Privacy and cookie notice

clairet.ai — Latest update: September 13, 2026

This notice covers the Clairet website at clairet.ai. It says what the site records, what it keeps in your browser, where each thing goes, how long it is kept, and how you choose. The short version: nothing that measures you runs until you allow it where the law asks first; elsewhere, usage analytics run unless you turn them off; the demo form sends only what you type, plus where your visit came from.

Who is responsible

Cybrary, Inc.
4600 River Road STE 400
Riverdale, MD 20737 USA

Contact for privacy matters: privacy@cybrary.it

Your choices

A banner asks on your first visit. Accept All, Reject Alland Manage Choices are equally available, nothing is pre-ticked, and the banner cannot be dismissed without a decision. Cookie Settings in the footer of every page reopens it, so withdrawing is as easy as agreeing. Your decision is kept in this browser for12 months, after which the site asks again, and it is asked again sooner if the categories change meaning.

Where the law asks first (the European Economic Area, the United Kingdom and Switzerland) everything below the "Necessary" line stays off until you choose. Elsewhere, analytics run by default and the banner offers to turn them off; marketing still waits for your choice. The site decides which applies from your browser's time zone, and treats an unknown zone as "ask first".

If your browser sends a Global Privacy Control signal, the site treats it as a refusal of marketing, whatever else you choose.

What runs, by category

Necessary (always on)

These keep the site working and remember your own choices. They identify no one and are never sent anywhere.

• clairet-consent: your cookie decision, the date you made it, and whether it came from you or from a Global Privacy Control signal. Kept 12 months.
• clairet-theme: light, dark or system. Kept until you change it.
• clairet-locale: the language you chose. Kept until you change it.
• clairet-listen-speed: the playback speed of the read-aloud player. Kept until you change it.
• clairet-listen-position: where you stopped listening in a post, one entry per post and language, so the player can offer to resume. Kept until your browser clears it.

Analytics

Which pages get read, where people get stuck, and which version of a page works better.

• Google Analytics 4, loaded through Google Tag Manager. Records page views and interactions (reading depth, the read-aloud player, downloads, language changes, the demo form's steps but never what you type) with a random visitor id in a cookie (_ga and one per property, two years). Google's Consent Mode keeps every signal denied until allowed. Analytics keeps event and visitor data for 14 months, and a daily copy goes to our own Google BigQuery project, where it is deleted automatically after 25 months. Aggregated reports are kept longer. Google may process this data in the United States.
• Microsoft Clarity: session recordings and heat maps that show how pages are used. Anything you type into a form or choose from a drop-down is masked before it leaves your browser. Cookies _clck and _clsk (one year and one day). Recordings are kept 30 days. Loaded only after analytics is allowed.
• clairet-first-touch: how your first visit reached the site (referrer, campaign, landing page), remembered in your browser only after analytics is allowed, so a later demo request can say what brought you here. Kept until your browser clears it.
• GrowthBook: which version of a page you are shown when two are being compared. The assignment rests on a random id, not you, kept in your browser as clairet-experiment-id only after analytics is allowed, so you see the same version each time. Kept until your browser clears it.

Marketing

Connects a demo request to the pages that led to it. Nothing here shows you advertising.

• HubSpot tracking: when you allow marketing, the site loads HubSpot's tracking code. It records the pages you visit and sets HubSpot's visitor cookies (hubspotutk, six months; __hstc, six months; __hssc, thirty minutes;__hssrc, for the browser session), and the visitor cookie is sent with a demo request so HubSpot can join the request to your earlier visits. The same HubSpot account serves the Cybrary site, so a visitor known there is recognised here. Nothing here shows you advertising.
• LinkedIn Insight: when you allow marketing, LinkedIn's tag records that you visited and, after a demo request, that you made one, so LinkedIn campaigns can reach people who know Clairet and count the requests they lead to. It sets LinkedIn's cookies (li_sugr, bcookie, lidc, UserMatchHistory,AnalyticsSyncHistory, up to a year), and LinkedIn may link the visit to your LinkedIn account if you have one.
• Google Ads signals: allowed or denied through the same Consent Mode as analytics, so a conversion can be attributed to an ad you clicked. No advertising cookie is set unless you allow marketing.

The demo form

Sending the form gives us your name, work email, phone number, company, job title, department, country and company size, and anything you add about what you would like to see. It goes to our HubSpotaccount through HubSpot Forms, where sales use it to contact you about Clairet, together with: the language you used, which site you were on, where your first visit came from (if remembered, see above), any Google click id in the address, and which page version you saw. If you allowed analytics, the anonymous Google Analytics browser id is included too, so we can see which visits led to a request, and so is your IP address, which HubSpot uses to estimate your location and for its form reports. The form posts to a small service of ours that checks the values, forwards them, and keeps nothing.

reCAPTCHA Enterprise (Google) checks that a submission is not automated. Its script loads only when you use the form and only once analytics is allowed. It gives the request a score; the score is stored with the request so sales can filter suspected bots, and no request is refused because of it. Google's badge is hidden; itsPrivacy Policy andTerms of Service apply.

HubSpot keeps a contact record until you ask us to delete it, or until we do. Write to the address above to see, correct or delete what we hold.

What the site never does

• Records anything you type, outside the demo form you choose to send.
• Runs analytics, recordings or marketing before you allow them, where the law asks first.
• Sells or shares personal data for advertising.
• Loads a chat widget, a payment provider or a social-media pixel.

Where data is processed

The site is served from Google Cloud. Google Analytics, Google Tag Manager, reCAPTCHA and HubSpot process data in the United States; Microsoft Clarity in the United States and the European Union. Each is bound by its own privacy terms and, for European visitors, by the standard contractual clauses or an adequacy decision covering the transfer.

Your rights

Depending on where you live, you may have the right to access, correct, delete or export personal data we hold about you, to object to or restrict certain processing, to withdraw consent at any time, and to opt out of the sale or sharing of personal data, under laws including the GDPR (European Union), the UK GDPR, the Swiss Federal Act on Data Protection, the LGPD (Brazil) and US state privacy laws such as the CCPA. To exercise any of these rights, write to privacy@cybrary.it. You may also complain to your local data protection authority.

Changes

When what the site records changes, this page changes with it, and the date at the top moves. Where a change affects something you consented to, the site asks again.