Exec x AI's Cookie Policy

1. Introduction and scope

Exec X AI UKS02 Ltd, registered in England and Wales with company number 16535629, is the data controller for personal data processed through cookies on www.execxai.com. Exec x AI advises organisations on AI strategy and builds cloud-native AI solutions within clients' own cloud environments.

Our approach is privacy-first: our website analytics are cookieless, we set no advertising or cross-site tracking cookies, and most pages set no cookies at all until you actively use a feature. By using this website you acknowledge this policy. You can manage your preferences at any time using the controls described below, and your right to withdraw consent is not affected by anything in this policy.

2. What are cookies

Cookies are small text files placed on your device when you visit a website. They allow a site to recognise your device on return visits and store information about your preferences or session state.

This policy also covers related browser technologies such as local storage and session storage. Where we record your consent choices we use your browser's local storage rather than a cookie.

Cookies can be set by us (first-party) or by third-party services we have integrated. First-party cookies support essential functionality. The only third-party cookies you may encounter come from our on-site "Ask" chat, described in section 8.

We process cookie data on the following legal bases: consent for non-essential technologies; legitimate interests for security and fraud prevention; and contractual necessity for services you have requested. Consent must be freely given, specific, informed, and unambiguous. Pre-ticked boxes are not used.

3. How we use cookies

Strictly necessary cookies keep the site functioning. They remember your regional edition, keep you signed in to the Atlas membership area, and let the "Ask" chat retain your conversation as you move between pages. They do not require your consent because they are technically essential, and each is set only when you use the related feature — not on a passive visit.

Analytics on this site is cookieless. We measure aggregate, anonymous usage with privacy-first tools (Plausible, Umami and Vercel Web Analytics) that set no cookies and cannot track you across other sites. Because they store no cookies and no directly identifying data, they place nothing on your device.

Preference behaviour, such as your EMEA/APAC edition, is remembered with a first-party cookie so you do not have to repeat the choice.

We set no marketing, advertising or retargeting cookies on this website.

4. Types of cookies

We categorise cookies by purpose, duration, and origin.

By purpose: strictly necessary (essential, no consent required) and functionality (personalisation). We do not use advertising cookies, and our analytics are cookieless, so there are no analytics or marketing cookies to categorise.

By duration: session cookies are deleted when you close your browser; persistent cookies remain for a defined period listed in the inventory below.

By origin: first-party cookies are set by www.execxai.com and managed by us; third-party cookies are set by external services we have integrated and managed by those providers.

5. Cookie inventory

This inventory is reviewed and updated when our integrations change. Cookies marked "set when" appear only if you use that feature; a passive visit to most pages sets no cookies.

Plausible, Umami and Vercel Web Analytics are cookieless and set no cookies, so they are not listed above.

6. Your choices and consent

When you first visit the site, a consent banner gives you the option to accept or reject each category of non-essential processing. You can accept all, reject all, or make category-by-category choices; analytics and marketing stay off until you turn them on.

Your consent applies to your device and browser. The banner is our own, built and hosted by us — there is no third-party consent vendor — and it records your choices in this site's browser storage (the execxai-cookies entry) rather than through a third-party consent service. You can change your choices at any time from the preferences link in the banner or the footer.

We previously used a third-party consent tool (CookieYes); it has been removed. If you visited before, a leftover cookieyes-consent cookie may remain on your device and can be safely deleted. Withdrawing consent does not affect any processing that took place while consent was in force.

7. Managing your preferences

You can manage cookies through the preferences panel in our consent banner or through your browser settings.

Browser controls vary by product. In Chrome: Settings, then Privacy and security, then Cookies and other site data. In Firefox: Settings, then Privacy and Security. In Safari: Settings, then Privacy. In Edge: Settings, then Cookies and site permissions. Browser-level controls apply to all sites, not just ours.

Because our analytics are cookieless there is no analytics cookie to opt out of; switching analytics off in the banner still prevents the measurement scripts from loading.

8. Third-party cookies

The only third-party cookies you may encounter come from our on-site "Ask" assistant, which is powered by OpenAI ChatKit. When the chat loads, OpenAI's infrastructure (Cloudflare) may set the__cf_bm and _cfuvid cookies on the openai.com domain for bot-management and rate-limiting. These are governed by OpenAI's privacy policy at openai.com/policies/privacy-policy and appear only if you use the chat.

Links to our social profiles (such as LinkedIn) are ordinary links, not embedded widgets; those platforms may set cookies only if you follow a link and interact with them on their own sites, under their own privacy policies. Our "Book a principal" scheduling link opens Calendly on Calendly's own domain and sets no cookies on www.execxai.com.

9. International transfers

Some processing (for example, the OpenAI ChatKit chat service) is carried out by providers based outside the UK and EEA. Where personal data is transferred to countries without an adequacy decision, we rely on standard contractual clauses or, where applicable, adequacy regulations and data bridge arrangements.

You can request details of the safeguards in place for any specific transfer by writing to compliance@execxai.com.

10. Data retention

Session cookies are deleted when you close your browser. Persistent first-party cookies are retained for the periods listed in the inventory above (for example, 30 days for the regional-edition and Atlas-session cookies). Your consent record persists in your browser's local storage until you clear this site's stored data.

Because our analytics are cookieless, we hold no analytics cookie data to retain. The OpenAI chat cookies expire as listed (one hour for __cf_bm; end of session for _cfuvid). When personal data collected through cookies is no longer needed, it is deleted or anonymised in accordance with our data retention procedures.

11. Your rights

Under the GDPR, UK DPA 2018, and DIFC Data Protection Law, you have the right to access personal data we hold about you through cookies, to request its erasure, to object to processing based on legitimate interests, and to withdraw consent for any processing based on consent.

To exercise any of these rights, contact our Data Protection Officer at compliance@execxai.com. We will respond within one calendar month.

12. Contact and complaints

If you are not satisfied with our response, you may complain to the Information Commissioner's Office (UK) at ico.org.uk/makeacomplaint, to your local EU supervisory authority, or to the DIFC Commissioner of Data Protection.

13. Changes to this policy

We update this policy when our cookie practices or legal obligations change. The effective date at the top of this page reflects the current version.

Significant changes will be communicated through the consent banner on your next visit.

14. Jurisdiction information

• EU visitors: we obtain explicit consent for all non-essential cookies in compliance with the GDPR and ePrivacy Directive. You may complain to your local data protection authority.
• UK visitors: we comply with PECR and UK GDPR. You may complain to the ICO.
• DIFC visitors: we comply with DIFC Data Protection Law No. 5 of 2020. You may complain to the DIFC Commissioner of Data Protection.
• All other visitors: we apply the highest applicable standard regardless of your location.