Cookie Policy
Draft for lawyer review. This policy is a working draft and is not yet final. It is not legal advice. Items marked [to confirm] depend on vendor settings that are chosen when the accounts are opened.
Effective date: not yet in effect (draft dated 2026-11-05)
This policy explains the cookies and similar technologies used on misolla.ai, our public website: what each one does, who provides it, how long it lasts, and how to turn it off. It sits alongside our Privacy Policy. The Misolla applications you sign in to (for example app.misolla.ai and your firm's workspace) are covered by your organization's agreement with us, not by this page.
1. How consent works on this site
- Nothing optional runs until you choose. When you first visit, a banner asks for your choice. Until you accept, only strictly necessary cookies are set and no analytics, recording, or marketing tool is loaded. This is the same for every visitor, in every province: we apply the opt-in standard of Quebec's Act respecting the protection of personal information in the private sector (as amended by Law 25) to everyone.
- Two optional categories. Analytics and Marketing can each be switched on or off on their own under Choose in the banner, or Cookie settings at the foot of every page.
- Reject is as easy as accept. Both buttons sit side by side in the banner.
- Your choice lasts 12 months, after which we ask again. We also ask again if we add a tool or a category.
- Withdrawing consent. Open Cookie settings and switch a category off. We delete the cookies and browser storage that category set on misolla.ai and reload the page (and any other open misolla.ai tabs) so its tools stop running. Cookies a provider set on its own domain (such as Google's) can only be removed in your browser settings. If your choice expires, we delete leftover tracking cookies on your next visit. Data already sent to a provider before you withdrew is kept under the retention periods below; to have it deleted, write to us (section 9).
- Global Privacy Control. If your browser sends the Global Privacy Control (GPC) signal, Accept all leaves Marketing off. You can still switch it on yourself.
2. Strictly necessary
These make the site work and remember your choices. They cannot be switched off here, but you can block them in your browser (the site will then ask for your choice on every visit).
| Name | Set by | Purpose | Lasts |
|---|---|---|---|
misolla_consent | Misolla (misolla.ai) | Records your cookie choice and when you made it. | 12 months |
misolla_workspace | Misolla (app.misolla.ai, readable on misolla.ai) | Set only after you sign in to Misolla. Lets the site show "Open your firm" instead of "Sign in". Holds your workspace's name and address, nothing else. | 12 months |
misolla_admin | Misolla (misolla.ai) | Signed session for Misolla staff using the site's admin pages. Not set for visitors. | 8 hours |
Security check on the Book a call page. The Book a call page may run a security check from Cloudflare (Cloudflare, Inc.) that tells people from automated programs, to keep the form from being flooded with fake requests. It runs on that page only, and without asking first, because it is part of what protects the form. To make the check, Cloudflare receives your network (IP) address and information about your browser and device. [to confirm: whether the check stores anything in your browser, and how long Cloudflare keeps this data]
The booking calendar. After you send the Book a call form, the page shows our booking calendar in a frame from calendar.misolla.ai, a scheduling service Misolla runs itself. The calendar may set cookies or browser storage of its own on calendar.misolla.ai that it needs to take a booking. [to confirm: list]
3. Analytics (optional)
Used to understand how the site is read: which pages people visit, where they click, how far they scroll, where they leave, and whether the Book a call form works and a call gets booked. We also record visits so we can watch how the pages are used, and note clicks that seem to go nowhere (repeated or unanswered clicks) and errors the page runs into in your browser, so we can fix them.
- How you found the site. The site that linked to us and any campaign tags in the link you followed (
utm_source,utm_mediumand similar). In the analytics we read, the linking site is kept as its address only, without the page or anything after a "?"; we keep the first and the most recent for your browser. PostHog's own cookie (ph_<project key>_posthog, below) also holds the first page you landed on and the page that linked to you, so it can credit the visit correctly. - Approximate location. Your network (IP) address is used once to estimate your country and province, and is then discarded. We do not keep the address or any city-level location.
- Versions of a page. Some visitors see a different version of a button or heading so we can learn which works better; which version you saw is recorded with your visit. If you haven't allowed Analytics, you always see the standard page.
| Name | Set by | Purpose | Lasts |
|---|---|---|---|
_ga | Google Analytics 4 (Google LLC) | Tells one browser's visits apart with a random identifier. | 13 months |
_ga_<container id> | Google Analytics 4 (Google LLC) | Keeps the state of the current visit. | 13 months |
ph_<project key>_posthog (cookie and browser local storage) | PostHog (PostHog Inc.) | A random identifier for this browser and the current visit, used for page views, clicks, scroll depth, funnels, and visit recordings. The cookie is set on .misolla.ai. | Cookie: 12 months. Local storage: until you withdraw consent or clear it. |
ph_<project key>_window_id, ph_<project key>_primary_window_exists (browser session storage) | PostHog (PostHog Inc.) | Tells the tabs of one visit apart, for recordings. | Until the tab closes |
misolla_intent (browser local storage) | Misolla (misolla.ai) | Counts which kinds of page this browser read in the last 14 days (for example product, security or research pages) and how many visits it made, to give the visit a score of how closely it matches someone evaluating Misolla. Holds no identifier. The score is sent to PostHog only. | 14 days of history; until you withdraw consent or clear it |
misolla_exp (browser local storage) | Misolla (misolla.ai) | Remembers which version of a page you were shown, so it stays the same on your next visit. | 30 days |
Visit recordings (PostHog). With Analytics on, PostHog may record what happens on the page during your visit: page layout, mouse movement, clicks, scrolling, and page changes. Every form field is masked, so what you type (including your email) is never recorded. Recordings are kept for [to confirm: 30 days] and then deleted.
Events kept. Page views and other events are kept for [to confirm: 12 months] in PostHog and for 14 months in Google Analytics [to confirm: GA data retention setting].
Google signals and advertising features are off unless you also accept Marketing.
4. Marketing (optional)
| Name | Set by | Purpose | Lasts |
|---|---|---|---|
_lfa | Dealfront (formerly Leadfeeder) [to confirm: contracting entity] | Recognizes repeat visits from the same browser so that visits can be grouped by organization. | [to confirm: 2 years] |
li_sugr, bcookie, lidc, UserMatchHistory, AnalyticsSyncHistory [to confirm: list] | LinkedIn Insight Tag (LinkedIn Ireland Unlimited Company) [to confirm: contracting entity] | Tells LinkedIn which visits came from our LinkedIn ads, and lets us show our ads on LinkedIn to people who visited this site. LinkedIn may link the visit to a signed-in LinkedIn member; we see only aggregated reports, not who you are. | From 1 day to 1 year [to confirm] |
| Google signals and advertising consent | Google LLC | With Marketing and Analytics both on, we tell Google Analytics that advertising storage, Google signals and ad personalization are allowed. Google may then use its own advertising cookies (for example on doubleclick.net) to link visits to signed-in Google accounts for aggregated reports. We run no Google advertising campaigns or tags today. | Set by Google [to confirm: list] |
Company identification (Dealfront). Dealfront compares the network (IP) address your visit comes from against databases of which organization owns that address. If it belongs to an organization (for example a law firm's office network), we see that organization's name and the pages visited from it. We do not identify you as a person from an anonymous visit, and we do not use tools that do. Visits from home or mobile networks usually match no organization.
5. When you tell us who you are
The Book a call form asks for your name, work email, firm and practice area. We use them to prepare for the call and to reply to you.
- What we keep. We keep your email. Your name, firm and practice area are not stored in our database; they reach the person at Misolla who prepares the call in an email and a text message, sent through our email and text-message providers.
- The booking. The next step passes all four details to our booking calendar, where you pick a time. The calendar keeps them with the booking. [to confirm: how long bookings are kept] The call is a Google Meet video call, so Google receives your name and email with the meeting invitation.
- Not linked to your visits. We do not link what you type in the form to your visits in our analytics, and we do not send it to Google Analytics or PostHog. The analytics events for the form record only how far it got (started, sent, booked) and on which page.
- The earlier form. Until October 2026 the site had a Request access form that asked for your email only. If you used it with Analytics on, PostHog holds that email linked to your visits on this site. To have it deleted, write to us (section 9).
We will only send you commercial email as Canada's anti-spam legislation (CASL) allows: replies to your request, and further messages only with your consent.
6. Where the data goes
Misolla is a Canadian company. These providers, and our booking calendar, store data outside Canada:
| Provider | What it holds | Where |
|---|---|---|
| Google LLC | Analytics events | United States and other Google locations |
| PostHog Inc. | Events and visit recordings (and, if you used the earlier Request access form with Analytics on, the email you gave it) | United States (PostHog US Cloud) |
| Dealfront | Company-level visit data | European Union [to confirm] |
| Visits from LinkedIn members, for ad conversion reports and audiences | United States and other LinkedIn locations [to confirm] | |
| Cloudflare, Inc. | The security check on the Book a call page: your network address and browser and device information | [to confirm] |
| Misolla's booking calendar | Your name, work email, firm and practice area, with the time you booked | United States |
| Our email and text-message providers | The notification of your request: your name, work email, firm and practice area | United States |
| Google LLC | The call (Google Meet) and its invitation: your name and email | United States and other Google locations |
Data held outside Canada is subject to the laws of the country where it is held, and may be accessible to that country's courts and authorities. Before sending personal information outside Quebec, we assess whether it will be adequately protected, as Quebec law requires.
None of the analytics or marketing data above enters the Misolla platform or its customer data stores. (The email you give in the Book a call form is kept by Misolla to reply to you.) Our data residency commitments for customer data are separate and unaffected.
7. Other ways to opt out
- Browser settings: block or delete cookies for misolla.ai.
- Google Analytics opt-out add-on: https://tools.google.com/dlpage/gaoptout.
- GPC: turn on Global Privacy Control in a browser that supports it.
8. Changes
We update this page when we add, remove, or change a tool, and ask for your choice again when a change affects what you agreed to.
9. Contact
Questions, or a request to access or delete website data held about you: [email protected].
This draft must be reviewed and approved by qualified privacy counsel before it is relied on. It is not legal advice.