Vysto Cookie & Tracking Notice
Document: Cookie & Tracking Notice Version: 1.0 Effective date: 23 October 2026 Status: Published Related documents: Terms of Service, Privacy Policy, Refund and Cancellation Policy
This notice describes how Vysto LLC (“Vysto,” “we”) uses cookies and similar technologies on vysto.ai, in the admin and MCP authentication flows, and on sites Customers publish on the platform, where Vysto sets an identifier to operate the site.
“Cookies” here includes cookies, local storage, session storage, and pixels. A session identifier can be a cookie or an equivalent stored by the browser. We treat them the same way.
1. Who sets what
Vysto sets the technologies in the table in Section 3, on our own domains and, where a Customer publishes a site on a Vysto domain or a custom domain we host, the identifiers required to run that site and to count visits.
A Customer may set additional cookies by embedding a third-party tool, a booking calendar, a pixel, or analytics on its own site. Those are the Customer’s. The Customer is the controller for them and must disclose them to its Visitors. Vysto does not control a tag the Customer adds, and this notice does not describe those tags. Customers should read this notice so they can tell Visitors about the Vysto session identifier that will be present on their site.
Customer sites that Vysto hosts do not receive Vysto advertising cookies. Vysto does not sell personal information for money.
Vysto does use advertising and analytics tags on one page of vysto.ai: the channel partner landing page. Those tags are the LinkedIn Insight Tag, the Meta Pixel, and the Google tag (Google Ads and Google Analytics). They measure visits from LinkedIn, Meta, and Google campaigns and they support retargeting of people who visit that page. They are not loaded on other vysto.ai pages, in the admin, on MCP, or on any site a Customer publishes. They do not read Customer Content or conversations on a Customer’s site.
Under the CCPA/CPRA, those tags may “share” personal information for cross-context behavioral advertising. A visitor can opt out as Section 5 describes. That is the only sharing of this kind.
For visitors in the EEA, the UK, and Switzerland, those tags do not fire until the visitor accepts them on the consent banner on that landing page. See Section 6. The tags must not be placed on the page in a way that lets them run before that choice.
2. Why a visit is counted
Self-serve and trial plans are metered in part by visits. A visit is a Visitor session on a published site, counted so Vysto can apply the visit allowance for the free tier and for any plan that includes a visit limit.
To do that we set a session identifier in the Visitor’s browser. The identifier:
- distinguishes one browsing session from another so the same session is not counted as many visits, and so a new session can be counted;
- is tied to the site and the time of the visit, not to a name, email, or advertising profile;
- is not used to follow the Visitor across other companies’ websites;
- is not used to build a marketing audience;
- is not a voiceprint and is not connected to voice identification.
The allowance that applies to a workspace is the number shown in that workspace’s plan or account at the time of the visit. This notice does not set the commercial limit. The plan does. If a plan has no visit cap, the identifier may still be set where we need it to operate the session or to detect abuse of the counter.
Without this identifier we cannot tell a genuine additional visit from a reload, and we cannot apply the free-tier and plan limits accurately. It is strictly necessary for the metering of the service the Customer asked us to provide. It is not an optional analytics cookie.
3. Technologies we use
| Name | Who | Purpose | How long |
|---|---|---|---|
| Visit session identifier | Vysto | Counts a visit against the workspace’s plan, including the free tier. See Section 2. | The browsing session. A new session can start a new count. We do not keep the identifier as a long-term profile of the Visitor. |
| Authentication session | Vysto | Keeps a Customer or Authorized User signed in to the admin, and protects the session against forgery. | For the signed-in session, or until logout, with a limited maximum life. The Customer can end it by logging out. |
| Security cookies | Vysto | Load balancing, bot mitigation, and abuse prevention. | Session, or a short fixed period needed for the control. |
| Conversation state | Vysto | Keeps the current conversation coherent for the Visitor (language, current thread) while they use the site. | Session, cleared when the conversation ends or the browser session ends. |
| Preferences | Vysto | Remembers a choice the person made, such as staying in Classic View. | Until the person clears storage, or up to 12 months. |
| Stripe | Stripe | Fraud prevention and payment completion on checkout pages where Stripe is loaded. | As Stripe’s own cookie notice describes. Card data is collected by Stripe, not stored in a Vysto cookie. |
| LinkedIn Insight Tag | Measures visits to the channel partner landing page from LinkedIn ads, and supports retargeting of people who visit that page. Not set anywhere else. | As LinkedIn describes. Runs only after the consent in Section 6, where that section applies. | |
| Meta Pixel | Meta | Measures visits to the channel partner landing page from Meta ads, and supports retargeting of people who visit that page. Not set anywhere else. | As Meta describes. Runs only after the consent in Section 6, where that section applies. |
| Google tag (Google Ads and Google Analytics) | Measures visits to the channel partner landing page from Google ads, records conversions, and supports audience measurement and retargeting for that page. Not set anywhere else. | As Google describes. Runs only after the consent in Section 6, where that section applies. |
Exact cookie names can change when we rotate security controls. The purpose and the lifetime category will stay as this table describes. A material new purpose, or placing these advertising tags on any page other than the channel partner landing page, is a change to this notice, and we will version it before the tags move.
No other analytics product is set on vysto.ai or on Customer sites. The Google tag in the table is limited to the channel partner landing page. It is not a condition of using the platform, and it is not placed on a Customer’s published site.
4. Similar technologies
Server logs record IP address, user agent, timestamp, and the requested URL. We use logs to secure the service, debug, and measure aggregate reliability. Logs are described in the Privacy Policy and are not cookies.
The scraping module runs server-side when a Customer imports a site. It does not set a cookie on the imported site’s Visitors by virtue of the import itself.
MCP connections use API credentials or OAuth, not a Visitor cookie. A Customer’s use of Claude, ChatGPT, Cursor, or another assistant is governed by that assistant’s own terms in addition to the Vysto Terms.
5. Choices
Visit session identifier, authentication, security, and conversation state. These are required to provide the service the Customer or Visitor is using. Browsers that block all cookies may be unable to hold a conversation session, stay signed in, or be counted correctly. There is no separate “reject” control inside the product for these, because the site does not function as a metered multi-tenant service without them. They are not advertising cookies.
Preferences. The person can clear site data for the domain in the browser. The preference will simply be asked again or return to the default.
Stripe. Stripe’s cookies appear on the payment step. The Customer or payer can read Stripe’s notice at stripe.com. Refusing them may prevent checkout from completing.
Browser controls. All major browsers let a person block or delete cookies. Blocking strictly necessary cookies will break sign-in and, for Visitors, may break the conversation.
Customer sites. If the Customer adds its own analytics or advertising tags, the Customer must provide its own consent mechanism where the law requires one (including the ePrivacy rules in the EEA and UK). Vysto’s strictly necessary session identifier does not depend on that consent, because it is required to deliver and meter the service. A Customer must not use Vysto’s visit identifier as a join key for the Customer’s own advertising.
Channel partner landing page. A visitor can refuse the LinkedIn, Meta, and Google tags. Refusal, or no choice, means those tags stay off. The strictly necessary cookies in this notice still run. Clearing site data for the domain removes a previous acceptance until the visitor chooses again.
Do Not Track and Global Privacy Control. A Global Privacy Control signal is an opt-out of the “sharing” described in Section 1. When we receive it, the LinkedIn, Meta, and Google tags on the channel partner landing page do not fire. Strictly necessary cookies, including the visit session identifier, remain.
6. Visitors in the EEA, UK, and Switzerland
Strictly necessary cookies and similar identifiers, including the visit session identifier, authentication, security, and conversation state required to provide the service, are set without a consent banner.
The channel partner landing page shows a consent banner to visitors in the EEA, the UK, and Switzerland before any optional cookie runs. The LinkedIn Insight Tag, the Meta Pixel, and the Google tag do not fire for those visitors unless they accept advertising and analytics cookies. If they reject them, or if they have not chosen, the tags stay off. The banner is part of the page, not a tag that itself sets an advertising cookie before the choice.
No other optional cookies are set on vysto.ai. Customers who add non-essential cookies to their own sites must collect any consent the law requires before those cookies run. Vysto is the Customer’s processor for the visit session identifier. The Customer’s privacy notice to Visitors should mention that the host sets a session identifier to operate and meter the site, and may link to the published version of this notice. The Customer’s notice does not need to describe the channel partner tags, because those tags are not on the Customer’s site.
7. Changes
We will post updates with a new version number and effective date. A material change (a new purpose, a new non-essential cookie, or a longer life for the visit identifier) will be notified to Customers before it takes effect, with at least 15 days’ notice, unless a shorter time is required for security. The published legal index will link to this notice.
8. Contact
Questions about this notice: privacy@vysto.ai Vysto LLC 1918 University Business Drive, Unit 513 McKinney, TX 75071