Alfred
Felix
Astrid
Herman
Frida
Viktor
Maja
Vera
Iris
Thor
Nora
Lucas
In brief
- Until you have made a choice in the cookie banner, the website only uses what is needed for it to work. The exception is Google Analytics for visitors in the United States.
- Statistics (Google Analytics and Microsoft Clarity) and ad measurement (Google Ads and Meta) only start when you say yes. In the United States, Google Analytics runs until you say no.
- It is as easy to say no as yes, and you can change your choice whenever you like.
- If your browser sends the Global Privacy Control signal, we record it as a no to everything except what is necessary.
- The chat only loads when you click on it.
What are cookies
Cookies are small text files that a website stores in your browser. Your browser also has local storage (localStorage and sessionStorage) that works in the same way. On this page we call all of this cookies, because the same rules apply.
Under the Norwegian Electronic Communications Act (ekomloven) section 3-15, we may only store or read such information on your device if you consent, or if it is necessary to provide something you have asked for. When cookies contain personal data, the General Data Protection Regulation (GDPR) also applies. How we otherwise process personal data is described in the privacy notice.
The categories we use
Necessary
Always on
Needed for the website to work and to remember the choices you have made, such as your consent, your language and light or dark mode. These cannot be switched off in the banner, but you can delete them in your browser.
Statistics
Requires consent
Shows us how the website is used, which pages work and where people drop off, so that we can improve it. We do not use it to find out who you are. If your device is set to a time zone in the United States, Google Analytics runs until you say no.
Marketing
Requires consent
Measures whether our ads lead to enquiries, and lets us show ads to people who have visited the website before. Google and Meta may link this to the account you have with them.
All the cookies we use
The list shows what is set when you visit the website. “Heyroes” means that the cookie is set on our own domain. The providers may change the names and durations of their own cookies, and we update the list when we notice.
Necessary
| Name | Set by | What it does | Duration |
|---|---|---|---|
| wpconsent_ | Heyroes | Stores what you have chosen in the cookie banner | 6 months |
| hh_ | Heyroes | A copy of your choice that our scripts read, with a random ID we use in the consent log | 6 months |
| hh_ | Heyroes | Remembers that you have chosen a country and language, so that we do not suggest another one | 12 months |
| hh- | Heyroes (local storage) | Remembers that you have chosen dark mode | Until you switch back or delete it |
| hh_ | Heyroes (session storage) | Remembers the web address you entered in one of the tools, so that the next step can use it | Until you close the tab |
| exit- | Heyroes (session storage) | Remembers that we showed you an offer as you were about to leave, so that it does not appear again | Until you close the tab |
| exit- | Heyroes (local storage) | Remembers that you have closed the offer or the booking button, so that they stay hidden | Until you delete it |
| Chatbase | Chatbase (local storage) | Keeps the conversation when you change pages. Only set if you open the chat | Until you delete it |
| wordpress_ | Heyroes | Login for those who edit the website. Not set for ordinary visitors | The session or up to 14 days |
Statistics
| Name | Set by | What it does | Duration |
|---|---|---|---|
| _ | Google Analytics | Distinguishes visitors from each other with a random ID | 2 years |
| _ | Google Analytics | Keeps track of your session | 2 years |
| _ | Microsoft Clarity | Recognises your browser between visits | 12 months |
| _ | Microsoft Clarity | Groups page views into one session | 1 day |
| CLID, MUID | Microsoft (clarity.ms, bing.com) | Recognises your browser across websites that use Clarity | 12 months |
| hh_ | Heyroes (session storage) | Remembers which page, link or campaign brought you here, so that we can see which channels generate enquiries. Click IDs from ads are only stored if you have also said yes to marketing | Until you close the tab |
Clarity shows us clicks, scrolling and mouse movements on the pages. Text you type in forms is masked before it is sent to Microsoft.
Marketing
| Name | Set by | What it does | Duration |
|---|---|---|---|
| _ | Google Ads | Measures whether a click on a Google ad led to an enquiry | 3 months |
| _ | Meta | Distinguishes visitors from each other when we measure ads on Facebook and Instagram | 3 months |
| _ | Meta | Stores the click ID when you arrive from an ad on Facebook or Instagram | 3 months |
If you have said yes to marketing and you submit a form, we also notify Meta of the enquiry directly from our server. Your email, phone number and name are then sent as a hash (a code that cannot be converted back), together with the click ID, IP address and browser type, so that Meta can measure the ad. Without consent, nothing is sent.
The chat and the forms
The chat on the website is provided by Chatbase and is an AI assistant. It does not load until you click the chat button, so Chatbase receives nothing from you before then. When you open it, Chatbase receives technical information such as your IP address and browser type, and what you write.
The forms are protected against spam by Cloudflare Turnstile. Turnstile only loads on pages with a form and looks at technical signals from the browser to tell humans from bots. Cloudflare does not use this for marketing.
How we respect your choice
- The banner has equally large buttons to accept and decline, and no boxes are ticked in advance.
- Google Analytics, Google Ads, the Meta pixel and Microsoft Clarity do not load at all until you have said yes. Google therefore receives nothing from us before then. The only exception is Google Analytics for visitors whose device is set to a time zone in the United States. It stops, and its cookies are deleted, when you say no.
- We also use Google Consent Mode v2, so that the Google tags know what you have chosen and do not store anything you have said no to.
- If your browser sends the Global Privacy Control (GPC) signal, we record it as a no to statistics and marketing, and show a message about it.
- We ask again after 6 months.
- We log your consent so that we can demonstrate that we have it: a random ID, what you chose, which version of the banner you saw, the page you were on, the time, the browser type and a hash of your IP address. The log is deleted after 2 years.
Changing or withdrawing consent
You can change your choice at any time, and it is as easy to withdraw consent as to give it. What you agreed to before remains lawful, but we stop collecting anything new. You can also delete the cookies in your browser settings. You will then see the banner again next time.
The app
The app at app.heyroes.com only uses cookies that are needed for login, security and connecting the services you link to it. It has no analytics tools or ad tracking.
Questions
If you have any questions about cookies, write to hello@heyroes.com. If you want to complain, you can contact the Norwegian Data Protection Authority (Datatilsynet), but we would appreciate the chance to put things right first.
