The fine print, in plain English.

Small files a website stores in your browser so it can remember things, like your cookie choice.

Needed for the site to work and stay secure, and to remember your cookie preference (the wc_consent cookie, 12 months). These don’t need consent.

We also keep, in your browser’s local storage rather than a cookie, the campaign that first brought you here: the utm parameters and click identifiers of the link you followed and the site that referred you, with the page you landed on and the date (wc_attrib, kept for 90 days). It leaves your browser in three cases only: with a form you submit, so we know which campaign a conversation started from; its source (the utm_source) with the form event that Google Analytics receives (section 03); and, when you open the scheduler, with the booking, where Cal.com keeps the campaign fields and the Meta click identifier as booking notes. We keep this record whatever you choose in the banner, because it is not a cookie and does not leave your browser on its own. A visit with no campaign link and no referring site stores nothing.

The Google Tag Manager script loads on every page. Until you make a choice, and after you reject, every Google signal is denied (Consent Mode): no analytics or advertising cookie is set, and what reaches Google Analytics is a cookieless ping without any identifier of you: the page you view, your IP address and browser, and, when you send a form, book a call or apply for a role, the event with the answers you chose from a list (company size, work areas, the role) and the campaign you came from. The click identifier of an ad you came from is carried in the site’s own links instead of a cookie (URL passthrough). If you accept analytics, Google Analytics measures which pages are useful, in aggregate, with the _ga and _ga_* cookies (2 years), and the form and booking events also carry the random identifier of your form, so we can match them with our records; we may also load Microsoft Clarity and Cloudflare Web Analytics. If you reject, that identifier never goes to Google and none of those tools sets a cookie.

Set by Meta (Facebook and Instagram) through the Meta Pixel, and by Google Ads through Tag Manager (the _gcl_au cookie, 3 months), only if you accept them, so we can tell whether our ads bring people to the site. Meta receives the page you visit, the page that sent you here, your IP address, browser and device data and the _fbp identifier; it also receives “ViewContent” when you open the booking page and, when you send a form or book a call, the event (“Lead” with the company size you chose, “Schedule”) with the random identifier of your form, never what you typed. Google Ads receives the same form and booking events through Tag Manager (section 03 says what they carry). The _fbp and _fbc cookies last up to 90 days and are removed if you withdraw your consent. What Meta and Google do with the data is covered by their own policies.

The Cal.com scheduler loads at step 2 of a booking when you press Continue, or Show calendar, and only then. Cal.com may set its own cookies, and it receives the email and the answers you typed in step 1 to prefill the booking, plus the campaign fields and the Meta click identifier of the link that brought you here, kept as booking notes. Rejecting cookies in the banner leaves this category on, because the scheduler only loads when you ask for it; you can switch it off in the cookie settings, and step 2 then shows a Show calendar button instead of the calendar. Its use is covered by Cal.com’s own policies.

Open “Cookie settings” in the footer at any time to accept or reject analytics and marketing cookies, or to switch the booking category off. If you withdraw consent, it takes effect from the next page load: analytics already running on the page you are on stop once you reload it or open another page; marketing cookies are removed at once.