WorkMesh Cookie Policy

This Cookie Policy explains how Cost Time Risk Pty Ltd trading as WorkMesh uses cookies and similar browser technologies. It should be read with the WorkMesh Privacy Policy.

1. What cookies are

Cookies are small text files stored by a website in your browser. Similar technologies include local browser storage and browser identifiers. They may be necessary for a service to work or may be optional technologies used for preferences, analytics or marketing.

2. Our approach

Necessary cookies are used for security, login, trusted-device choices and remembering your privacy selection. Optional categories are off by default. Google Analytics is loaded only after you consent to Analytics. LinkedIn Insight and Meta Pixel are loaded only after you consent to Marketing and only on selected public WorkMesh marketing, content and Blog pages. These optional services are not loaded on authenticated WorkMesh or other excluded operational surfaces.

3. Cookie inventory

Provider and consent overview: Google Analytics 4 (G-KY1052LEME) is used for public-site usage statistics under Analytics consent. LinkedIn Insight (9764794) and Meta Pixel (1112374878036019) are used for audience and marketing measurement under Marketing consent. Analytics and Marketing can be selected separately; rejecting either category prevents its corresponding provider from loading on a fresh page visit. Optional providers may process permitted visit information outside Australia, including in the United States.

Name or pattern	Provider	Category and purpose	Typical duration
SYSTEMS_APP_SESSION	WorkMesh	Necessary. Maintains an authenticated WorkMesh session and supports security and request protection.	Browser session, subject to server idle and absolute timeout settings
WM_TRUSTED_DEVICE	WorkMesh	Necessary when you select the option. Remembers an MFA-trusted browser using a protected random token. It does not contain the MFA secret.	30 days
WM_PRIVACY_CONSENT	WorkMesh	Necessary. Remembers your versioned privacy choices and consent identifier so optional services can honour them.	180 days
_ga	Google Analytics	Analytics. Distinguishes browsers using a random identifier so aggregate public website usage can be measured.	Up to 2 years
_ga_*	Google Analytics	Analytics. Persists session state for the Google Analytics property, including measurement ID G-KY1052LEME.	Up to 2 years
lms_ads, lms_analytics	LinkedIn	Marketing. LinkedIn identifiers used on third-party sites for advertising and analytics after Marketing consent.	30 days
li_fat_id	LinkedIn	Marketing. First-party indirect member identifier used for conversion tracking, retargeting and analytics when applicable.	30 days
li_giant	LinkedIn	Marketing. First-party indirect group identifier used for conversion tracking when applicable.	7 days
li_adsid	LinkedIn	Marketing browser storage. Pseudonymous first-party LinkedIn Ads identifier used as an additional conversion signal where LinkedIn makes it available.	Up to 6 months where applicable
_fbp	Meta	Marketing. First-party browser identifier used by Meta Pixel to measure visits and marketing performance after Marketing consent.	Typically up to 90 days
_fbc	Meta	Marketing. First-party click identifier that may be created when a visitor arrives from a Meta advertising link after Marketing consent.	Typically up to 90 days

4. Google Analytics

After Analytics consent, WorkMesh loads Google Analytics 4 using measurement ID G-KY1052LEME. It helps us understand matters such as visits, pages viewed, general referral sources, browser and device types and broad geographic usage so we can improve the public website.

Google LLC receives the measurement data processed through this tag and may process it outside Australia, including in the United States and other countries where Google or its service providers operate. We configure the tag without Google advertising signals or advertising personalisation. We do not provide a WorkMesh user ID, do not send names, email addresses or form contents, and remove query strings from the page location sent by our tag.

The analytics script is limited to public website pages that are deliberately marked for public analytics: Home, Enterprise, Business & SME, Solutions and solution pages, Platform, Industries, Developers, Why WorkMesh, Pricing, Request a demo, Waitlist, privacy/cookie/privacy-request pages, and public legal/commercial pages.

It is not loaded on the authenticated WorkMesh application, login or Business login, MFA setup and recovery, onboarding, controlled signup/account setup/completion, digital signing, external forms/approvals, unsubscribe, maintenance, noindex redirects, or other product-operation pages.

5. LinkedIn Insight Tag

After Marketing consent, WorkMesh loads the LinkedIn Insight Tag using Partner ID 9764794 on selected public marketing, content and Blog pages. LinkedIn states that the tag may collect information about a visit including the page URL, buttons clicked, referring page, IP address, browser and device characteristics and timestamp, together with LinkedIn cookies or pseudonymous identifiers.

We use the tag to understand aggregated professional audience demographics such as job title, job function, seniority, company, company size, industry and location, and to support measurement or retargeting if WorkMesh later runs LinkedIn campaigns. WorkMesh does not receive a named list of individual website visitors from LinkedIn Website Demographics. This implementation does not send WorkMesh form field contents, names or email addresses to LinkedIn and does not implement LinkedIn enhanced matching.

The LinkedIn tag is not loaded on authenticated WorkMesh application pages, login/security flows, onboarding, signing/external workflow pages, privacy-request pages or other sensitive operational surfaces. We deliberately omit LinkedIn's no-JavaScript image-pixel fallback because it would not be able to honour the WorkMesh Marketing consent gate.

LinkedIn may set or read additional cookies on its own domains in accordance with its current Cookie Policy and Cookie Table.

6. Meta Pixel

After Marketing consent, WorkMesh loads Meta Pixel ID 1112374878036019 on selected public marketing, content and Blog pages. The initial implementation sends the standard PageView event only. We do not send WorkMesh form field contents, names, email addresses or authenticated application activity through this implementation.

The Meta Pixel is not loaded on authenticated WorkMesh application pages, login/security flows, onboarding, signing/external workflow pages, privacy-request pages or other sensitive operational surfaces. We deliberately omit Meta's no-JavaScript image fallback because it would not be able to honour the WorkMesh Marketing consent gate.

7. Local browser storage

Authenticated WorkMesh screens may use first-party local storage for navigation return paths, workspace selection, archive-view preferences and similar interface settings. These items do not enable cross-site advertising and remain in the browser until cleared or replaced.

8. Your choices

Analytics controls Google Analytics; Marketing controls LinkedIn Insight and Meta Pixel. Each category can be enabled or disabled independently in Cookie settings. Withdrawing consent stops new tracking on WorkMesh pages after the change takes effect; it does not automatically delete information already processed by a provider.

On your first visit, you can select Accept all, Reject non-essential or Manage preferences. Analytics and marketing are not selected in advance. Select Cookie settings at any time to change or withdraw optional consent.

When Analytics consent is withdrawn, WorkMesh disables the public Analytics tag for the current page and attempts to remove first-party Google Analytics cookies accessible from the WorkMesh domain. When Marketing consent is withdrawn, WorkMesh removes accessible first-party LinkedIn and Meta identifiers where possible and reloads the page without the LinkedIn Insight Tag or Meta Pixel; provider-domain cookies cannot be deleted by the WorkMesh domain and can be managed through browser or provider controls. You can also clear cookies and local storage through your browser settings. Deleting WM_PRIVACY_CONSENT will cause the banner to appear again.

Necessary cookies cannot be switched off through the banner because login, security, trusted-device and privacy-choice functions may otherwise stop working.

9. Consent records

When you make or change a choice, WorkMesh stores the selection in WM_PRIVACY_CONSENT and may record a pseudonymous audit event containing the consent identifier, selected categories, policy versions, time, page, a protected IP hash and browser information. These records are normally retained for up to three years unless needed for a complaint, investigation or legal obligation.

10. Changes and contact

We will update this policy and the cookie inventory when our technologies or practices change. A new choice will be requested where a material change affects consent-based processing.

Questions and privacy rights requests may be submitted through the WorkMesh privacy request form.