Cookies

Your consent choice — vera_cmp_consent. The consent manager stores the categories you chose, when you chose, the version of the consent notice, and a random ID for that choice, so it does not ask again on every page. It keeps them for 365 days; then, or when a new category or purpose needs your choice, it asks again.

Access to the financials — __Host-cybr-access. Set only once access to the financial detail has been granted — when you open an access link we sent you, or when a form you send qualifies for access straight away — and only on this site. It is signed, and it says only that access was granted, under which offering mode, against which version of the eligibility wording, and when, with a random ID for that grant: no name, no email, no answer from the form. It expires thirty days after access was granted.

A form error, without JavaScript — __Secure-cybr-gate-flash. Set only on the investor-access pages, and only if you send a form with JavaScript switched off and it comes back with an error. It carries the form, the kind of error and the names of the fields to correct — never what you typed — and lasts twenty seconds.

The opening sequence — cybr.boot, in session storage. The home page remembers, for this tab, that its opening sequence has already played. It is not a cookie, and it is cleared when you close the tab.

The bot check — Vercel BotID. When you send a form, a check script served from this site’s own address collects signals from your browser and device to tell a person from a bot. It may set items of its own in your browser; they are Vercel’s, and last as Vercel sets them.

A security challenge — Vercel, our host. If Vercel’s firewall challenges a request to this site, to check that a browser rather than a bot sent it, Vercel may set a cookie of its own to remember that the check was passed. It is set only for a request that is challenged, it is Vercel’s, and it lasts as Vercel sets it.

Nothing on this site uses this category. It exists so that anything added later has to ask first.

Yandex Metrica, which sets its own cookies and storage items on this site (named _ym_uid, _ym_d, _ym_isad and similar) and cookies on Yandex’s own domains, to count visits and see which sections people read. It loads only after you accept analytics, only on the public pages, and never on the investor-access pages, the confirmation page or the financials. Session recording (Webvisor) and click maps are switched off in our code, so the session-recording cookie _ym_visorc is not part of this setup. Nothing typed into any form reaches it.

Our own event log uses cybr_sid, in session storage: a random ID that groups this tab’s analytics events. It is created only after you accept analytics, and removed when the tab closes or you withdraw.

While your browser sends Global Privacy Control, none of this loads, even if you switch Analytics on.

There is no advertising or marketing tracking on this site. Nothing uses this category; it exists so that none can be added without asking you. A Global Privacy Control signal from your browser keeps both Analytics and Marketing off.

Analytics items are set only after you accept analytics, and never while your browser sends Global Privacy Control. Nothing is set in the Functional or Marketing categories.

Switch Analytics off in Cookie preferences and the site deletes the _ym cookies on this site’s address and on its parent domain, removes the _ym items from local and session storage, forgets the tab’s random ID and — if Metrica had already loaded — reloads the page so that it stops. Cookies Yandex set on its own domains stay until they expire or you delete them in your browser.

You can also block or delete cookies in your browser settings. Blocking the strictly necessary items may break parts of the site, such as access to the financials.

Before you choose, only the strictly necessary items are active, and Vercel, our host, receives your IP address and browser data with every page you open. What happens to that, and to anything you send through a form, is in the privacy notice. Third-party items on other domains are governed by those providers’ policies.