Cookie Policy

Lobor, Inc.
Last updated: 2026-07-22
Effective date: 2026-07-22

1. About This Policy

This Cookie Policy explains how Lobor, Inc. ("Lobor", "we", "our", or "us") uses cookies and similar tracking technologies on https://augex.ai, https://staging.augex.ai, and Lobor-managed applications and dashboards (collectively, the "Services").

This Policy supplements our Privacy Policy. Capitalized terms not defined here have the meaning given in the Privacy Policy or Terms of Service.

Consent works differently by region. If you are visiting from the European Economic Area, the United Kingdom, Switzerland, or the additional European and associated territories we cover under the same consent-first approach (together, the "consent-first regions"), non-essential cookies and tags stay off until you opt in through the Cookie Banner. If you are visiting from anywhere else, the non-essential cookies and tags described in Section 3 are active by default; a non-blocking notice bar informs you on your first visit, and you can opt out at any time via [Cookie Settings](/legal/cookie-settings). In every region we honor the Global Privacy Control (GPC) and Do Not Track (DNT) browser signals — when your browser sends one, non-essential cookies and tags are disabled regardless of these defaults. You may withdraw or change your choices at any time by clearing the lobor.cookieConsent entry in your browser's site storage (the banner will then re-appear on your next visit) or by adjusting cookie settings in your browser.

2. What Are Cookies

Cookies are small text files that a website places on your device (computer, phone, or tablet) when you visit it. Similar technologies include local storage, session storage, pixels, and SDKs that perform comparable functions.

• First-party cookies are set by Lobor on the augex.ai domain.
• Third-party cookies are set by service providers we embed (for example, payment processors or model provider domains during BYOK authentication).
• Session cookies expire when you close the browser tab or window.
• Persistent cookies remain on your device for a defined retention period or until you delete them.

We also use localStorage to store non-sensitive UI state such as your cookie consent record, language preference, and theme (theme — stored as localStorage, not as a cookie). These entries are not transmitted to our servers automatically except where explicitly noted (for example, your consent choice is also recorded server-side for audit purposes — see Section 3.2).

3. Cookies We Use

3.1 Essential Cookies

Essential cookies are strictly necessary to deliver the Services you request: authentication, security, language, and theme. They cannot be disabled through the Cookie Banner because the Services would not function without them.

Name	Purpose	Duration	Type
lobor_session	Client-readable session marker (intentionally JavaScript-accessible) used by the web application to detect an active server-side session and hydrate the UI accordingly. Does not carry identity — the authentication token is stored separately in the HttpOnly auth_token cookie.	~30 days	First-party cookie
auth_token	Refresh token used to renew session credentials securely. Signed JSON Web Token whose payload includes your account identifier, email address, role, and session version. Email address is used server-side to identify your session; HttpOnly protection prevents third-party readability.	~30 days	First-party, HTTP-only cookie
lobor_token	First-party cookie (JavaScript-readable) carrying the authentication token on password-login sessions. Used by server-rendered pages to authenticate the initial render when the HttpOnly auth_token cookie is not present. Carries the same signed JWT payload as auth_token.	~30 days	First-party cookie
lobor_consent_binding	First-party HttpOnly cookie, signed with a server secret, binding your cookie-consent choice to your current browser session. Used to safely associate your anonymous consent record with your account if you subsequently log in. Does not carry identity on its own.	~24 hours	First-party, HTTP-only cookie
lobor-locale	Stores your selected interface language (en or zh).	1 year	First-party cookie

The auth_token and lobor_token cookies carry a signed JSON Web Token whose payload includes your account identifier, email address, role, and session version. The email address is used server-side to identify your session; it is not readable by third parties due to HttpOnly/SameSite protections on auth_token and the TLS transport layer.

We may also set short-lived CSRF and rate-limit cookies that are required for security and are treated as essential.

3.2 Analytics Cookies

With your Analytics consent, Lobor loads Google Analytics 4 (measurement ID G-98FPH4PVLE) through Google Tag Manager (container GTM-PVC3CLXJ, served from www.googletagmanager.com). Google Analytics sets first-party _ga* cookies to measure page views and product usage in aggregate; no advertising use is made of Analytics data. In the consent-first regions (see Section 1) the tag receives no data until you grant Analytics consent; everywhere else it is active by default and stops when you opt out via Cookie Settings or when your browser sends a Global Privacy Control (GPC) or Do Not Track signal (Google Consent Mode analytics_storage). Other than Google Analytics and Microsoft Clarity (disclosed below), we deploy no third-party analytics tools (no Mixpanel, Segment, PostHog, Amplitude, Heap, FullStory, or Hotjar). Lobor does maintain an internal server-side event log for service operation, which records anonymized session identifiers, anonymized IP hashes, and truncated user-agent strings on every request. Writes to this log that are tied to your session are gated by your effective Analytics consent — your recorded choice where you have made one, otherwise the regional default described in Section 1 (off in the consent-first regions and wherever your location is unknown; on elsewhere). You may withdraw your consent at any time via the Cookie Settings page (see Section 4). Withdrawal stops new records from being written; it does not delete historical records, which are retained per our [Data Retention policy](/legal/data-retention). Essential server logs unrelated to your Analytics choice (such as error logs and security logs) are retained independently, per the same retention policy.

With your Analytics consent (granted regionally as described in Section 1), our public marketing pages may also load Microsoft Clarity, a heatmap and session-replay service provided by Microsoft Corporation (loader served from clarity.ms). Clarity records interaction signals on those pages — clicks and their positions, scrolling, mouse movement, and viewport contents — to produce aggregate heatmaps and replayable sessions that show us how visitors use our landing pages. Text you type is masked and is not transmitted. Clarity captures rendered page content and element attributes (with typed input masked), interaction and diagnostic events, and derives your approximate location from your IP address. It sets first-party cookies including _clck and _clsk to distinguish sessions; we keep Clarity's advertising storage DISABLED, so no Microsoft advertising cookies are used. The collected data is transmitted to and stored by Microsoft, which processes it as an INDEPENDENT DATA CONTROLLER under the [Microsoft Privacy Statement](https://privacy.microsoft.com/privacystatement); per Microsoft's current documentation, session recordings are retained for up to 30 days (up to 9 months for recordings that are saved or otherwise selected for longer retention) and aggregated heatmap/click data for up to 9 months. Clarity runs ONLY on public marketing pages (for example the homepage, /creator, and /pricing) — never on signed-in surfaces such as chat, your workspace, or account settings — and it honors the same consent model, opt-outs, and GPC/DNT signals as every other Analytics tool described here.

3.3 Third-Party Cookies

The following third parties may set their own cookies on their own domains when you interact with their embedded flows on the Services. Their cookie use is governed by their own policies.

• Stripe — Stripe Checkout and Stripe Elements may set session and fraud-prevention cookies during payment, in line with Stripe's Privacy Policy and Cookie Policy.
• LLM providers (BYOK) — When you authenticate to a model provider (for example, OpenAI, Anthropic, or Google) through our Bring-Your-Own-Key flow, that provider's domain may set cookies on its own domain during the OAuth or sign-in step. Lobor does not read those cookies.
• Google (Tag Manager, Analytics, Ads) - Lobor loads Google Tag Manager (container GTM-PVC3CLXJ) from www.googletagmanager.com. Inside the container: Google Analytics 4 (G-98FPH4PVLE) runs with Analytics consent, and the Google Ads tag (AW-18142334212) measures conversions with Marketing consent. Each tag honors Google Consent Mode: in the consent-first regions (see Section 1) it receives no data until the matching consent is granted; elsewhere the matching consent is granted by regional default unless you opt out or your browser sends a GPC/DNT signal. Google's use of cookies is governed by Google's policies.
• Microsoft (Clarity) — With Analytics consent, Microsoft Clarity sets the _clck and _clsk cookies on public marketing pages for heatmaps and session replay, per the Microsoft Privacy Statement.
• Cloud infrastructure — Our hosting and edge providers may set short-lived security cookies for DDoS protection and load balancing.

Except for the consent-gated Google Ads conversion measurement described in Section 3.4, we do not embed social media trackers or cross-site behavioral advertising cookies on the Services.

3.4 Marketing Cookies

Marketing cookies help us understand how you arrived at Lobor (e.g., via a search engine, social media, referral link, or paid Google Ads campaign) and whether those campaigns lead to signups or purchases. We store UTM parameters from the URL you arrive through, the hostname of your referring site (e.g., google.com - not the full URL), and the landing page path. This data is kept locally in your browser until you complete signup, at which point the marketing attribution of your first visit and last visit before signup may be recorded on your account for campaign analytics.

When your Marketing consent is granted — by your opt-in in the consent-first regions (see Section 1), or by regional default elsewhere unless you opt out or your browser sends a GPC/DNT signal — the Google Ads conversion tag (AW-18142334212) activates inside our Google Tag Manager container (GTM-PVC3CLXJ, served from www.googletagmanager.com). The tag may process page path, browser and device signals, IP address, and Google Ads click or conversion identifiers under Google's policies. Lobor uses this tag for campaign measurement, not to build Lobor-owned cross-site behavioral advertising profiles.

We do NOT store in Lobor first-party attribution records:
- Full referring URL (only the hostname)
- Google Ads click identifiers beyond what Google's consent-gated tag processes for conversion measurement
- Third-party ad-network trackers beyond the Google Ads tag disclosed above

Name (in browser)	Purpose	Duration	Type
lobor_first_touch (localStorage)	First source of visit (UTM + referrer + landing)	Cleared at signup	First-party
lobor_last_touch (localStorage)	Most recent source of visit before signup	Cleared at signup	First-party
Google tag (AW-18142334212)	Google Ads conversion measurement after Marketing consent	Subject to Google controls and browser/site-data settings	Third-party script / cookies
_ga, _ga_*	Google Analytics 4 usage measurement after Analytics consent	Up to 13 months, subject to Google controls	First-party cookies set by Google Analytics

3.5 Personalization Cookies

Personalization cookies remember your preferences and activity on the site so you see a more tailored interface when you return. We store your recently viewed agents (up to 10, on your account) and your local UI preferences (such as marketplace sort order, filter selections, and sidebar state).

We do NOT use personalization data for third-party targeting or advertising.

Name (in browser)	Purpose	Duration	Type
lobor.uiPreferences (localStorage)	Marketplace sort, filter, sidebar collapse state	Persistent until you clear site data or revoke consent	First-party
Server-side recently_viewed_agents table	Your last 10 agents viewed, per account	Persistent until account deletion or consent revocation	Server

4. Your Choices

You can control how cookies are used in several ways:

• Cookie Banner (consent-first regions). On your first visit from a consent-first region (the EEA, the UK, Switzerland, and the additional European and associated territories we cover under the same consent-first approach — see Section 1), the blocking Cookie Banner offers three actions:
• Accept All — enables analytics, marketing, and personalization categories.
• Reject Non-Essential — only essential cookies are used.
• Customize — opens a settings panel where you can toggle each non-essential category individually (Analytics, Marketing, Personalization) before saving.
• Notice bar (everywhere else). On your first visit from a region where cookies are active by default, a non-blocking notice bar explains that we use cookies for analytics and ads measurement, with Cookie settings (opens the same settings panel) and OK (dismisses the bar; you can still opt out at any time).
• Revisit your choices. Visit [/legal/cookie-settings](/legal/cookie-settings) at any time to review and update your preferences. You do not need to clear any browser data.
• Browser-level controls. Most browsers allow you to view, delete, and block cookies through their settings. Blocking essential cookies may prevent the Services from working.
• Global Privacy Control (GPC). Lobor honors the GPC signal in every region, as required by the California Consumer Privacy Act (as amended by the CPRA). If your browser sends Sec-GPC: 1 (navigator.globalPrivacyControl === true), we treat your preferences as "Reject Non-Essential" — no regional default or notice-bar dismissal overrides it.
• Do Not Track (DNT). Lobor honors the DNT signal for non-essential cookies. If your browser sends DNT: 1 or navigator.doNotTrack === '1', we will treat your preferences as if you selected "Reject Non-Essential" and will not show the Cookie Banner.

5. How to Delete Cookies

You can delete cookies that have already been stored on your device through your browser settings. The exact steps differ by browser; the links below are placeholders pointing to common help articles:

• Google Chrome — Settings → Privacy and security → Cookies and other site data
• Mozilla Firefox — Settings → Privacy & Security → Cookies and Site Data
• Safari (macOS) — Safari → Settings → Privacy → Manage Website Data
• Microsoft Edge — Settings → Cookies and site permissions → Manage and delete cookies and site data
• Mobile browsers — refer to your device's browser help center.

Deleting cookies will sign you out of the Services and reset your saved preferences, including language and theme.

6. Changes

We may update this Cookie Policy from time to time to reflect changes to the Services, the cookies we use, or applicable law. The "Last updated" date at the top indicates when the Policy was last revised. Material changes will be communicated through an in-product notice or by re-prompting the Cookie Banner.

7. Contact

For questions about this Cookie Policy or our cookie practices, contact:

Lobor, Inc.
Email: privacy@augex.ai