Cookie Policy

The service is operated by Enzo MARTIN, an active sole proprietor (SIREN 108 698 242, SIRET 108 698 242 00014), under the ALL activity. The business locality is

Last updated: September 5, 2026.

The service is operated by Enzo MARTIN, an active sole proprietor (SIREN 108 698 242, SIRET 108 698 242 00014), under the ALL activity. The business locality is Saint-Martin-d'Hères, France; the detailed business address is [NOT PUBLICLY DISCLOSED] in this public version. Contact: contact@harmate.com.

1. Purpose

This policy explains which cookies and trackers are used on Harmate, why they are used, and which choices you have.

2. Purposes And Choices

Harmate separates three purposes:

  • first-party audience measurement, limited to this site and Harmate's exclusive use, may run without consent only when every technical condition for the applicable exemption is demonstrated. You can object at any time;
  • analytics journey tracking is optional and inactive without your consent;
  • campaign attribution (gclid/fbclid) is a separate optional purpose and is inactive without your consent.

Rejecting optional purposes is as easy as accepting them. Missing technical or documentary evidence disables the relevant collection.

3.1 Strictly necessary cookies

These cookies are required for core service operation, including:

  • authentication and session continuity;
  • application security;
  • essential technical preferences.

Without these cookies, core services cannot operate correctly.

3.2 Objectable first-party audience measurement

When enabled, this measurement receives only the canonical route. Date, hour, language, page family, device, browser and country are reduced to coarse categories by Harmate. Raw IP addresses and User-Agent strings are neither serialized nor retained by this processing. It is not reconciled with Account data or analytics providers.

The random harmate_audience_id is hashed before storage, restricted to Harmate, retained for no more than 390 days and never renewed on a visit. Source events are retained for no more than 25 months; terminal exports suppress cells with fewer than five unique visitors.

3.3 Analytics journey and attribution (optional)

After consent, the journey may measure canonical routes, UTM campaigns, bounded reading time and depth, exits, performance, clicks, CTAs and declared conversions. PostHog may also produce heatmaps and replay only public and authentication pages without URL parameters; the Google callback is excluded. Entered values are masked; file and hidden inputs are blocked; console content, network payloads, questionnaire, results and dashboard pages are not recorded.

Providers are Google Analytics and PostHog, only after explicit analytics consent. PostHog uses a random browser-limited identifier and creates no person profile or link to a Harmate account.

  • Google Analytics;
  • PostHog.

Preferences use the v2 eu-consent cookie:

  • audience_measurement: active or opposed;
  • analytics_journey and campaign_attribution: accepted or rejected;
  • text version and date for each choice;
  • retention: 180 days.

You can reopen Cookie Settings at any time. An objection deletes audience sources linked to the browser identifier; withdrawing analytics consent stops new events and resets provider identity.

5. Analytics Data Collected

Before consent, no GA4/PostHog request, command or script is emitted. Only the first-party measurement described above may run when its exemption gate is proven and you have not objected. Query strings, fragments, raw referrers, content, searches, emails, names and business UUIDs are excluded.

After analytics consent, only allowlisted properties are accepted for named events. Click IDs remain excluded until the separate attribution purpose is accepted. ad_personalization always remains denied. PostHog anonymizes IP addresses and restricts replays to Harmate domains.

6. Transfers And Processors

Each provider can be enabled only when its contracting entity, region, DPA, subprocessors, retention, rights and any transfer mechanism outside the EEA are documented and current. Otherwise no request is sent. This technical gate is not a legal opinion.

PostHog Inc. processes data in its US Cloud. Its terms, published standard DPA, subprocessor list, Data Privacy Framework, and Standard Contractual Clauses are referenced in the provider manifest. No countersigned DPA is claimed.

7. Retention And Deletion

  • preferences: 180 days;
  • first-party audience identifier: no more than 390 days, without renewal;
  • audience source events: no more than 25 months;
  • Google Analytics: events are retained for 2 months and user data for 14 months, with the duration reset on new activity; and
  • PostHog: events for 12 months, browser identifiers for 12 months renewed on activity, replays for 30 days, and no person profiles.

8. Your Rights

You can:

  • object to first-party audience measurement;
  • separately accept or reject analytics journey tracking and attribution;
  • change your choice at any time;
  • request access, export or erasure of analytics pseudonyms and exercise your other GDPR rights via contact@harmate.com.

You may also lodge a complaint with the CNIL: https://www.cnil.fr/.