TESS AI PLATFORM COOKIE POLICY
This Cookie Policy was updated on July 27, 2026.
This Cookie Policy explains how and why Tess Tecnologia LTDA ("Tess", "we", "us") uses cookies and similar tracking technologies when you interact with the Tess website, platform, and related digital services (collectively, "the Application").
For simplicity, technologies such as cookies, local storage identifiers, web beacons, embedded scripts, and device identifiers are referred to as "Trackers" in this document.
Where applicable law requires consent for non-essential Trackers, you may withdraw consent at any time using the options described in the How to Manage Preferences section.
SCOPE
This policy applies to all users, visitors, and customers who access:
- the public website at https://tess.im;
- the Tess AI platform (authenticated workspace);
- related landing pages, legal pages, checkout flows, and embedded forms.
It covers Trackers deployed on computers, tablets, and smartphones.
This document addresses Trackers only. For broader personal data processing, see our Privacy Policy.
RELATED DOCUMENTS
- Privacy Policy
- Terms of Service
- Trust Center
LEGAL BASES
Under the LGPD (Brazil) and, where applicable, the GDPR (EU/EEA/UK), Tess relies on the following bases:
| Category | Typical Legal Basis |
|---|---|
| Strictly necessary Trackers | Legitimate interest / performance of contract / security |
| Functional Trackers | Legitimate interest and/or consent, depending on context |
| Analytics Trackers | Consent, where required by law |
TRACKERS USED BY THE APPLICATION
The inventory below was validated on June 1, 2026.
Strictly necessary Trackers
These Trackers are required for security, authentication, load balancing, and core operation of the Application.
Tess (first-party)
Tess sets first-party Trackers to maintain sessions, protect against CSRF attacks, and remember interface preferences.
| Tracker | Purpose | Duration |
|---|---|---|
| Session Cookie | Keeps you signed in and maintains workspace context | Session / up to configured session lifetime |
XSRF-TOKEN |
CSRF protection for form and API requests | Session |
navbarCollapsed_{userId}_{workspaceId} |
Remembers sidebar state | ~24 hours |
isMobileScreen |
Adapts layout between mobile and desktop | ~24 hours |
- Personal Data processed: session identifiers, interface preferences
- Place of processing: Brazil / infrastructure regions used by Tess hosting
Cloudflare (Cloudflare Inc.)
Cloudflare distributes traffic and protects the Application against abuse. Some Cloudflare cookies are strictly necessary for security and routing.
- Personal Data processed: IP address, device/browser signals, security tokens
- Place of processing: United States and global Cloudflare edge locations
- Privacy Policy: https://www.cloudflare.com/privacypolicy/
| Tracker | Duration |
|---|---|
_cfuvid |
Session / short-lived |
cf_clearance |
30 minutes |
__cf_bm |
~30 minutes |
Google reCAPTCHA (Google LLC)
Used on signup, login, and selected public forms for bot and abuse prevention.
- Personal Data processed: interaction signals, IP address, browser data
- Place of processing: United States
- Privacy Policy: https://policies.google.com/privacy
- Terms: https://policies.google.com/terms
Functional / experience Trackers
These Trackers improve support, onboarding, and optional product features.
Gleap (Gleap GmbH)
Active on platform and authentication pages, not on the public marketing homepage.
- Personal Data processed: user ID, email, name, plan, workspace metadata, support interaction data
- Place of processing: European Union / vendor infrastructure
- Privacy Policy: https://www.gleap.io/privacy
- Active on: authenticated platform pages (not on anonymous public homepage)
Typeform (Typeform S.L.)
Used when you open Tess-hosted forms (for example, phone verification or cancellation feedback).
- Personal Data processed: form responses, email, name, phone, company, Trackers
- Place of processing: Spain / European Union
- Privacy Policy: https://www.typeform.com/privacy-policy/
- Active on: specific flows only (embedded iframe or external link), not site-wide
Cello (Cello / referral program)
Affiliate and referral program widget when the affiliate center feature is enabled.
- Personal Data processed: referral identifiers, usage signals, Trackers
- Place of processing: United States / European Union (vendor infrastructure)
- Privacy Policy: https://cello.so/privacy
- Active on: authenticated users when the feature flag is enabled
Measurement and analytics Trackers
These Trackers help Tess measure usage, diagnose errors, and improve the product.
Google Analytics 4 (Google LLC)
Loaded via gtag.js when a measurement ID is configured in Tess admin settings.
- Personal Data processed: usage data, device/browser data, pseudonymous identifiers
- Place of processing: United States
- Privacy Policy: https://policies.google.com/privacy
- Opt out (browser add-on): https://tools.google.com/dlpage/gaoptout
| Tracker | Typical Duration |
|---|---|
_ga |
2 years |
_ga_* |
2 years |
_gid |
24 hours |
_gat |
1 minute |
Google Tag Manager (Google LLC)
We use Google Tag Manager to manage analytics and digital marketing tags configured by Tess. These tags may set third-party cookies as described in this policy.
- Personal Data processed: depends on tags configured inside the container
- Place of processing: United States
- Privacy Policy: https://policies.google.com/privacy
Sentry (Functional Software Inc.)
Error, performance, and diagnostic monitoring.
- Personal Data processed: pseudonymous user ID, email (when authenticated), stack traces, browser/device data, IP address
- Place of processing: United States
- Privacy Policy: https://sentry.io/privacy/
| Tracker / Storage | Purpose |
|---|---|
| Sentry session / replay storage | Error correlation and debugging |
PostHog (PostHog Inc.)
Product analytics for authenticated users when the PostHog feature flag is enabled (typically trial/onboarding cohorts).
- Personal Data processed: user ID, email, workspace metadata, page views, product usage events; session recording when enabled
- Place of processing: United States / European Union (depending on project configuration)
- Privacy Policy: https://posthog.com/privacy
- Opt out: request channel available under "Privacy Notice" or [email protected]
LogRocket (LogRocket Inc.)
Optional session replay on public pages when explicitly enabled via environment configuration.
- Personal Data processed: interaction recordings, device/browser data
- Place of processing: United States
- Privacy Policy: https://logrocket.com/privacy/
INTERNATIONAL DATA TRANSFER
Some of the Trackers described in the Trackers Used by the Application section are operated by vendors headquartered outside Brazil, as indicated in the "Place of processing" field of each entry. In such cases, the data necessary for the Tracker to operate may be transferred internationally.
The legal basis for the transfer follows the legal basis of the Tracker itself, as declared in the Legal Bases section:
- Strictly necessary Trackers: the transfer is necessary for the performance of the contract and to serve the legitimate interests of Tess in the security, authentication, and availability of the Application, being carried out upon prior notice to the User and without depending on specific consent.
- Functional and analytics Trackers: the transfer is based on consent, where required by law, and ceases when consent is withdrawn, as described in the How to Manage Preferences section.
Such transfers are carried out with adequate protection safeguards, in accordance with arts. 33 to 36 of the LGPD, ensuring that the data maintains a level of protection compatible with that required by Brazilian legislation. The User may request information about the safeguard mechanisms adopted through the channels indicated in the Owner and Data Controller section.
HOW TO MANAGE PREFERENCES
Browser and device controls
You can manage Trackers through your browser settings to:
- see which Trackers are stored;
- block Trackers;
- delete existing Trackers.
Browser controls usually apply globally and do not offer granular category consent.
Guides for common browsers: Google Chrome, Mozilla Firefox, Apple Safari, Microsoft Internet Explorer, Microsoft Edge, Brave, and Opera.
Third-party opt-outs
- Google Analytics: https://tools.google.com/dlpage/gaoptout
- Google ad personalization: https://adssettings.google.com/
- Industry opt-out programs: YourOnlineChoices (EU/UK), NAI (US), DAA (US)
Consequences of denying Trackers
If you block strictly necessary Trackers, parts of the Application may not function (for example, login, checkout, or security validation). Blocking analytics Trackers does not prevent core use of the platform but limits Tess ability to measure and improve the service.
YOUR RIGHTS
Depending on your location, you may have the right to:
- confirm whether Tess processes personal data via Trackers;
- access, correct, or delete personal data;
- object to or restrict certain processing;
- withdraw consent where processing is consent-based;
- request portability;
- lodge a complaint with ANPD (Brazil) or your local supervisory authority.
To exercise these rights, please preferably use the dedicated request channel available on our website under "Privacy Notice", managed by the Data Protection Officer (DPO) and monitored daily, with automated alerts for new requests. Contact by e-mail at [email protected] remains active as an alternative channel. Requests will be answered within the periods established by applicable legislation.
OWNER AND DATA CONTROLLER
Data Controller: Tess Tecnologia LTDA
CNPJ: 60.806.420/0001-91
Address: Avenue Oscar Niemeyer, 2000, Block 1, Room 401, Santo Cristo, Rio de Janeiro, RJ, 20220-297, Brazil
Website: https://tess.im
Data Protection Officer (DPO): DPO services are performed on Tess's behalf by Open CyberSecurity (https://opencybersecurity.com.br/), a privacy and information security consultancy contracted to support LGPD/GDPR compliance.
Contact: [email protected]
Because some third-party Trackers are controlled by external providers, refer to their privacy policies for full details. For questions about Tess use of Trackers, contact the DPO.
CHANGES TO THIS POLICY
We may update this Cookie Policy to reflect changes in technology, regulation, or Tess practices. The update date indicated at the top of this document identifies the current version. Material changes will be communicated through the Application or by updating this document.