Controller: Illuminum AB · org.nr 559359-4343 · VAT SE559359434301 · Västra Ågatan 22, 753 09 Uppsala, Sweden
Effective date: 30 August 2026 Version: 2026-08-30.1
This policy states what we store on your device, why, and how you stop it. It is the company-level cookie policy for Illuminum AB and covers every website and product we run. Our Privacy Policy covers everything else we do with personal data; where the two describe the same processing they are meant to agree, and if they ever do not, write to us and we will correct whichever text is wrong.
One thing to read before the rest. We ask for your consent before setting anything on illuminum.se. On gaia.eco and app.gaia.eco we do not yet — advertising cookies are set there when you arrive, without being asked. We are not comfortable with that, we are fixing it, and until we have, Section 6 tells you exactly how to refuse in the meantime. We would rather write this down than let you find it out yourself.
| Property | What it is | Tags it carries | Asked before setting? |
|---|---|---|---|
| illuminum.se | Our company homepage | Google Tag Manager container GTM-TQHLMFFG, feeding Google Analytics 4 and Google Ads |
Yes — consent banner, nothing set until you answer |
| gaia.eco | The Gaia marketing site | The Google tag, with Google Ads account AW-18407219082 as a linked destination, plus its own Google Analytics 4 |
No — not yet. See Section 5 |
| app.gaia.eco | The Gaia application | The Google tag with AW-18407219082. Google Ads only — no Analytics |
No — not yet. See Section 5 |
| qnt.pro, app.qnt.pro | The Quant site and application | The same Google Ads tagging, being deployed as this version takes effect | See Section 5 |
Until Quant's tags are live, no cookie in Section 4 is set on qnt.pro or app.qnt.pro. Test environments of either product behave as their live counterparts do, except that Gaia's application fires no conversion outside production.
A cookie is a small file a site asks your browser to keep and hand back on your next visit. Two neighbouring technologies do the same job: local storage, which holds a value in the browser until it is cleared, and tracking pixels, which report a page view by loading an invisible image. Where this policy says "cookie", it means all three.
A first-party cookie is stored under our own domain. A third-party cookie is stored under someone else's — google.com or doubleclick.net — which lets that party recognise the same browser on other sites that use it too.
Two Google products, no others.
How the two Gaia properties are joined. An ad click lands on gaia.eco, where the Google tag writes the click identifier into a _gcl_aw cookie at the gaia.eco domain. If you then sign up, the application at app.gaia.eco reads that same cookie — it shares the domain — and reports the signup to Google Ads as a conversion.
What is sent with a signup conversion. The conversion event carries the conversion label, a value of 1 and the currency, and a transaction_id: a one-way hash of your account identifier. Its only purpose is deduplication — the same person always produces the same hash, so Google counts one signup rather than one per reload or device. It is not your name, your email address or your account id itself, and it cannot be reversed into them, but it is a stable pseudonymous identifier and we would rather name it than let it pass unmentioned. Whether a signup has occurred is decided on our server, not in your browser, so a returning login is never counted as one.
Remarketing. A Google Ads tag also collects data that Google can use to build remarketing audiences — lists of browsers that visited a given page, addressed as an audience and never as a named person. We may use that to show our ads to people who have visited us. We cannot see who is in such a list and cannot direct an ad at one individual.
What we do not do. We do not send Google your email address or telephone number to improve conversion matching — Enhanced Conversions is off. We do not send anything from inside the products: not your Gaia searches, not your Quant analyses, notes, holdings or AI Chat, none of which ever reaches an advertising tag. We do not sell what the tags collect. If any of that changes, this policy changes first.
| Cookie | Set by | What it does | Expires |
|---|---|---|---|
_ga |
Google Analytics | Holds a random id distinguishing your browser from another, so two visits by you are not counted as two people | 2 years from your last visit |
_ga_ + property id |
Google Analytics | Holds the state of your current visit — when it started, how many pages in you are. On illuminum.se it is _ga_SDCKJ5S262; each site has its own |
2 years from your last visit |
_gcl_au |
Google Ads | Records that a click on one of our ads led to this visit, so a later signup can be attributed to that ad | 90 days |
_gcl_aw, _gcl_gb, _gcl_dc |
Google Ads | The same attribution record, named for the ad network you arrived from. Set only if you did arrive from an ad. On gaia.eco this is the cookie the application later reads | 90 days |
IDE, test_cookie |
doubleclick.net (third party) |
Recognises your browser across sites to select and frequency-cap our ads and measure their effect; test_cookie only checks whether your browser accepts cookies at all |
13 months in the EEA; test_cookie 15 minutes |
NID |
google.com (third party) |
Google's own ad selection, frequency capping and abuse prevention | 6 months |
illuminum.consent.v1 |
Illuminum | Local storage, not a cookie. Holds the choice you made on illuminum.se, so we do not ask again on every page | Until you clear it or change your choice |
Names and lifetimes belong to Google and Google may change them; treat this table as accurate as of the effective date above. The third-party entries appear only where advertising personalisation is active.
Signing in sets its own cookies. app.gaia.eco — and app.qnt.pro — keep a session cookie so you stay signed in from one page to the next, and our identity provider Auth0 keeps its own on its domain. Payment pages carry Stripe's cookies, which run its fraud checks; card details are entered on and held by Stripe and never reach us. These are set only once you sign in or pay, carry no analytics or advertising purpose, and the products cannot work without them. They are therefore outside the choice below, and no banner can switch them off.
Our legal basis for storing anything that is not strictly necessary is your consent, under Chapter 9, Section 28 of the Swedish Electronic Communications Act (2022:482) and Article 6(1)(a) of the GDPR. That is the standard, and we meet it on one property and not yet on the others.
On illuminum.se, nothing in Section 4 runs until you answer. The first time you open the site a banner asks whether you accept analytics and advertising cookies. Before the tag manager loads, every Google Consent Mode v2 signal — advertising storage, ad user data, ad personalisation, analytics storage, functionality and personalisation — is set to denied, and only the security signal is granted. Until you answer, the Google tag stores nothing and reads nothing: no _ga, no _gcl_au, no identifier of any kind. If you accept, the signals are switched on and the cookies in Section 4 are set. If you decline, the tag stays denied for as long as your choice stands. Declining is one click, in the same place and of the same weight as accepting, and nothing about it reduces what the site does for you.
On gaia.eco and app.gaia.eco, there is no consent banner yet. The Google tag loads with the page, and the advertising cookies in Section 4 are set on arrival without your being asked. We are telling you because a policy that claimed otherwise would be false, and because you are entitled to know before you decide whether to browse. This is being corrected across both Gaia properties together — gating the application alone would achieve nothing while the marketing site continued to set the same cookies upstream. Until it ships, the browser-level controls in Section 6 are the effective way to refuse, and they work today.
On qnt.pro and app.qnt.pro, the tags are being deployed as this version takes effect, and the consent arrangement will be stated here before they carry anything.
Your choice is not permanent and withdrawing it costs you nothing.
googletagmanager.com, google-analytics.com and doubleclick.net, block third-party cookies generally, or delete the cookies in Section 4. Every major browser offers this, any content blocker does it in one step, and blocking these particular cookies breaks nothing on our sites or in our products — you will not be shown a degraded version, asked again on every page, or charged a different price.Withdrawing consent stops future collection. It does not erase measurements already recorded before you withdrew; for that, and for your other rights, see Section 9.
Google Ireland Limited is our counterparty for both Analytics and Ads. Google LLC in the United States may access the data in the course of providing those services. Google is certified under the EU–US Data Privacy Framework; where the Framework does not cover a transfer, it rests on the European Commission's Standard Contractual Clauses. Google processes this data as our processor for measurement, and separately as a controller for its own purposes described in its own privacy policy, which we do not control.
No one else receives what these tags collect. Auth0's and Stripe's own cookies, mentioned in Section 4, are governed by their policies as well as ours.
The cookies expire on the schedule in Section 4. In Google Analytics we set user and event data to be deleted after 14 months. Aggregate figures — visit counts, page totals — outlive that, but they are not about you and cannot be traced back to you. Conversion records in Google Ads are held under Google's own retention terms.
What these cookies collect is personal data, and the rights in the Privacy Policy apply to it: access, correction, erasure, restriction, portability and objection. Where the basis is consent, the most direct remedy is to withdraw it, which you may do at any time, by the routes in Section 6, without giving a reason. Write to us at the address in Section 11, or complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), Box 8114, 104 20 Stockholm.
We update this policy whenever the tags or their purposes change, and we do it before the change goes live rather than after. The effective date and version at the top tell you which text you are reading. A change that widens what we collect — a new advertising purpose, a new recipient — resets your consent and the banner asks again.
Questions about anything above, or a request to exercise your rights: