Cookie policy

Version 1.0 · Effective October 28, 2026 · Last updated October 28, 2026

---

Part A: Cookie policy

1. What this policy covers

This policy explains how outwerk.ai (the "site"), operated by Vivek Yogesh Doshi, trading as Outwerk, Mumbai, Maharashtra, India ("Outwerk", "we"), uses cookies and similar technologies, what they do, and how you can control them. It should be read with our privacy policy at outwerk.ai/privacy/.

2. What cookies and similar technologies are

A cookie is a small text file that a website stores on your device. Similar technologies include localStorage and sessionStorage (browser storage that works like a cookie), pixels (tiny images or scripts that report when a page loads or an action happens) and device fingerprinting signals. In this policy "cookies" covers all of these.

Cookies can be first-party (set by outwerk.ai) or third-party (set by another company whose code runs on our page). They can be session cookies (deleted when you close the browser) or persistent cookies (kept until they expire or you delete them).

3. Our approach

The site works without any non-essential cookies. Our analytics tool, Plausible, does not use cookies at all. The chat widget and advertising pixels load only after you choose to accept them. Before you choose, nothing in those categories runs, and the Google tags operate in a "consent denied" state that sets no advertising cookies.

4. Categories

5. Cookies we expect on the site

The table lists the cookies and storage we expect each provider to set when it runs. Vendors change their cookies without notice, so we re-scan the site regularly and update this table. Durations are maximums set by the provider.

Where a Google tag runs before you have accepted marketing, it runs in Consent Mode v2 with all consent signals denied. In that state Google sets no cookies and receives only cookieless pings that cannot identify you. If you later accept, the cookies above are set from that point.

6. How to manage your choices

• Consent banner. On your first visit (and again after a material change to this policy) a banner lets you accept all, reject all, or choose categories. Both "Accept all" and "Reject all" are one click.
• Cookie preferences link. The footer of every page has a "Cookie preferences" link that reopens the banner so you can change or withdraw consent at any time. Withdrawal takes effect immediately for new data; cookies already set are deleted where we control them and expire on their own where we do not.
• Global Privacy Control. If your browser sends a Global Privacy Control signal, we treat it as a rejection of the marketing category and record it as such.
• Browser settings. You can block or delete cookies in your browser. Blocking strictly necessary cookies may stop the form or the consent choice from working.
• Provider opt-outs. Google: adssettings.google.com. Meta: facebook.com/ads/preferences. LinkedIn: linkedin.com/psettings/guest-controls. Your choices on those platforms are separate from your choices on our site.

7. Changes

We update this policy when our providers or practices change. Material changes reset your consent and the banner is shown again. The effective date and version number at the top of this page will change.

8. Contact

Questions about cookies: hello@outwerk.ai. For the full privacy policy and your rights see outwerk.ai/privacy/.

---

Part B: Consent banner specification (for the developer)

B.1 Objective

No non-necessary script, cookie or network request to a third-party advertising or chat domain may run until the visitor has given consent for that category. The banner must satisfy EU ePrivacy and GDPR consent standards (freely given, specific, informed, unambiguous, as easy to withdraw as to give), UK PECR Regulation 6, Google's EU User Consent Policy with Consent Mode v2, and California's Global Privacy Control requirement.

B.2 Regions

• Banner legally required: EEA, UK, Switzerland (for the functional and marketing categories). Canada's guidance expects meaningful consent for tracking. California requires honoring GPC and the privacy choices link.
• Recommendation: show the banner to everyone, everywhere. Geo-targeting depends on IP lookup, which fails behind VPNs and corporate networks, and the saving in US conversion rate is small for a B2B site with a reject-first design. One global behavior is easier to test and defend.

B.3 Loading order

1. Page loads only first-party code and strictly necessary assets. Plausible script may load (cookieless, exempt).
2. The consent manager initializes and reads the stored consent record (first-party cookie outwerk_consent, mirrored in localStorage).
3. Before any Google tag loads, push the Consent Mode v2 default command with all four signals denied:

gtag('consent', 'default', { ad_storage: 'denied', ad_user_data: 'denied', ad_personalization: 'denied', analytics_storage: 'denied', wait_for_update: 500 });

4. If no valid consent record exists, show the banner and block all scripts in the functional and marketing categories. Use type="text/plain" data-category="marketing" on the script tags (or the consent manager's equivalent) so they are inert until activated.
5. On consent, activate the scripts in the accepted categories and push gtag('consent', 'update', {...}) with granted for the corresponding signals. Set ad_storage, ad_user_data and ad_personalization to granted only if marketing is accepted; analytics_storage to granted only if analytics (GA4) is accepted.
6. Meta Pixel and LinkedIn Insight Tag initialize only after marketing consent. Do not use Meta's "limited data use" flag as a substitute for consent in the EEA or UK.
7. Crisp initializes only after functional consent. The chat launcher may be shown as a static "Chat with us" button that, when clicked without consent, opens the preferences panel with the functional category highlighted.
8. Cal.com embed: load on the /audit/ page only. Its cookies are limited to the booking session and are treated as strictly necessary for the function the visitor requested. If Cal.com introduces tracking cookies, move the embed behind functional consent.

B.4 Banner design

• Positioned bottom of viewport, not blocking the full page, with the page content still scrollable behind it. No cookie wall.
• Headline: "Cookies on this site." Body (two sentences): "We use a cookieless analytics tool by default. Chat and advertising cookies load only if you allow them." Link: "Cookie policy" and "Privacy policy".
• Three controls on one row, visually equal in size, color and weight: Reject all, Accept all, Preferences. "Reject all" must not be a text link while "Accept all" is a button. Both complete the choice in one click.
• Brand palette: near-black #1B1D1A text on a white panel, cream #F5F3EE page, blue #4B62F8 fill with white text for the primary button. Never small blue text on cream.
• Preferences panel: four categories with a toggle each. Strictly necessary is on and disabled. Analytics (Plausible) is shown as "always on, cookieless" with a note, with a separate GA4 toggle only if GA4 is enabled. Functional and marketing default off. Each category lists its providers and links to the table in Part A. Buttons: Save preferences, Accept all, Reject all.
• No pre-ticked boxes. No nudging language ("we recommend accepting"). No color imbalance that favors accept.
• Closing the banner without a choice (X or clicking outside) counts as no consent; the banner reappears on the next page load. Prefer no X at all.
• Keyboard accessible, focus trapped while open, screen-reader labelled, WCAG 2.1 AA contrast.
• Works at 320px width without horizontal scroll.

B.5 Consent record

Store, in the first-party cookie outwerk_consent (12 months, SameSite=Lax, Secure) and in localStorage:

{ "version": "1.0", "policyDate": "October 28, 2026", "timestamp": "2026-11-03T14:22:05Z", "categories": { "necessary": true, "analytics": true, "functional": false, "marketing": false }, "method": "banner|preferences|gpc", "id": "uuid-v4" }

• version and policyDate must match the current cookie policy. If the stored version is older than the current version, treat consent as expired and show the banner again (re-consent on policy change).
• Re-prompt after 12 months regardless.
• Optional but recommended once advertising spend starts: post an anonymized copy of the record (id, timestamp, categories, version, country from CDN header, no IP) to a Netlify Function that appends it to a consent log. Keep 24 months.

B.6 Withdrawal and the footer link

• Every page footer carries two links: "Cookie preferences" (reopens the panel) and "Your privacy choices" (California wording; opens the same panel with the marketing category in focus).
• On withdrawal of a category: push the Consent Mode update with denied, stop the related scripts, and delete the first-party cookies that Outwerk controls (_gcl_*, _ga*, _gid, _fbp, _fbc) for the outwerk.ai domain. Third-party cookies on google.com, facebook.com and linkedin.com cannot be deleted by our code; the policy says so.

B.7 Global Privacy Control

• On every page load, check navigator.globalPrivacyControl === true.
• If true and no consent record exists: set marketing to false, create a consent record with method: "gpc", do not load marketing scripts, and show the banner with the marketing toggle already off and a one-line note: "Your browser sent a Global Privacy Control signal, so advertising cookies are off."
• If true and a record exists with marketing true: honor the GPC signal, downgrade marketing to false and update the record. A later explicit acceptance in the preferences panel may override GPC for that visitor only if the panel states that it does so.
• Treat GPC as a request to opt out of sale or sharing under California law and record it for evidence.

B.8 Testing checklist before launch

1. Fresh browser profile, EU and US IP (or VPN). Load the home page. In the network inspector confirm: no requests to googleadservices.com, googlesyndication.com, doubleclick.net, google-analytics.com, connect.facebook.net, facebook.com, snap.licdn.com, px.ads.linkedin.com, client.crisp.chat before any banner interaction. Plausible request present and cookieless.
2. Confirm dataLayer contains the consent default event with all four signals denied before any config command.
3. Click "Reject all". Confirm no third-party requests appear on navigation across five pages. Confirm outwerk_consent exists with all optional categories false.
4. Clear, reload, click "Accept all". Confirm the tags fire, cookies in the table appear, and the Consent Mode update shows granted.
5. Clear, reload, open Preferences, enable functional only. Confirm Crisp loads and no advertising requests appear.
6. Reopen preferences from the footer, withdraw marketing. Confirm first-party advertising cookies are removed and no further advertising requests fire.
7. Enable GPC in the browser (or a GPC extension). Clear, reload. Confirm marketing is off, the note appears, and method is gpc.
8. Bump the policy version in config. Reload. Confirm the banner reappears.
9. Run the check on mobile Safari and Chrome. Confirm the banner does not cover the primary call to action at 320px.
10. Record screenshots and the HAR files for the compliance file. Repeat quarterly and after any tag change.

B.9 Tooling

Either a self-built lightweight consent manager (recommended given the small script footprint, roughly 200 lines of vanilla JavaScript and a Netlify Function for the optional log) or a Google-certified consent management platform that supports Consent Mode v2, equal-prominence buttons and GPC. If a platform is used, confirm it does not itself set tracking cookies or load from a third-party domain before consent.