Legal document
Cookie Policy - Hiram Trade
- Version
- 2026-10-31
- In force from
- October 31, 2026
- Operator
- JIII-LEGACY
Version: 2026-10-31. Effective date: 2026-10-31.
Changes compared with version 2026-10-09: added the "Marketing" category and the Meta pixel (section 3, cookies _fbp and _fbc and the browser storage hiram.meta-click.v1, and the "Meta pixel" paragraph); loaded only after consent to the "Marketing" category, which is off by default. Section 4 now covers withdrawing Marketing consent. Because a new category was added, we ask every visitor again to choose their cookie settings. The other entries are unchanged.
This English version is a translation. The Polish version is legally binding.
1. Who is responsible for cookies
Cookies on the hiramtrade.com and app.hiramtrade.com websites are used by JIII-LEGACY spółka z ograniczoną odpowiedzialnością, ul. Jaworowa 19, Kuźniki, 63-500 Ostrzeszów, Polska (the "Operator"). Contact: contact@hiramtrade.com.
2. Legal basis
- The rules for storing information, and for gaining access to information stored, in the user's terminal equipment are laid down in Art. 399 of the Act of 12 July 2024 - Electronic Communications Law (Prawo komunikacji elektronicznej), which from 10 November 2024 replaced Art. 173 of the Telecommunications Law (Prawo telekomunikacyjne) in this respect. This provision implements Art. 5(3) of Directive 2002/58/EC (the ePrivacy Directive).
- The user's consent is not required where storing or accessing information is strictly necessary to provide an electronically supplied service explicitly requested by the user, or solely for the purpose of carrying out the transmission of a communication.
- The Platform uses cookies and similar technologies that are strictly necessary within the meaning of section 2 and, only with the user's consent, technologies in the "Analytics" and "Marketing" categories. The only "Marketing" technology is the Meta pixel described in section 3; it is off by default and loads only if you consent to it. We use no third-party tracking tools other than those described below. On the first visit we show a banner where all categories can be accepted, all optional ones rejected, or settings chosen. The choice can be changed at any time through "Cookie settings" in the footer and in the user menu.
3. List of cookies and similar technologies
| Name | Provider | Purpose | Type and duration |
|---|---|---|---|
hiram_session | Operator (app.hiramtrade.com) | Maintaining a signed-in session. Contains a random token; the server stores only its hash. Attributes httpOnly, Secure, SameSite=Lax. | Persistent; expires with the session: after 7 days of inactivity or at the latest 30 days after sign-in; deleted on sign-out |
hiram_oidc | Operator (app.hiramtrade.com, path /api/v1/auth/oidc) | Securing sign-in with Google or Microsoft: encrypted state of the sign-in flow (protection against CSRF and response substitution). Created only when such sign-in is chosen. | Up to 10 minutes; deleted on return from the provider |
NEXT_LOCALE | Operator | Remembering the selected interface language (Polish or English). | Session; deleted when the browser is closed |
__cf_bm | Cloudflare, Inc. | Distinguishing human and bot traffic, protection against attacks. Used only when Cloudflare activates bot management. | 30 minutes |
cf_clearance | Cloudflare, Inc. | Confirming that a security check (challenge) has been passed. Used only when Cloudflare displays a check. | According to the zone setting, 30 minutes by default |
_cfuvid | Cloudflare, Inc. | Rate limiting for users sharing an IP address. Used only when Cloudflare applies rate limiting rules. | Session |
| Browser session storage (sessionStorage): draft request from the home page | Operator | Carrying a draft request typed on the home page over to the form after sign-in. The data is not sent to the server until the user saves it. | Until the browser tab is closed; deleted after use |
Browser local storage (localStorage) hiram.listing-draft.v1 | Operator (app.hiramtrade.com) | Keeping the offer or request you are preparing without an account in the listing wizard (pages /start/offer and /start/request), so that you can publish it after signing up or signing in. Contains only the form fields and the current wizard step. It is not sent to the server before you publish it and is not read by analytics tools. | 7 days from the last save; deleted when the listing is saved in your account after sign-in or when you discard the draft |
Browser local storage (localStorage) hiram.consent | Operator | Stores your cookie choice so that we do not ask on every visit. | 6 months, then the banner is shown again |
Cloudflare Web Analytics script (beacon.min.js) - "Analytics" category, consent required | Cloudflare, Inc. | Visit statistics (page views, referring site, device type). Sets no cookies and stores nothing in the browser. | Script loaded after consent; nothing stored in the browser |
_clck - "Analytics" category, consent required | Microsoft Ireland Operations Limited (first-party (hiramtrade.com, app.hiramtrade.com on the /start pages)) | Stores the pseudonymous Clarity user ID and its preferences. | 1 year |
_clsk - "Analytics" category, consent required | Microsoft Ireland Operations Limited (first-party (hiramtrade.com, app.hiramtrade.com on the /start pages)) | Connects several page views into a single Clarity session recording. | 1 day |
CLID - "Analytics" category, consent required | Microsoft Ireland Operations Limited (Microsoft (separate domain)) | Identifies the first time Clarity saw this user on any site that uses Clarity. | 1 year |
ANONCHK - "Analytics" category, consent required | Microsoft Ireland Operations Limited (Microsoft (separate domain)) | Indicates whether MUID is transferred to ANID (an advertising cookie); Clarity does not use ANID, so the value is always 0. | 10 minutes |
MR - "Analytics" category, consent required | Microsoft Ireland Operations Limited (Microsoft (separate domain)) | Indicates whether to refresh MUID. | 7 days |
MUID - "Analytics" category, consent required | Microsoft Ireland Operations Limited (Microsoft (separate domain)) | Identifies unique browsers visiting Microsoft sites (according to Microsoft: advertising, site analytics and operational purposes). | 1 year |
SM - "Analytics" category, consent required | Microsoft Ireland Operations Limited (Microsoft (separate domain)) | Synchronises MUID across Microsoft domains. | session |
Browser session storage (sessionStorage) hiram.acquisition.v1 - "Analytics" category, consent required | Operator | Campaign source of the first visit (utm_source, utm_medium, utm_campaign, landing page, referring host); sent with the account registration. | Until the browser tab is closed; removed when consent is withdrawn |
| Browser local storage (localStorage) entries of the PostHog SDK - "Analytics" category, consent required | PostHog, Inc. (first-party (hiramtrade.com, app.hiramtrade.com)) | Product analytics across the signed-in application and public pages. Today PostHog sets only a pseudonymous, random identifier; it does not capture page views and does not set a user identifier. The SDK stores in localStorage and sets no cookies. | Not a cookie - localStorage entry; kept until the visitor clears site data or withdraws Analytics consent (on withdrawal PostHog stops capturing, its identifier is reset, and only a technical opt-out marker remains in local storage) |
_ga - "Analytics" category, consent required | Google Ireland Limited (first-party (hiramtrade.com)) | Set by Google Analytics 4 for audience and traffic analytics on public pages only (Enhanced Measurement on; see the Privacy Policy for the data collected). | 2 years (cookie); Google Analytics 4: user-level and event-level data are retained for 14 months, extended on new activity; aggregated reports are not subject to this limit |
_ga_<container-id> - "Analytics" category, consent required | Google Ireland Limited (first-party (hiramtrade.com)) | Set by Google Analytics 4 for audience and traffic analytics on public pages only (Enhanced Measurement on; see the Privacy Policy for the data collected) (one cookie per data stream). | 2 years (cookie); Google Analytics 4: user-level and event-level data are retained for 14 months, extended on new activity; aggregated reports are not subject to this limit |
_fbp - "Marketing" category, consent required | Meta Platforms Ireland Limited (third party) | Set by the Meta pixel to measure the effectiveness of our advertising on Facebook and Instagram. | Up to 90 days; deleted when you withdraw Marketing consent |
_fbc - "Marketing" category, consent required | Meta Platforms Ireland Limited (third party) | Set by the Meta pixel to store the click identifier (fbclid) of a visit that came from a Meta ad, for the same measurement. | Up to 90 days; deleted when you withdraw Marketing consent |
Browser session storage (sessionStorage) hiram.meta-click.v1 - "Marketing" category, consent required | Operator | Keeps the Meta click identifiers (fbclid, _fbp, _fbc) in your browser for the measurement above; not sent to our server. | Until the browser tab is closed; removed when consent is withdrawn |
Microsoft Clarity. Microsoft Clarity (provider: Microsoft Ireland Operations Limited; data may be processed in the USA by Microsoft Corporation) is used to analyse visitor behaviour: it creates recordings of the visit (pointer movement, scrolling, clicks, pages visited) and heatmaps. We load it only after you consent to the "Analytics" category and only on the public pages of hiramtrade.com and on the pages of the listing wizard without an account on app.hiramtrade.com (/start/offer, /start/request); it does not run on any other page of app.hiramtrade.com, in particular on the sign-up, sign-in and onboarding pages or in the signed-in application, and it stops when you leave the wizard to sign up or sign in. Strict masking is enabled in the Clarity project settings: the content of form fields and the text of pages are masked before data leaves the browser. Without consent Clarity does not start and sets no cookies; after you withdraw consent it stops collecting data. The cookies CLID, ANONCHK, MR, MUID and SM are set on Microsoft domains. Information on Clarity cookies: https://learn.microsoft.com/en-us/clarity/setup-and-installation/cookie-list.
Cloudflare uses its cookies as the Operator's processor for the purpose of protecting the website. Information on Cloudflare cookies: https://developers.cloudflare.com/fundamentals/reference/policies-compliances/cloudflare-cookies/.
Meta pixel. On the public pages of hiramtrade.com we load the Meta pixel (provider: Meta Platforms Ireland Limited; data may be processed outside the EEA, including in the USA, by Meta Platforms, Inc.) only after you consent to the "Marketing" category. It records which of our public pages you viewed (the events PageView and ViewContent) so we can measure the effectiveness of our advertising on Facebook and Instagram. We send no name, e-mail address, telephone number or company data, and nothing about counterparties, listings, quotes or deals; advanced matching is off. Without consent the pixel does not load and sets no cookies; when you withdraw consent the pixel is removed and its cookies _fbp and _fbc are deleted. Meta acts as an independent controller for the data it receives; see Meta's data policy.
4. Managing cookies
You can change or withdraw your consent to the "Analytics" and "Marketing" categories at any time through "Cookie settings" in the footer and in the user menu. Withdrawing "Marketing" consent removes the Meta pixel and deletes its cookies _fbp and _fbc. You can delete or block cookies in your browser settings. Blocking hiram_session will prevent sign-in, and blocking hiram_oidc will prevent sign-in with Google or Microsoft. The other public features of the website will remain available.
5. Personal data
Information on the processing of personal data, including IP addresses, is given in the "Privacy Policy".