Cookies

Where this stands today

Read the site, and nothing is stored on your device until you answer one question. The single exception is the /demo page, and it is named below rather than buried.

Visiting hirecall.ai sets no cookie, writes nothing to local or session storage, and reads nothing already stored there — not on the first page, not while you read, not until you have made a choice. There is no script waiting in the background and no "cookieless ping" going out while you decide. This is verifiable: open the network and application panels on a fresh profile and load the site.

At the bottom of the page you are asked whether we may count your visit with Google Analytics. What follows from your answer:

• You refuse. Nothing is sent to Google, no analytics cookie is set, and your browser never contacts Google at all. One entry is written to your device recording that you said no, so we do not ask you again for six months. That entry is the whole of it.
• You do not answer. Exactly the same as refusing, minus the record — nothing whatsoever is stored, and you will be asked again next time.
• You accept. Google Analytics loads and sets two cookies, listed below, for thirteen months. You can withdraw from the footer of any page, and withdrawing deletes them.

Two other things happen that your answer does not affect.

The site counts page views through Cloudflare Web Analytics, which stores nothing on your device and reads nothing stored there — it has no visitor identifier at all, not even a short-lived one. It needs no answer from you because there is nothing to answer.

And an anti-bot check runs on the /demo page, and only there. That one is the exception to the headline above, and we would rather point at it than let you find it. It may store something on your device; we have not finished checking, and until we have, this page will not tell you either way. It is described in full below. If you do not open /demo, it never runs for you.

Why there is a banner

Under French law — Article 82 of the loi Informatique et Libertés, which implements the ePrivacy Directive — consent is required before storing information on someone's device or reading information already stored there. Google Analytics stores two cookies on your device, so it needs your consent, and it does not run without it.

Everything else on this site stays outside Article 82 rather than being excused by it, and the distinction matters:

• Cloudflare Web Analytics stores nothing and reads nothing stored. It is not consented to and not "essential" — Article 82 simply does not reach it. A banner covering it would be theatre: it would ask you to make a choice with no effect.
• The record of your own answer is storage, and it is the one thing kept under the exemption in Article 82 itself: storage strictly necessary for a service you asked for. Remembering "no" is what makes not asking you again possible. It holds a choice, a date and a version number — it is not an identifier, nothing else can read it, and it is written only once you have chosen.

So: one banner, for one purpose, and nothing hiding behind the word "essential".

What the site does do

Four things happen that are worth knowing about, none of which involves cookies.

The site is served to you. Our host receives your IP address, the page you asked for, the time, and your browser's user agent, and records them in server and security logs. This is how any website works; without it, nothing could be delivered to you. It is covered in the Privacy Policy.

The site counts its visitors — without cookies. We use Cloudflare Web Analytics, from the company that serves the site. It sets no cookie and stores nothing on your device — and it does not try to recognise you at all: there is no visitor identifier, not even a short-lived one. For each page view it records the page and the referrer, coarse location derived from your IP address (country — the address itself is not kept in the analytics data), your browser, device type and operating system, and how fast the page loaded. The legal basis and your right to object are in the Privacy Policy.

Fonts are served from our own domain. The typefaces come from Google Fonts, but they are downloaded when the site is built and served from our own host. Your browser makes no request to Google when you visit, so Google receives nothing — not your IP address, not the fact of your visit.

Forms send what you type. If you book a demo, sign up to the newsletter, leave an address before starting the demo, or ask for your three free interviews after trying it, what you enter is sent to us. The address before the demo is optional and the demo runs identically without it. That is the whole of it, and it is described in the Privacy Policy.

The demo sends you somewhere else, and sends nothing back. Trying the demo takes you to the product application at interview.hirecall.ai. Your audio is never recorded; a temporary transcript drives the conversation there and is destroyed when you return here, or automatically five minutes later if you do not. Nothing you said comes back to this site. The brief shown afterwards is a worked example written in advance — the same one for everyone who tries that role.

What we do not do

• No analytics that runs without being asked. Google Analytics runs only for visitors who accepted it; Cloudflare's runs for everyone and stores nothing. There is no third tool — no Plausible, no Fathom, no PostHog, nothing else.
• No advertising cookies, no retargeting, no conversion pixels, no Meta pixel, no LinkedIn Insight Tag. None of these is built, dormant or planned in the site's code, and accepting the banner does not permit any of them: Google's advertising signals are refused whatever you answer.
• No Google Tag Manager. Deliberately: a tag manager exists to let tags be added without a code change, which would make every promise on this page unverifiable. Anything Google receives from this site is loaded by code you can read.
• No social media embeds, no third-party video players, no chat widget, no embedded maps — none of the things that quietly set third-party cookies.
• No cross-site tracking and no fingerprinting.
• No session recording or heatmapping.
• No A/B testing tool.

Google Analytics, if you accept it

Paid campaigns need to know which pages people read and which advertisement brought them. Cloudflare's cookieless counter cannot answer that, so Google Analytics 4 runs on this site, behind the consent banner.

Nothing loads before you choose. On your first visit you are asked one question, at the bottom of the page. Until you answer it, no Google script is fetched, nothing is executed, and no request reaches Google — not even the "cookieless ping" that Google's own recommended setup sends while consent is pending. Your browser does not contact Google at all.

Refusing is one click, in the same place, in the same style. Two identical buttons, "Refuse" and "Accept", side by side on the first and only layer of the banner, with refuse first. No pre-ticked boxes. No second screen to reach a refusal. The site is not gated on your answer: everything works identically either way, and refusing costs you nothing.

A refusal is remembered, and you are not nagged. Your answer is stored on your own device — one entry recording what you chose, when, and which version of the notice you were shown. That entry is the only thing this site writes to your device before you accept, and it exists so that "no" means no on every later page. A refusal stands for six months. An acceptance stands for thirteen months, after which you are asked again.

You can change your mind from any page. The footer of every page carries a Cookie choices link that reopens the same banner, with the same two answers at the same weight. If you withdraw, the tag stops sending immediately and the cookies it set are deleted from your device — verifiable in devtools, like everything else on this page.

What is set, if you accept. Two first-party cookies, written by JavaScript on hirecall.ai:

Thirteen months rather than Google's default of two years: it is the CNIL's recommended ceiling for an audience-measurement cookie, and it makes the cookie expire with the consent rather than after it.

What is switched off inside the tag. Google's advertising features are disabled at the property level (allow_google_signals, allow_ad_personalization_signals) and denied through Consent Mode v2 (ad_storage, ad_user_data, ad_personalization are never granted). Accepting the banner permits audience measurement and nothing else. If an advertising tag is ever added, that is a second purpose and it needs its own question — the consent collected here does not stretch to cover it.

Where it goes. Google Analytics sends this data to Google, a company established in the United States, and it may be processed there. The transfer rests on the EU–US Data Privacy Framework, an adequacy decision of the European Commission; Google LLC's certification under it was confirmed on the US Department of Commerce's public list on 3 September 2026, the day this tag went live. The Privacy Policy carries the detail and the safeguards. If you would rather your data did not go there at all, refusing the banner is the whole of what that takes.

The five conditions

These were written as a checklist for whoever shipped the first Google tag. The tag has now shipped, so this is the record of how each was met — and of the one that was not.

1. Prior blocking. ✅ Met. The tag is injected only after an affirmative choice; there is no dormant script and no consent ping. Verifiable with the network panel open on a first visit.
2. Refusing as easy as accepting. ✅ Met. Same component, same variant, same size, refusal first, one layer, no pre-ticked boxes, no cookie wall. This is not a style preference: the CNIL fined Google €150 million and Facebook €60 million (decisions of 31 December 2021) for making refusal harder than acceptance, and "harder" there meant an extra click and a quieter button.
3. Proof and withdrawal. ⚠️ Partly met, and the gap is stated rather than papered over. The withdrawal route is met in full: a persistent "Cookie choices" link in the footer of every page reopens the banner, a refusal is remembered for six months and not re-asked, and withdrawing deletes the cookies. Proof of consent is only partly met: what was shown, what was chosen and when are recorded on the visitor's device, against a version number for the banner's wording that this repository's history resolves to exact text. That is a record, not a register we hold. A register would mean logging an IP address against a privacy choice, on a site that stores nothing else — worse for the visitor, better for us. That trade is for counsel to make. It is the open item on this page.
4. Consent Mode v2. ✅ Met, and used more strictly than Google intends: the consent defaults deny all four signals, only analytics_storage is ever granted, and the tag is not loaded at all until it is. "Installed but dormant" is not the design here — "absent until asked" is.
5. The transfer analysis, re-run on the day. ✅ Met on 3 September 2026, the day the tag went live, and it is the one condition that will go stale on its own. Two things were checked and both held: the EU–US Data Privacy Framework remains valid — the challenge to it (Latombe, C-703/25 P) is pending before the Court of Justice with no hearing date — and Google LLC's certification under the Framework is live on the US Department of Commerce list. Neither is permanent. The certification is renewed annually, and the two frameworks that preceded this one were both struck down by the same court. If that happens again, this tag needs standard contractual clauses and a transfer assessment, or it comes off the site.

The near-misses to learn from. Analytics were added to this site on 20 August 2026, and this page said "no analytics of any kind" until it was revised the same day. The demo funnel then merged Turnstile-calling code on 21 August 2026 while this page still said the site contacted no third party at all — dormant, so the page stayed true, but true by one unset variable. The control this page proposed in response now exists: scripts/check-consent.mjs fails the build if the site's measurement configuration and the front matter of this page disagree, in either direction, and it checks the dependency list for tag packages as well. A page describing a banner nobody is shown is as wrong as a page denying a tag everybody loads. This page is verifiable by anyone with a browser's developer tools open — which makes it a strong trust signal while true, and a plainly false statement by a company selling itself on data discipline the day it goes stale.

If you take the interview

The demo takes you to a different application, at interview.hirecall.ai. That application is not covered by this page, and what it stores is explained there. The demo itself needs no account, but the application will still set at least what it needs to run the session.

The anti-bot check on the demo page

The /demo page puts a Cloudflare Turnstile challenge in front of the demo, to stop the free interview minutes being consumed by bots. It went live on 25 August 2026. It runs on that page and on no other: we verified on the deployed site that no other page references challenges.cloudflare.com at all.

Three things follow from it. Only the second is about storage — the first is about a request your browser makes, and the third about why this one is not in the banner:

1. Your browser contacts Cloudflare. Loading the challenge is a request to challenges.cloudflare.com, which necessarily discloses your IP address and user agent to Cloudflare. This is true whether or not anything is stored on your device, and it is the reason Cloudflare is now listed as a provider in the Privacy Policy. It happens on the /demo page only.
2. Something may be stored on your device, and we have not finished checking what. Turnstile stores something in some of its configurations and nothing in others, and we have not yet confirmed which of those ours is. So this page does not name a cookie, a purpose or a lifetime for it — the rest of this page names all three for everything it describes, and we would rather leave a visible gap here than fill it with a guess you cannot check. It applies to the /demo page and nowhere else.
3. You cannot refuse this one, and that is why it is not in the banner. The banner covers Google Analytics, which you can decline at no cost — the site works identically. This check is different: it stands between a bot and a free service, so refusing it would mean not taking the demo. We therefore rely on a different part of the law: Article 82 does not require consent for storage that is strictly necessary to a service you have expressly asked for. What we can tell you plainly is what it is not. It is a security measure, not tracking. Turnstile is not an analytics product, it does not follow you between sites, and it runs on one page of this site.

Questions

privacy@hirecall.ai

Last updated: 3 September 2026