes, and uses SameSite=None so Apple can return to the same sign-in from its secure form. It contains no provider token, password or account data. The “sairo_workspace” cookie remembers which authorised workspace to open when an account belongs to more than one. It lasts up to 30 days, uses HTTP-only, SameSite=Lax and Secure settings, and contains a workspace identifier rather than a password or payment detail.

Connecting an AI application also uses the temporary “sairo_mcp_flow” cookie. It binds the OAuth approval to the browser that started the connection, is HTTP-only with SameSite=Lax, is secure in production, expires after ten minutes and is cleared after a completed approval or denial. The cookie does not give the external application your sign-in session.

The signed-in interface can store the “sairo-workspace-theme” preference in local storage so it can remember light, dark, or system appearance. Removing that value returns the interface to its default.

The public demo can set a first-party “sairo_demo” cookie for 24 hours so “Keep this assistant” can carry the demo into sign-up. It stores only the demo slug, uses SameSite=Lax, and is not required for browsing. The embedded widget remembers a site-specific conversation reference in session storage. This lets AI or live chat reconnect after a page refresh within the same browser session. The widget does not use a third-party advertising identifier or place a cross-site tracking cookie.

You can remove cookies and local storage through browser settings. Removing the session cookie signs the account out; removing the workspace choice or theme preference resets that convenience. Blocking essential storage can prevent account and workspace features from working correctly.

Because the current public website does not use optional advertising or analytics cookies, it does not display an optional-cookie preference banner. If that changes, Sairo must update this notice and add the consent controls required for the affected visitors before enabling those technologies.

A business that installs the Sairo widget remains responsible for the cookie and privacy notice on its own website. It should explain how visitor questions and optional contact details are used and identify any other technology that website loads.

Other services on the host website may use their own cookies. This Sairo notice does not describe the customer’s analytics, consent manager, commerce platform, or other third-party tools.