Everything we have committed to in writing, in one place. The Terms of Service incorporate the Data Processing Agreement, the sub-processor list and the SLA by reference — you do not need to sign anything for them to apply.
Every category except the essential one can be switched off. A category left off is never loaded — not merely idle. We keep your choice for 12 months, and the “Cookie preferences” link in the footer reopens this window whenever you want.
Consent record
—
—
Essential cookies Always on
Signing in, security, and your language and theme. Without these you cannot log in or use the dashboard.
This category rests on legitimate interest and performance of a contract, so it needs no consent and cannot be switched off. You can still see exactly what we store.
Session and security (cookie)
wc_sess
Keeps you signed in to the customer dashboard. Created only when you log in, deleted when you log out. Marked so that no script in the browser can read it.
First partyCookie30 days.wcally.comHttpOnly · Secure · SameSite=Lax
wc_admin
The admin panel’s separate session cookie. It exists only in the site owner’s browser, and only after a password and a one-time code. Visitors never receive it.
First partyCookie30 days.wcally.comHttpOnly · Secure · SameSite=Lax
Bot and abuse protection
To tell automated attacks and fake traffic apart from real visitors, our infrastructure provider may place a short-lived security cookie. It carries nothing that identifies you and is never used for advertising.
Third partyCookieSession – 30 minwcally.comset by our infrastructure provider
Your consent record (local storage)
wcally_cookie_consent
Stores the choice you make in this window: consent id, date, policy version and which categories you allowed. Delete it and the banner returns.
First partyLocal storage12 monthswcally.com
Your dashboard preferences (local storage)
wcally_theme
Remembers whether to open the dashboard in the light or dark theme.
First partyLocal storageUntil you clear itwcally.com
wcally_dashlang
Remembers your dashboard language (10 available).
First partyLocal storageUntil you clear itwcally.com
wcally_site
If you run several sites, remembers which one you worked on last. Holds the site id only.
First partyLocal storageUntil you clear itwcally.com
wcally_tab
Remembers the last dashboard tab you opened, so a refresh puts you back where you were.
First partyLocal storageUntil you clear itwcally.com
wcally_view
Remembers whether you prefer records as a list or as cards.
First partyLocal storageUntil you clear itwcally.com
The admin panel’s theme and last open tab. These three exist only in the site owner’s browser.
First partyLocal storageUntil you clear itwcally.comsite owner only
App cache
Service worker cache
Stores pages, fonts and icons in your browser so the site can be installed like an app and still opens on a weak connection. Holds no personal data.
First partyCache storageUntil the version changeswcally.com
Analytics cookies Loads on consent
Helps us see which pages work and where people get stuck.
Turning this on loads Google Analytics 4 and Microsoft Clarity. IP addresses are truncated, ad matching stays off, and we never share the data with ad networks. Both services process data on servers abroad; your consent covers that transfer.
While this is off, none of that code reaches the page.
Google Analytics 4
_ga
Gives your browser a random id so visitors can be told apart. Carries no name, e-mail or IP address.
Third partyCookie2 years.wcally.comawaiting consent
_ga_<MEASUREMENT_ID>
Holds the state of your visit: when the session started and how many times you have been here.
Third partyCookie2 years.wcally.comawaiting consent
Microsoft Clarity
_clck
Stores a random id so later visits from the same browser can be matched up.
Third partyCookie1 year.wcally.comawaiting consent
_clsk
Links the pages you view within a single visit.
Third partyCookie1 day.wcally.comawaiting consent
CLID
Identifies which Clarity project the measurement belongs to.
Third partyCookie1 yearclarity.msawaiting consent
MUID · ANONCHK · SM
Microsoft’s ids for de-duplicating measurement and syncing it between their servers. We keep Clarity’s advertising integration switched off.
Third partyCookie10 min – 1 year.microsoft.com · c.clarity.msawaiting consent
Our own measurement
Widget event counter
Opens and plays on the demo widget on wcally.com reach our own server without any cookie, carrying nothing beyond the page address and the event name.
First partyLocal storage—wcally.comno cookie
Marketing and partners
Remembers where you came from if a partner sent you. Ad measurement is off today.
Partner tracking: our partners earn a commission on sign-ups that come from their links. Leave this off and we store no source — nothing changes for you, the commission simply is not credited.
Ad measurement: we run no ads today and no ad tag is loaded. If that changes, it will run only while this category is on, and it will be listed here first.
Partner (affiliate) tracking
wcally_aff · wcally_aff_at
If a partner link brought you here (?aff=…), stores the partner code so the commission reaches the right partner. Deleted once you sign up.
First partyLocal storage60 days, or until you sign upwcally.com
wcally_aff_src
Stores the address you clicked that link from, which is how we filter out fake referrals. Deleted once you sign up.
First partyLocal storage60 days, or until you sign upwcally.com
wcally_src · wcally_src_at
If you arrived from the widget badge on a customer’s site, stores which site that was. Deleted once you sign up.
First partyLocal storage60 days, or until you sign upwcally.com
Ad measurement
_gcl_au
Lets Google Ads match an ad click to a completed sign-up. Only appears if we start running ads.
Third partyCookie90 days.wcally.comawaiting consent
_uetsid · _uetvid
The ids Microsoft Ads uses for the same measurement. Only appears if we start running ads.
Third partyCookie1 day · 13 months.wcally.comawaiting consent
What this policy covers+
This policy explains the cookies and similar storage we place in your browser on wcally.com and its sub-addresses (customer dashboard, admin panel, downloadable plugins). The data controller is wcally; reach us any time at info@wcally.com.
The wcally widget our customers place on their own sites is covered in its own section below — the widget uses no cookies at all.
Why we process your personal data is set out in the Privacy Policy. This document is part of our disclosure duty under the GDPR, the CCPA and Türkiye’s KVKK (law 6698).
What is a cookie? What is local storage?+
A cookie is a small text file your browser stores and sends back to the server on every request. That is how a session stays open.
Local storage stays in your browser and is never sent on its own. We keep preferences there: theme, language, the last tab you opened. It is technically not a cookie, but the law treats both the same way — so we list both with the same detail.
First party means we placed it. Third party means it belongs to another company (a measurement or payment provider).
Which cookies and records we use+
The list below comes from a sweep of the whole codebase and is updated with every release. Anything tagged “awaiting consent” is not loaded yet — it runs only once you allow that category.
A handful of companies process data on our behalf. Each is bound by contract, may use the data only as we instruct, and none of them places advertising cookies on our site.
Cloudflare — delivery and security in front of wcally.com. This is the provider that may set the short-lived bot-protection cookie listed above; it sets no other cookie for us.
Hetzner — the servers behind our own traffic counting. Germany and Finland. Sets no cookies.
Amazon Web Services (SES) — sends the e-mails you receive from us: sign-up, alerts, invoices. Sets no cookies.
Our payment provider — takes payment and issues the invoice. Sets its own cookies, and only on the checkout page.
Google (Analytics 4) and Microsoft (Clarity) — measurement, and only if you allow analytics cookies.
Some of them process data outside your country. Those transfers rest on standard contractual clauses, and for the consent-based tools, on your consent — which you can withdraw at any time.
What the widget stores for your visitors+
The wcally widget sets no cookie and does not follow visitors between sites. It uses no ad network, no fingerprinting and no third-party id.
On a customer’s site the widget keeps exactly two records, in that site’s own local storage:
wcally_dismissed_<site key> — the moment you closed the widget, so it stays closed for the period the site owner set (24 hours by default).
wcally_tt_<site key> — the moment you closed the tooltip, kept the same way.
On the measurement side, opens and plays reach our own server without cookies, carrying nothing beyond the page address and the event name.
If the customer’s site runs its own Google Analytics or Meta Pixel, the widget reports the same event to that tag as well. wcally does not install those tags; they belong to the site owner and to that site’s own cookie notice.
How to change your choice+
The “Cookie preferences” link at the foot of every page reopens the preference window. You can withdraw consent at any time; withdrawal does not affect processing that already happened lawfully.
You can also delete or block all cookies in your browser. Blocking the essential ones makes signing in impossible.
Chrome: Settings → Privacy and security → Third-party cookies
Safari: Settings → Privacy → Manage cookies
Firefox: Settings → Privacy & Security → Cookies and Site Data
Edge: Settings → Cookies and site permissions
Your rights+
Under the GDPR and KVKK article 11 you may ask whether we process data about you, access it, have it corrected or erased, object to the processing, and receive your data in a portable form.
Write to info@wcally.com and we answer within 30 days. Include the consent id from the preference window and we can find your record straight away.
If you live in California: we do not sell or share your personal information.
Changes+
When we add a tool we update this list and raise the policy version. A new version asks for your consent again — an old consent never covers a new tool.