Cookie Policy - Picari

1. Who we are

This Cookie Policy is issued by Picari Limited, 77 Camden Street Lower, Dublin 2, D02 XE80, registered in Ireland under number 794246, the operator of picari.ai, referred to below as "Picari", "we" or "us". It explains what Picari stores on your device when you use picari.ai and mcp.picari.ai, why, and how you control it. Questions go to hello@picari.ai.

2. What cookies and similar technologies are

A cookie is a small text file a website asks your browser to keep and send back on later requests. Modern sites also use two kinds of browser storage that work like cookies but are not sent automatically: localStorage, which stays until it is deleted, and sessionStorage, which is cleared when the tab closes. European law (the ePrivacy Directive and the GDPR, the UK's PECR) treats all three the same way: storing something on your device, or reading it back, needs your consent unless it is strictly necessary for a service you asked for. This policy therefore lists cookies, localStorage and sessionStorage together, and calls them "storage".

3. The categories

Strictly necessary. Storage without which the site does not work: your sign-in session, protection against abuse, your consent choice, and the drafts you create. Always on. No consent is required for these, and the law does not let us ask for it.

Preferences. Choices you make on the site (demo mode, buyer or vendor mode, dismissed tips, sidebar widths). Written only by your own action, kept on your device, never sent to us or anyone else. There is no switch for these in version 1 of our settings because nothing is stored until you ask.

Analytics. Google Analytics 4 and Picari's own usage analytics, described in the table and in section 5. Whether it starts off or on depends on where you are (section 8): off until you accept in the EEA, the UK and Switzerland; on until you opt out elsewhere. Either way one click changes it.

Visitor insights. Off unless you turn it on. Our partner RB2B sets first-party cookies (_reb2buid, _reb2butk, _reb2bgeo, _reb2bref, _reb2bsessionID, _reb2bloaded, _reb2bfxf, _reb2btd, _reb2bli, _reb2bresolve) to recognize your company and, in the US, you. RB2B loads its data partner LiveIntent (liadm.com), which sets its own first-party keys (_lc2_fpi*, _li_*) to match visits. Picari deletes RB2B's and LiveIntent's keys on picari.ai when you turn it off; cookies RB2B or LiveIntent set on their own domains cannot be removed from picari.ai. Picari sets no advertising storage, and Google Analytics' advertising features are permanently denied through Google Consent Mode.

4. What we store: the complete table

Every key below is read from the code on October 16, 2026 and pinned by the static check scripts/check-consent-writers.mjs (stage consent-writers): a key written in the site's code that is missing from the inventory this table renders from fails the build. "No expiry" means the browser keeps it until you or the site deletes it. A name ending in * covers every key starting with it.

Every cookie and storage key Picari or a third party writes, with its purpose, lifetime and category
Name	Type	Set by	Purpose	Lifetime	Category
`sb-*`	localStorage	Picari	Your sign-in session (sb-<project>-auth-token), written by the auth library	Until you sign out, refreshed while you use the site	Strictly necessary
`picari_consent`	localStorage	Picari	Your cookie choice, the policy version it was made under, the region rule applied and the two-letter country code the edge reported	12 months after Accept, 6 months after Reject	Strictly necessary
`picari_owner_token`	localStorage	Picari	Keeps the briefings and evaluations you create on this device reachable after a reload; never sent to analytics	Until you clear it	Strictly necessary
`picari_signup_fired:*`	localStorage	Picari	Stops a sign-up alert for your own account being sent twice	Until you clear it	Strictly necessary
`picari_session_id`	localStorage	Picari	Links the messages of a support chat you opened to the same conversation	Until you clear it	Strictly necessary
`picari_session_id`	sessionStorage	Picari	Groups the stack audit you submit in one sitting	Until the tab is closed	Strictly necessary
`picari.rank.sid`	localStorage	Picari	A random rate-limit bucket for shortlist ranking requests	Until you clear it	Strictly necessary
`picari:chunk-reload-at`	sessionStorage	Picari	Stops a page reloading in a loop after a failed code download	Until the tab is closed	Strictly necessary
`picari_pending_stack`	localStorage	Picari	Your stack audit answers while you sign in	Until you clear it	Strictly necessary
`picari_stack_audit`	localStorage	Picari	Your stack audit in progress	Until you clear it	Strictly necessary
`picari_pending_bakeoff`	localStorage	Picari	An evaluation you started setting up before signing in	Until you clear it	Strictly necessary
`picari_pending_setup`	localStorage	Picari	Vendors you picked for an evaluation before it was created	Until you clear it	Strictly necessary
`picari_workspace_*`	localStorage	Picari	Vendor suggestions you accepted or dismissed in an evaluation	Until you clear it	Strictly necessary
`picari_suggestions_hidden_*`	localStorage	Picari	Remembers that you hid the vendor suggestions panel in an evaluation	Until you clear it	Strictly necessary
`picari_bakeoff_handoff`	sessionStorage	Picari	Carries a shortlist into the evaluation you are creating from it	Until the tab is closed	Strictly necessary
`picari_briefing_brief`	sessionStorage	Picari	Your briefing answers so a refresh does not lose them	Until the tab is closed	Strictly necessary
`picari_briefing_messages`	sessionStorage	Picari	The briefing conversation so a refresh does not lose it	Until the tab is closed	Strictly necessary
`picari_briefing_phase`	sessionStorage	Picari	Which step of the briefing you are on	Until the tab is closed	Strictly necessary
`picari_briefing_result_id`	sessionStorage	Picari	The id of the shortlist your briefing produced	Until the tab is closed	Strictly necessary
`picari_briefing_report:*`	localStorage	Picari	A cached copy of a briefing report you opened	Until you clear it	Strictly necessary
`picari_brief_unlocked`	localStorage	Picari	Remembers that you unlocked a briefing report	Until you clear it	Strictly necessary
`picari:auto-send-brief`	sessionStorage	Picari	Sends the report you asked for by email once you have signed in	Until the tab is closed	Strictly necessary
`picari_pending_signal`	localStorage	Picari	A vendor signal you gave before signing in, confirmed afterwards	30 minutes, removed as soon as it is applied	Strictly necessary
`picari_pending_comment`	localStorage	Picari	A vendor comment you wrote before signing in, posted afterwards	30 minutes, removed as soon as it is applied	Strictly necessary
`picari_signals_open_hint`	localStorage	Picari	Opens the signals panel you were using after a sign-in redirect	24 hours	Strictly necessary
`picari:invite-email:*`	sessionStorage	Picari	The address a team invitation was sent to, moved out of the link before anything else runs	Until the tab is closed	Strictly necessary
`picari:message-prefill:*`	sessionStorage	Picari	A message your AI client prepared for an evaluation, moved out of the link and put in the compose box after you sign in	30 minutes, removed as soon as it is used, or when the tab is closed	Strictly necessary
`picari_saved_shortlists`	localStorage	Picari	Shortlists you saved before signing in	Until you clear it	Strictly necessary
`picari_vendor_profile_draft_*`	localStorage	Picari	An unsaved draft of a product profile you are editing in the vendor portal	Until you save it, sign out or clear it	Strictly necessary
`picari.role.v1.*`	localStorage	Picari	A short-lived copy of your account roles so pages render without waiting	24 hours, or until you sign out	Strictly necessary
`admin_excluded_emails`	localStorage	Picari	Admin tooling: addresses excluded from the admin AI chat	Until you clear it	Strictly necessary
`picari_embeds_ok`	sessionStorage	Picari	Remembers that you chose to load embedded videos in this tab	Until the tab is closed	Strictly necessary
`__stripe_*`	cookie	Stripe	Fraud prevention for a payment you start on a checkout page (Stripe)	Set by Stripe, up to 1 year	Strictly necessary
`_session`	cookie	Picari	The sign-in session of the MCP authorization server on mcp.picari.ai	60 seconds	Strictly necessary
`_interaction`	cookie	Picari	An authorization request in progress on mcp.picari.ai	10 minutes	Strictly necessary
`_interaction_resume`	cookie	Picari	Resumes an authorization request on mcp.picari.ai after consent	10 minutes	Strictly necessary
`picari_demo_mode`	localStorage	Picari	Whether demo mode is on	Until you clear it	Preferences
`user_mode_*`	localStorage	Picari	Whether you last used the site as a buyer or a vendor	Until you clear it	Preferences
`picari_admin_view_active`	localStorage	Picari	Admin tooling: whether the admin view is on	Until you clear it	Preferences
`picari_admin_exclude_internal`	localStorage	Picari	Admin tooling: whether internal traffic is excluded from analytics views	Until you clear it	Preferences
`admin-sidebar-*`	localStorage	Picari	Admin tooling: sidebar width and open groups	Until you clear it	Preferences
`picari_shortlist_rail_width`	localStorage	Picari	The width you gave the shortlist side panel	Until you clear it	Preferences
`picari_dismissals:*`	sessionStorage	Picari	Shortlist entries you dismissed in this tab	Until the tab is closed	Preferences
`picari_bakeoff_preview_dismissed:*`	sessionStorage	Picari	Remembers that you closed the evaluation preview for a shortlist	Until the tab is closed	Preferences
`picari_show_welcome`	localStorage	Picari	Shows the welcome dialog once after onboarding	Until you clear it	Preferences
`stack-audit-popup-dismissed`	sessionStorage	Picari	Remembers that you closed the stack audit prompt	Until the tab is closed	Preferences
`profile_nudge_dismissed_*`	sessionStorage	Picari	Remembers that you closed the profile completion reminder	Until the tab is closed	Preferences
`picari_onboarding_tour_completed`	localStorage	Picari	Remembers that you finished the product tour	Until you clear it	Preferences
`picari_vendor_portal_onboarding_completed`	localStorage	Picari	Remembers that you finished the vendor portal tour	Until you clear it	Preferences
`picari:premium-interest-sent`	sessionStorage	Picari	Remembers that you already asked about premium in this tab	Until the tab is closed	Preferences
`picari:vendor-msg-*`	localStorage	Picari	Which evaluation message thread you last read and how far	Until you clear it	Preferences
`deal-questions-*`	localStorage	Picari	Questions you ticked off in an evaluation checklist	Until you clear it	Preferences
`picari.v5.theme`	localStorage	Picari	A draft home page's theme choice (draft pages only)	Until you clear it	Preferences
`picari_anonymous_id`	localStorage	Picari	The analytics visitor id only: a random id that lets us count you as one visitor across visits and link your pre-sign-in activity to your account. Not the handle your own briefings are saved under (that is picari_owner_token)	Until you withdraw analytics consent	Analytics
`telemetry_session`	sessionStorage	Picari	A random id for the current sitting (30 minutes idle)	Until the tab is closed	Analytics
`telemetry_session_seen`	sessionStorage	Picari	When the current sitting was last active	Until the tab is closed	Analytics
`picari_sid`	sessionStorage	Picari	A random id attached to the vendor suggestions you act on	Until the tab is closed	Analytics
`picari_attribution_first`	localStorage	Picari	The campaign and referrer of your first visit	Until you withdraw analytics consent	Analytics
`picari_attribution_last`	localStorage	Picari	The campaign and referrer of your latest visit	Until you withdraw analytics consent	Analytics
`picari_ab_*`	localStorage	Picari	Which variant of a page test you were shown	Until you withdraw analytics consent	Analytics
`picari_dedup:*`	localStorage	Picari	Stops a usage event being counted twice	Until you withdraw analytics consent	Analytics
`picari_internal_browser`	localStorage	Picari	Marks a Picari staff browser so its visits are left out of our statistics	180 days	Analytics
`_ga*`	cookie	Google	Google Analytics: tells visits by the same browser apart (_ga, _ga_<property>)	Up to 2 years, expired on withdraw	Analytics
`_reb2buid`	cookie	RB2B	RB2B: a random id for this browser	360 days, deleted when you turn Visitor insights off	Visitor insights
`_reb2bsessionID`	cookie	RB2B	RB2B: groups the pages of one visit	30 minutes, deleted when you turn Visitor insights off	Visitor insights
`_reb2bgeo`	cookie	RB2B	RB2B: the country, region and network type its location service returned for your connection	20 days, deleted when you turn Visitor insights off	Visitor insights
`_reb2bref`	cookie	RB2B	RB2B: the site you came from	30 days, deleted when you turn Visitor insights off	Visitor insights
`_reb2bloaded`	cookie	RB2B	RB2B: stops its script running twice on one page	1 second, deleted when you turn Visitor insights off	Visitor insights
`_reb2bfxf`	cookie	RB2B	RB2B: a hashed match from one of its identity partners	30 days, deleted when you turn Visitor insights off	Visitor insights
`_reb2btd`	cookie	RB2B	RB2B: a hashed email match from one of its identity partners	30 days, deleted when you turn Visitor insights off	Visitor insights
`_reb2bli`	cookie	RB2B	RB2B: a hashed email match from LiveIntent	30 days, deleted when you turn Visitor insights off	Visitor insights
`_reb2bsha`	cookie	RB2B	RB2B: a hashed email match from LiveIntent	30 days, deleted when you turn Visitor insights off	Visitor insights
`_reb2butk`	cookie	RB2B	RB2B: a copy of a HubSpot visitor token, when one exists (Picari runs no HubSpot)	365 days, deleted when you turn Visitor insights off	Visitor insights
`_reb2bec`	cookie	RB2B	RB2B: an id carried in an RB2B email link	360 days, deleted when you turn Visitor insights off	Visitor insights
`_reb2beid`	cookie	RB2B	RB2B: an external id RB2B's script assigns	360 days, deleted when you turn Visitor insights off	Visitor insights
`_reb2*`	cookie	RB2B	RB2B: any other cookie its script sets (names start _reb2, such as _reb2bresolve or _reb2bignorerepeats)	Up to 1 year, deleted when you turn Visitor insights off	Visitor insights
`_reb2*`	localStorage	RB2B	RB2B: copies of its visitor id, referrer and email-link ids (_reb2buid, _reb2bref, _reb2bec, _reb2butk, _reb2beid)	Until you turn Visitor insights off	Visitor insights
`_lc2_fpi*`	cookie	LiveIntent, loaded by RB2B	LiveIntent: a first-party id for this browser, read by RB2B	Set by LiveIntent, deleted when you turn Visitor insights off	Visitor insights
`_lc2_fpi*`	localStorage	LiveIntent, loaded by RB2B	LiveIntent: a first-party id for this browser, read by RB2B	Set by LiveIntent, deleted when you turn Visitor insights off	Visitor insights
`_li_*`	cookie	LiveIntent, loaded by RB2B	LiveIntent: its sync and id state (_li_duid, _li_dcdm_c, _li_ss)	Set by LiveIntent, deleted when you turn Visitor insights off	Visitor insights
`_li_*`	localStorage	LiveIntent, loaded by RB2B	LiveIntent: its sync and id state (_li_duid, _li_dcdm_c, _li_ss)	Set by LiveIntent, deleted when you turn Visitor insights off	Visitor insights

5. Picari's own usage analytics, in plain terms

With analytics on, the site sends batches of events (page views, clicks on recommendations, briefing and evaluation milestones) to Picari's API, together with the visitor id, the session id and the campaign parameters above. Picari's API also records your browser's User-Agent string with those events. If you sign in, the visitor id is linked to your account, including visits made before you signed in. When a briefing starts, a shortlist is revealed, an evaluation is launched or a workspace is opened, Picari's team receives an alert in Slack carrying the event and the visitor id. Raw events are deleted 12 months after the month they were recorded. Vendors with a Picari portal see monthly counts of visitors to their pages and shortlist appearances built from these events, so those counts include only visitors with analytics on.

With analytics off, the site sends none of this, stores no visitor id, and the API refuses any analytics request that does not carry a consent claim saying analytics is on (a request header, or the same claim inside the body for the one kind of request a browser sends without headers).

6. Third-party embeds

Vendor pages can carry videos hosted by YouTube or Vimeo. Picari shows a still preview with a play button and loads the player only when you click it; until then nothing is requested from YouTube or Vimeo. When you click, YouTube (youtube-nocookie.com, Google Ireland Limited) or Vimeo (Vimeo.com, Inc., United States, with "do not track" set) receives your IP address and may write its own storage, under its own policy. Vendor logos are fetched by Picari's server, never by your browser from the logo provider. Google sign-in is a redirect to Google when you click it; Google sets nothing on picari.ai.

7. How to change your choice

Open from the footer, your account menu or the top bar of any page, or from this page, and move the Analytics switch. Turning it off takes effect at once: Picari deletes its analytics keys, expires the Google Analytics cookies it can reach, and records the withdrawal. Turning it on takes effect at once too.

The Visitor insights switch works the same way: turning it off stops RB2B at once, without a reload, and deletes its cookies on picari.ai. To ask RB2B to delete what it already holds, visit app.retention.com/optout.

If your browser sends a Global Privacy Control signal, Picari treats it as "Reject all" without showing the banner, and Cookie settings says the signal was honored. You can still turn analytics on there. Picari does not read the older Do Not Track header.

Your browser can also block or delete storage. Blocking the strictly necessary keys signs you out and loses unsaved drafts.

8. How this depends on where you are

Picari applies one of two rules, chosen by where your request comes from.

In the EEA, the United Kingdom and Switzerland, nothing non-essential runs until you click Accept all or turn analytics on in Cookie settings. You see the banner with Reject all, Accept all and Cookie settings, and nothing is sent to Google or to Picari's analytics before you choose.

Everywhere else, analytics runs from your first page until you opt out. You see a notice saying so, with Opt out, OK, Accept all and Cookie settings. Google Analytics' advertising features are off in both regions, permanently.

How we know where you are. Our content delivery network reads the country of the network address your request arrives from and passes a two-letter country code to our API; the API returns the rule to apply and stores nothing. The address is not kept with your consent choice or your analytics events; our ordinary server logs are described in the Privacy Policy. The lookup happens once per consent choice, not on every page, so a choice you made does not change when you travel; it is made again when your choice expires or you clear it. If the country cannot be determined, for any reason, Picari treats you as being in the EEA and applies the stricter rule.

Global Privacy Control is honored in both regions: a browser that sends it gets analytics off without a click, and Cookie settings says so.

Changing either way. in the footer, account menu or top bar has the same Analytics switch under both rules. Turning it off deletes Picari's analytics keys, expires the Google Analytics cookies it can reach and records the change; turning it on starts analytics at once.

9. What we record about your choice, and for how long

Each time you accept, reject, change or withdraw, and the first time analytics runs by default in your region, Picari records: the time, a random consent id (not your visitor id, not your account), the policy version you saw, your choice per category, how you decided (banner, settings, Global Privacy Control, or "implied" when analytics ran by default in your region), the region rule that applied, and the two-letter country code that rule was based on, if one was resolved. If you are signed in, the record is attached to your account so we can answer a question about it. We do not record your IP address or your browser's User-Agent with the choice. Records are kept for 6 years, the limitation period for a claim about consent, then deleted.

10. Changes to this policy

This policy carries a version number and a date at the top. A change that adds storage, a purpose or a third party either raises the version, and the site asks for your choice again, or adds a new setting that stays off and asks you about that setting alone, keeping your earlier choices. Corrections that change nothing about what is stored update the date only.

11. Contact

Questions about this policy or about a consent record: hello@picari.ai. The Privacy Policy at /privacy covers everything else we do with personal data.