Cookies & Consent

Our tracker (pulse-oem-1.1.8.js, served per-tenant from cdn.menoinfra.com/p/<tracking-id>.js) runs on your site to identify companies and, where consent allows, people visiting from your target audience. The tracker’s default posture is deliberately conservative: no cookies, no persistent client identifiers, no form-value reading. The underlying identification pipeline still touches personal data, and different jurisdictions treat that differently. This guide covers exactly what the tracker stores, what it sends, and how it interacts with consent managers.

What the tracker sets and stores

No cookies. No localStorage.

The tracker (pulse-oem-1.1.8.js, served at cdn.menoinfra.com/p/YOUR_TRACKING_ID.js) sets no cookies and writes no localStorage entries of its own. Every visitor is tab-scoped and forgotten when the tab closes. (The tracker may read from localStorage if a CMP such as Framer’s built-in banner stores its own consent state there, but it never writes to it.)

sessionStorage

sessionStorage is not shared across tabs, not preserved across browser restarts, and cannot be read by other origins. Under UK/EU cookie law it is treated more permissively than a persistent cookie, though the underlying tracking activity may still require consent. See the jurisdictional table below.

Data sent to Warm AI’s edge function

Each page view and session event sends the following to our beacon endpoint at https://t.menoinfra.com/api/track:

• url, path, title, referrer (the visitor’s current page)
• event_type: session_start, page_view, or session_end
• user_agent (browser + OS string)
• The session token (session_token) from sessionStorage
• On session_start only: any UTM parameters (utm_source, utm_medium, utm_campaign, utm_term, utm_content) present in the current URL’s querystring
• On session_end / page_view: duration_seconds, scroll_depth, active_seconds (time on page while the tab is visible and the user is actively interacting)
• Visitor IP address (attached server-side from the request, used for company identification via reverse-IP resolvers)

Person-level identification

For a subset of US visitors, Warm surfaces individual identity signals (LinkedIn URL, name, job title, business email, company firmographics) alongside the standard company-level identification. This runs server-to-server. No additional third-party pixel, script, or host is loaded in the browser beyond our own tracker file.

The flow:

1. Your visitor loads pulse-oem-1.1.8.js from our CDN.
2. The tracker sends a session-start beacon to our edge function.
3. If the visitor’s IP resolves to a US location and our identification providers have coverage for that IP, an identity match is delivered to us via a server-to-server webhook.
4. We attribute the match to your account and deliver it to your dashboard, webhook, or integrations.

Because no third-party script is loaded in the browser, you do not need to declare any additional host in your CMP configuration, cookie policy, or third-party sub-processor list beyond our own tracker. Our named list of identification-provider sub-processors is covered in /legal/tracker §8 — email support@getwarmai.com for the current full DPA / Trust Centre references.

Person-level identification is enforced US-only at the resolver layer, so non-US visitors are silently filtered before any person-level data is exposed. For opt-out requests, email support@getwarmai.com with either the visitor’s email, LinkedIn URL, or IP, and we’ll add them to the global exclusion list across all our sources.

Automatic geo-fencing (built into the tracker)

Since pulse-oem-1.1.8 (currently the global default), the tracker resolves the visitor’s country + region at the edge (Cloudflare) and routes them into one of three tiers before any beacon fires:

This tier logic runs before any tracking activity, so you do not need to configure geo-blocking yourself.

Jurisdictional quick-reference

Supported consent management platforms

The tracker auto-detects consent from the following CMPs. If any of these are installed on your site, you don’t need to tag our script manually. The tracker reads their state via each vendor’s documented API:

Termly is not in the auto-detect list. If you use Termly, tag our tracker manually (see below) and Termly will unblock it once the visitor consents.

The tracker waits up to 10 seconds for a CMP to load before deciding “no CMP present”. This handles lazy-loaded enterprise CMPs that stall until page interactivity.

For customers without a CMP: Klaro auto-inject

If you don’t have (or don’t want to install) a CMP, we can auto-inject Klaro, a lightweight open-source cookie banner, on your site. It’s opt-in per account and enabled during onboarding or via support request. When enabled, the tracker checks for an existing CMP first, and only injects Klaro if no other CMP is detected within 10 seconds.

Klaro is loaded from our CDN (cdn.menoinfra.com/klaro.js), styled minimally, and behaves as a standard “accept / decline” banner. Users who accept unlock person-level identifications for their session; users who decline get no tracking beyond what your jurisdiction allows without consent.

To enable Klaro auto-inject on your account, contact support or use the checkbox in the tracker install screen at warmai.uk .

Manual tagging (advanced)

If you prefer to tag our tracker explicitly rather than rely on auto-detection (for example, to override the category classification), the standard pattern is:

Cookiebot

<script
  src="https://cdn.menoinfra.com/p/YOUR_TRACKING_ID.js"
  async
  data-cookieconsent="statistics"
></script>

Use marketing instead of statistics if you’d like to be explicit about person-level identification being marketing-adjacent. Cookiebot enforcement guidance varies by industry.

OneTrust

<script
  src="https://cdn.menoinfra.com/p/YOUR_TRACKING_ID.js"
  async
  class="optanon-category-2"
></script>

optanon-category-2 typically maps to Performance cookies; verify in your OneTrust dashboard. Use optanon-category-4 for Marketing if that’s a better fit.

Termly

<script
  src="https://cdn.menoinfra.com/p/YOUR_TRACKING_ID.js"
  async
  type="text/plain"
  data-categories="analytics"
></script>

Termly replaces type="text/plain" with type="text/javascript" after consent.

If you don’t use a consent manager and don’t want Klaro

If your site has no CMP and Klaro auto-inject is disabled:

For US / Tier A visitors: the tracker fires normally. Disclose the tracker in your privacy policy and reference our compliance email as the opt-out channel from your California “Do Not Sell or Share” flow.

For UK, EU, and other Tier B visitors: the tracker silently skips. You will not see identifications for those visitors. If a meaningful share of your target audience is in the EU or UK, either enable Klaro auto-inject (recommended) or install a CMP from the supported list.

Data subject rights (GDPR / CCPA)

Visitors can exercise rights over their data: access, deletion, correction, portability (GDPR), or opt-out of sale (CCPA). Here’s how to handle these requests:

Finding a visitor’s data: Because we don’t set persistent client-side identifiers, the primary key for a visitor’s activity is their session token combined with their IP address and the timestamp of their visit. If a visitor asks about a specific session, we need the approximate date/time and IP to locate it. For person-level identifications, the primary key is the resolved email address or LinkedIn URL.

Deletion requests: Contact Warm AI support with the details above. We will delete all session events, identifications, and downstream records linked to that visitor.

Export requests: Email support@getwarmai.com with the identifier and we’ll export the associated records. Format depends on the underlying data (typically CSV or JSON).

Retention: Session events and identification records are held as product logs and security telemetry, retained per our Privacy Policy  (typically 30 to 180 days). Contact us if your account requires a specific retention window.

Person-level opt-out: Email support@getwarmai.com with the visitor’s email, LinkedIn URL, or IP. The exclusion is applied at the resolver layer, so the visitor will not appear in person-level identifications on any Warm-tracked site.

Our internal compliance stance

We built the tracker with a minimal-footprint principle: no cookies on the standard build, no persistent client identifiers, no form-value reading, no fingerprinting, no third-party pixel loading. Consent handling is server-tier-aware. The tracker geo-fences at the edge before any beacon fires, and defaults to skip-on-unknown for consent-required jurisdictions. Person-level identification runs server-to-server so your CMP configuration only needs to cover our one script, not a chain of third-party pixels.

Our infrastructure runs on Supabase (US region) and Cloudflare (used as reverse proxy, CDN, and WAF; international transfers governed by EU Standard Contractual Clauses with the UK Addendum, per our privacy policy). We do not sell visitor data to third parties.

If you have compliance questions that aren’t answered here, email us at support@getwarmai.com.