Cookie Policy

Effective Date

This Cookie Policy is effective as of October 3, 2026.

We will update the Effective Date at the top of this page whenever we make material changes. The version that applies to your visit is the version published at the time you accessed the website.

Introduction

This Cookie Policy explains how Burna AI, Inc. ("Burna AI," "we," "us," or "our") uses cookies and similar technologies on its public website at burna.ai, including www.burna.ai (the "Website").

This policy is a companion to our Privacy Policy, which describes more broadly how we collect, use, and protect personal information. Where this Cookie Policy is silent, the Privacy Policy governs. The third parties that process personal information for us are listed on our subprocessors page.

Our approach to cookies

1. Cookieless analytics by default. The analytics that run on every visit, PostHog and Cloudflare Web Analytics, use no cookies or browser storage. Until you click Accept All, no tag that sets analytics or marketing cookies is loaded.
2. Tags only after Accept All. Google Tag Manager, and through it Google Analytics 4, Plausible, the LinkedIn Insight Tag and the Apollo.io website tracker, load only after you click Accept All in the cookie banner. If you click Decline All, none of them load.
3. One banner for every visitor. The same banner appears on your first visit wherever you are, and your choice is kept in your own browser.

SCOPE This Cookie Policy covers the Website. ctcae.ai and Protocol Studio publish their own cookie policies, at ctcae.ai/cookies and protocolstudio.ai/cookies. The Burna AI application at app.burna.ai and the Healthnotes mobile app are outside this policy; the Mobile Applications section of the Privacy Policy describes Healthnotes.

What cookies are

A cookie is a small text file that a website places on your device (computer, phone, or tablet) through your browser. Cookies let a website remember information about your visit, such as your sign-in or a setting you chose, so the next page or the next visit works correctly.

Session cookies exist only while your browser is open and are deleted when you close it. Persistent cookies remain on your device for a defined period or until you delete them.

First-party cookies are set by the site you are visiting, here burna.ai. Third-party cookies are set by another domain, such as a service whose script or frame the page loads. Third-party cookies are controlled by the service that sets them and governed by that service's own policies.

This policy also covers technologies that work like cookies even when they are not technically cookies, including:

• Pixels (sometimes called web beacons or tracking pixels): small invisible images or scripts that record that a page was viewed.
• Local storage and session storage: browser features that keep small amounts of information on your device for one site. Local storage lasts until it is cleared; session storage lasts until you close the tab.
• Server-side visit counting: some analytics tools count visitors without storing anything on your device, by computing a short-lived identifier on their own servers from your IP address and browser details. PostHog on every visit, and Plausible after Accept All, count visits this way on the Website.
• Measurement scripts: small scripts that report how a page loaded and was used, without storing anything on your device. Cloudflare Web Analytics works this way on the Website.

Categories we use

We group what the Website stores into four categories. The table in the next section lists each item by name.

Strictly necessary. Storage the Website needs to do what you asked: the record of your cookie choice, an access cookie that keeps a restricted page open after you reach it through a private access link, and the two anonymous session cookies the fishbone board uses to read your drawing and deliver an export you request. These are set without asking for your consent. You can block them in your browser, but parts of the Website may then not work as described here.

Preferences. The interface language detected from your browser, kept in a cookie and in local storage by the language library the Website loads on every page, and your choice of light or dark theme, kept in local storage when you switch. The Website's pages are in English. These are set without asking for your consent.

Analytics. PostHog runs on every visit without cookies or browser storage. It records the pages you view, how long a page stays open, page load performance, the links and buttons you click in the navigation, footer and calls to action, links you follow to other sites, how far you scroll, which sections of a page come into view, the campaign tags in the link you arrived from, and whether you chose Accept All or Decline All. It also records named steps: opening or booking a call on the request-demo page, submitting the newsletter or a resource request form and whether it went through, and actions in the Website's interactive tools, such as how many findings a tool returned. These events carry counts, timings and form names, not the text you type. It counts visitors with a daily identifier it computes on its servers from your IP address, browser user agent and the site's host name, so the same visitor is counted as new on a different day. PostHog's capture of "dead clicks", clicks that produce no change on the page, is turned off. Cloudflare Web Analytics, a script from Cloudflare, measures page load performance and counts visits, without cookies or browser storage. After you click Accept All, Google Analytics 4 sets its own cookies on burna.ai, and Plausible counts page views, clicks on links to other sites, file downloads and form submissions without cookies.

Marketing and advertising. After you click Accept All, the Website loads two marketing tags. The LinkedIn Insight Tag lets LinkedIn report on visits from LinkedIn members and use the visit for LinkedIn advertising measurement and audiences, under LinkedIn's own policies. The Apollo.io website tracker lets Apollo.io match a visit to the company it comes from and report the pages viewed; where Apollo's person-level identification is switched on, Apollo.io can also match a visit from the United States to a person in its database. Neither tag loads if you click Decline All or make no choice.

Specific cookies set

The table below lists what the Website and the services it loads store on your device: what each item does, how long it lasts, and when it is set.

Third-party cookies

When the Website loads a service hosted by a third party, that third party may set its own cookies or storage on your device. Those cookies are governed by the third party's privacy and cookie policies.

On the Website this happens in four ways. PostHog and Cloudflare Web Analytics run on every visit without cookies or browser storage. The tags listed above load after you click Accept All. The Cal.com scheduler on the request-demo page is a frame served by Cal.com. Links to our LinkedIn company page and our X account take you to those sites, whose own cookies apply there.

The policies of the services the Website uses:

• Google (Analytics and Tag Manager): policies.google.com/technologies/cookies
• LinkedIn: linkedin.com/legal/cookie-policy, with the cookie table at linkedin.com/legal/l/cookie-table
• Apollo.io: apollo.io/privacy-policy
• Plausible: plausible.io/data-policy
• PostHog: posthog.com/privacy
• Cloudflare: cloudflare.com/privacypolicy
• Cal.com: cal.com/privacy
• X (formerly Twitter): help.x.com/en/rules-and-policies/x-cookies

How to control cookies

Cookie banner. On your first visit the Website shows a banner with two buttons, Accept All and Decline All, to every visitor wherever they are. Accept All loads the analytics and marketing tags described above; Decline All keeps them off. Your choice is kept in your browser's local storage under cookie-consent, with no fixed expiry, and PostHog records the choice as a cookieless event. To change your choice, clear the stored data for burna.ai in your browser; the banner then appears again on your next visit, and the tags stay off until you click Accept All.

Browser settings. All major browsers let you view, block, and delete cookies and site data for one site or for all sites. Blocking all cookies and storage may stop parts of the Website from working as described.

Google Analytics. Google offers a browser add-on that stops Google Analytics from receiving data: tools.google.com/dlpage/gaoptout.

LinkedIn. LinkedIn members can manage LinkedIn's advertising use of their data in their LinkedIn advertising settings.

Cookie instructions for the major browsers:

• Google Chrome: support.google.com/chrome/answer/95647
• Apple Safari (macOS): support.apple.com/guide/safari/manage-cookies-sfri11471
• Apple Safari (iOS): support.apple.com/HT201265
• Mozilla Firefox: support.mozilla.org/en-US/kb/enhanced-tracking-protection-firefox-desktop
• Microsoft Edge: support.microsoft.com/en-us/microsoft-edge
• Brave: support.brave.com/hc/en-us/articles/360050634931

EU, UK, and Brazil consent

Visitors from the European Economic Area, the United Kingdom, Switzerland, and Brazil see the same consent flow as every other visitor:

• First visit. Before you choose, the Website loads no tag that sets analytics or marketing cookies. PostHog and Cloudflare Web Analytics run without cookies throughout, and the language cookie described above is set on every visit.
• Your choices. Accept All and Decline All apply to the four tags together.
• Recording your choice. Your choice stays in your browser's local storage until you clear it.
• Withdrawing consent. Clearing the stored data for burna.ai removes your choice, so the banner appears again and the tags stay off until you click Accept All. It also removes the Google Analytics cookies set on burna.ai. Cookies that LinkedIn or Apollo.io set on their own domains are removed through your browser's settings for those domains.
• Presentation. The two buttons appear together, at the same button size. Accept All is a filled button and Decline All an outlined one.

DNT and GPC signals

Do Not Track (DNT). Some browsers can send a "Do Not Track" signal. There is no common standard for how a website should respond to it, and the Website does not change its behavior when it receives one.

Global Privacy Control (GPC). The Website does not read the GPC signal. The controls that act on the Website are the cookie banner and your browser settings, described above.

Changes to this policy

We may update this Cookie Policy from time to time to reflect changes in the cookies and tags we use, the services we work with, or applicable law.

We will update the Effective Date at the top of this page whenever we make material changes. The version published at burna.ai/cookies at the time of your visit is the version that applies to that visit.

How we handle updates:

• Minor updates (typographic fixes, clarifications that do not change practice): we will update this page.
• Material changes (a new cookie, tag or third-party service, or a change to how consent works): we will update this page and its Effective Date.

Contact us

If you have questions about this Cookie Policy or about the cookies set on your device by the Website, contact [email protected].

If you find a cookie or stored item on burna.ai that this page does not list, tell [email protected] so we can investigate and update the policy.

For broader privacy questions, or to exercise rights under GDPR, UK GDPR, CCPA/CPRA, LGPD, or other applicable laws, see our Privacy Policy, which describes the full set of rights available to you and how to exercise them.