— Legal
Cookie Policy
Last updated November 11, 2026
What are cookies?
Serviceform’s website uses cookies to distinguish users from one another, enhance browsing experience, and improve site functionality. The company stores small files of letters and numbers on your browser or computer with your agreement. The term “cookies” in this notice encompasses similar technologies including pixels, local storage, and SDKs.
Legal basis
Serviceform relies on several legal frameworks:
- Strictly necessary cookies are deployed without prior consent under §205(2) of the Finnish Act on Electronic Communications Services and Article 5(3) of the ePrivacy Directive, as they are essential for providing requested services.
- All other cookies (analytical and marketing) require prior, freely given, specific, informed consent collected through the Serviceform Cookie Controller, as mandated by §205 of the Finnish Act and Article 6(1)(a) GDPR.
Types of cookies we use
- Strictly necessary – Required for website operation, including language preference, A/B test variant assignment, security, and load balancing. These cannot be disabled.
- Analytical – Help us see which pages work and which do not. Loaded only with consent.
- Marketing – Let us measure our ads and reach you again on other platforms. Loaded only with consent.
Cookies set by Serviceform
The following cookies are utilized by the Serviceform pixel and iframe embeds to manage sessions and visitor interactions.
| Name | Purpose | Type (Category) | Duration |
|---|---|---|---|
sf-pxs | Short-lived pixel session ID used to connect page views, chat/form activity, and the active widget session. | Functional / session | 30 min or 72 min after lead submission |
sf-session | Legacy chat/form continuation cookie. Stores the current chat/form step so a user can continue a flow after reload/navigation. | Functional | 144 min |
sf-livechat | Legacy live chat session marker used to keep an agent/live chat session active across page changes. | Functional | 144 min |
sf-popup-time-<toolId> | Remembers that a popup/chat prompt was shown or dismissed so it does not repeatedly appear. | Functional / UX | Varies, depends on popup configuration |
sf-did | Persistent device ID for cross-session analytics/journey stitching. | Analytics | 365 days |
sf-ab-<testId> | Stores A/B test assignment so the same visitor consistently sees the same variant. | Analytics / experimentation | 1-60 days (default 30 d), depends on the AB test duration, counted from the end date |
sf-testing | Internal test-mode cookie when a page is opened with the sf-test parameter. | Testing | 29 min, can be cleared instantly |
Browser storage used by the chatbot
These entries are stored in the browser’s sessionStorage. While these are not cookies, they are relevant for internal privacy reviews and data processing transparency.
| Name | Storage | Purpose | Expiry |
|---|---|---|---|
mira_user_id | sessionStorage | Anonymous per-tab visitor ID for the chatbot session. | Cleared when browser tab/session ends |
mira_session_<toolId> | sessionStorage | Chatbot session ID when the pixel cookie is unavailable. (Only used when Mira is not installed through the pixel) A session expires after 3 hours, or sooner if you close the browser tab. | Cleared when browser tab/session ends |
mira_history_<toolId>_<userId> | sessionStorage | Stores recent chat messages so the conversation survives refresh/navigation. | Cleared on tab close; app also expires stored history |
mira_history_timestamp_<toolId>_<userId> | sessionStorage | Timestamp used to expire stored chat history. | Same as above |
mira_search_<toolId>_<userId> | sessionStorage | Temporary product/search refinement state, if search features are enabled. | Typically expires after 3 hours |
mira_session_events | sessionStorage | Popup display state, event deduplication, and session-level A/B assignment state. | Cleared when browser tab/session ends |
mira_lc_session | sessionStorage | Temporary live chat session token for reconnecting after refresh. | Cleared on tab close or when live chat ends |
mira_lc_queued_at | sessionStorage | Timestamp for live chat queue timeout handling. | Cleared on tab close or timeout |
Cookie modes in Serviceform tools
Regarding Cookies, Serviceform tools provide two modes, cookieless mode and default model. The mode is selected in the installation and applies to all Serviceform tools on the same domain.
Default mode
When using the default mode, Serviceform tools are visible only if all the Serviceform cookies have been approved by the user and the cookie controller has been configured correctly.
Strictly necessary mode
If you want to minimize the use of cookies, we can configure the Serviceform pixel to operate in Strictly Necessary Mode.
In this mode, only strictly necessary session cookies may be created when a visitor actively starts using a Serviceform tool, such as opening a chatbot or submitting a form. No analytics, visitor tracking, or A/B testing cookies (such as sf-did or sf-ab-<testId>) are created unless the visitor has given explicit consent for analytics cookies.
The strictly necessary session cookie is used only to maintain the requested service – for example, to keep a chatbot conversation active, remember the conversation during the session, or complete a form submission. It is not used for marketing, cross-site tracking, profiling, or website analytics.
Benefits
- Only strictly necessary session cookies are used before analytics consent.
- Chatbots and forms continue to function normally while prioritizing visitor privacy.
Limitations
- Website analytics are unavailable until analytics consent is granted.
- Visitor metrics, such as unique visitor counts, may be less accurate.
This approach aligns with GDPR principles by limiting cookies to those that are strictly necessary for providing a service explicitly requested by the visitor, while analytics and marketing cookies remain disabled until consent is obtained.
No cookies mode
When requested, we can also completely remove cookies from our tools. Please send the request to our customer service.
Serviceform cookie installation
Important! When using Serviceform tools, to comply with GDPR or other privacy-related requirements:
- Serviceform must be added as a third-party provider for the customer website Privacy Policy.
- Serviceform cookies must be added to customer website cookie policy
- Serviceform cookies must be configured to the website cookie consent controller according to their classification and verify the consent controlling works expectedly.
Please see the classification of cookies in the table above to help installation.
Specific third-party cookies
Strictly necessary
| Name | Provider | Purpose | Retention |
|---|---|---|---|
sf-consent-v4 | Serviceform | Stores your cookie consent choice. Set in browser localStorage. | Until cleared |
sf_h1 | Serviceform | A/B test variant – keeps the version you see consistent across loads. | 30 days |
cf_clearance | Cloudflare | Bot-protection challenge result. | 30 days |
__cf_bm | Cloudflare | Bot-management session identifier. | 30 minutes |
Analytical (consent required)
| Name | Provider | Purpose | Retention |
|---|---|---|---|
sf_vid · sf_sid | Serviceform Analytics | First-party visitor and session IDs for our own product analytics – page views, clicks and traffic source. EU-hosted, no third parties. | 365 days (sf_vid) · session (sf_sid) |
mp_…_mixpanel | Mixpanel (EU) | Session recordings and click heatmaps so we can see how pages are used and improve them. Form inputs are always masked. Set in browser localStorage, processed on Mixpanel’s EU servers. | 365 days |
Marketing (consent required)
| Name | Provider | Purpose | Retention |
|---|---|---|---|
_gcl_au | Google Ads | Conversion attribution for Google Ads campaigns. | 90 days |
_ga | Set by Google Tag (gtag.js). Distinguishes unique users. | 2 years | |
_ga_<id> | Per-property session counter created by gtag.js even in an Ads-only setup. | 2 years | |
IDE | Google DoubleClick | Set on doubleclick.net for ad measurement and remarketing. | 13 months |
_fbp · _fbc | Meta (Facebook) | Meta Pixel – ad measurement and conversion attribution for Meta campaigns. | 90 days |
li_fat_id · bcookie · lidc | LinkedIn Insight Tag – LinkedIn campaign attribution, conversion measurement and remarketing. | Up to 1 year | |
Visitor pixel · __cflb | Lemlist | Records the page visited, active time and click count for sales attribution. The __cflb cookie is a third-party load-balancing cookie set by Lemlist’s Cloudflare infrastructure. | Page visit · up to 7 hours (__cflb) |
ap3c · ap3sessionkey · other ap3* storage | Ortto | Connects website visits and activity to Ortto for sales and marketing automation. | Session to 1 year |
Google Ads operates under Google Consent Mode v2: until you opt in, only cookieless modelled-conversion pings are sent.
LinkedIn Insight Tag, Lemlist and Ortto load only after you grant marketing consent. Lemlist and Ortto are also delayed until after the initial page-load and interaction window.
We do not currently load Hotjar, Sentry, GA4 (as a measurement property), X Ads, HubSpot, Leadfeeder, Dealfront, Reddit Pixel, Reb2b or ActiveCampaign on this domain. If we add any of those later, they will appear in the Marketing or Analytical category above and require fresh consent.
Consent audit log
When you make a cookie choice, we record a pseudonymous audit entry in our ClickHouse cluster on European infrastructure. The entry stores: your decision (analytics / marketing booleans), the schema version, an ISO country code, and a one-way SHA-256 hash of your IP + user agent + a server-side secret. We never store your raw IP or any directly identifying information. The record is kept for 13 months, after which ClickHouse expires it automatically. This log exists solely so we can demonstrate, on request from you or a supervisory authority, that consent was given (GDPR Art. 7(1)).
Managing your preferences
Open the Cookie Preferences link at the bottom of any page to review or change your choice at any time. Selecting “Reject all” stops every non-essential cookie immediately and tells Google to model conversions cookielessly going forward. The control follows EDPB guidance and Finnish Traficom expectations: a “Reject all” option is presented with the same prominence as “Accept all.”
Browser-level controls are not valid consent mechanisms under Finnish law but serve as supplementary management tools. Deleting your localStorage will invalidate the consent record and re-show the banner on your next visit.
Contact and supervisory authority
Cookie-related questions should be directed to asiakaspalvelu@serviceform.com. Complaints regarding cookie handling compliance may be filed with the Office of the Data Protection Ombudsman of Finland (Lintulahdenkuja 4, 00530 Helsinki) or Traficom under §205 of the Act on Electronic Communications Services.