What is stored in your browser, and what you can switch off

Strictly necessary covers what the site cannot function without: session integrity, load balancing, security tokens and the record of your own consent choices. That last one is worth noticing. Remembering that you rejected everything requires storing the fact that you rejected everything, which is why the consent record itself sits in this category rather than in the ones you can turn off.

Preference covers choices you have made that are not required: market selection between the United States, United Kingdom and Australia views, currency display, and interface preferences that survive a reload. Turning these off does not break anything; it just means the site forgets.

Analytics covers aggregate measurement of how pages are used, and marketing covers advertising and attribution technology set by third parties. Both are off until you consent, and both are described in the consent manager with the vendor, the purpose and the duration rather than as a single opaque toggle.

The consent manager offers per-category control rather than an accept button and a hidden settings link. Reject all is available at the same level as accept all, in the same visual weight, on the first screen. A reject-all that is one click harder than accept-all is a dark pattern with a legal opinion attached to it, and it is not what this site does.

Choices are revocable at any time from a persistent control, and revoking is as easy as granting. When consent is withdrawn, the categories stop firing on the next page load and the associated storage is cleared where the browser permits it. Some third-party storage can only be cleared by that third party, which is a limitation of the medium rather than a policy choice, and it is stated rather than glossed.

Consent is recorded with a timestamp and the version of the notice you were shown, because a consent record that cannot say what the person was told is not much of a record.

Once you log in, the storage the application uses is strictly necessary. Session tokens, authentication state, tenant context, security controls such as cross-site request protection, and a small amount of interface state such as which pipeline view you had open. These are required to deliver a service you have actively asked for, and there is no consent banner inside the product for them.

There is no advertising technology in the product, and no third-party marketing pixels on authenticated pages. Product analytics, where used, is aggregate telemetry about feature use and errors under the customer agreement rather than a consent-based cookie relationship with the individual recruiter.

The reason to say this explicitly is that recruiters are the population with the least appetite for surprises here. Somebody working a desk all day has a right to know that their own tooling is not also an advertising surface.

Where Surhires serves a white-labelled career portal for your firm, the candidates arriving on it are your visitors. The consent obligations there follow your firm, your jurisdiction and your own tracking decisions. If you add your own analytics or advertising tags to that portal, you have taken on the consent question for them.

The portal itself is built to run on strictly necessary storage: application state, form integrity and security. It does not carry vendor advertising technology, and it does not quietly attach a tracking relationship to a candidate applying for a job.

That boundary is worth writing into your own candidate privacy notice rather than assuming. Candidates who read anything tend to read the career portal notice, and it is the one place where a vague statement is most likely to be noticed.

Browser-level controls sit above anything a site can do. Blocking third-party storage, clearing site data or running a strict privacy mode will affect the site, and the parts that break will be the parts that depend on remembering things. Strictly necessary storage is required for authentication, so blocking it entirely will prevent login rather than degrade it.

Global privacy signals sent by the browser are respected where they apply, and the position on them is stated in the consent manager rather than assumed. Older do-not-track headers are not a reliable signal and are not treated as one, which is the honest position rather than a claim of universal support.

None of this substitutes for the consent controls on the page. A browser setting is a blunt instrument applied to every site; the consent manager is the specific record of what you decided here, and it is the one that gets logged.