Small pieces of storage, used for clear reasons.

The “sairo_session” cookie keeps an authenticated account signed in. It is HTTP-only, uses SameSite=Lax, is secure in production, and expires after 30 days. The server stores only a hash of the session token and lets a user revoke active sessions.

The “sairo_workspace” cookie remembers which authorised workspace to open when an account belongs to more than one. It has the same 30-day security settings and contains a workspace identifier, not a password or payment detail.

Connecting an AI application also uses the temporary “sairo_mcp_flow” cookie. It binds the OAuth approval to the browser that started the connection, is HTTP-only with SameSite=Lax, is secure in production, expires after ten minutes and is cleared after a completed approval or denial. The cookie does not give the external application your sign-in session.

The signed-in interface can store the “sairo-workspace-theme” preference in local storage so it can remember light, dark, or system appearance. Removing that value returns the interface to its default.

The public demo can set a first-party “sairo_demo” cookie for 24 hours so “Keep this assistant” can carry the demo into sign-up. It stores only the demo slug, uses SameSite=Lax, and is not required for browsing. The embedded widget remembers a site-specific conversation reference in session storage. This lets AI or live chat reconnect after a page refresh within the same browser session. The widget does not use a third-party advertising identifier or place a cross-site tracking cookie.

You can remove cookies and local storage through browser settings. Removing the session cookie signs the account out; removing the workspace choice or theme preference resets that convenience. Blocking essential storage can prevent account and workspace features from working correctly.

Because the current public website does not use optional advertising or analytics cookies, it does not display an optional-cookie preference banner. If that changes, Sairo must update this notice and add the consent controls required for the affected visitors before enabling those technologies.

A business that installs the Sairo widget remains responsible for the cookie and privacy notice on its own website. It should explain how visitor questions and optional contact details are used and identify any other technology that website loads.

Other services on the host website may use their own cookies. This Sairo notice does not describe the customer’s analytics, consent manager, commerce platform, or other third-party tools.