AI SCANNING

Nobody should maintain a cookie spreadsheet.

Katla crawls your site the way a visitor would, records every cookie it sets, and classifies each one with a confidence score. You review and override; the policy follows automatically.

crawl · yoursite.com · 214 pagesclassifying
00:00.4GET / → 200crawl
00:01.1cookie _ga · .yoursite.comdetect
00:01.1cookie _gid · .yoursite.comdetect
00:01.6cookie _fbp · .yoursite.comdetect
00:02.0GET /pricing → 200crawl
00:02.3_ga → Analytics (Google Analytics) 100%classify
00:02.3_fbp → Marketing (Meta Pixel) 100%classify
00:02.4intercom-id → Functional (Intercom) 90%classify
00:03.1kt_exp_v → unmatched, sent to the modelclassify
00:41.047 cookies · 0 unclassifieddone
HOW IT WORKS

Four passes, one inventory.

01

Crawl

A headless browser walks your site from the homepage, following links that stay on your domain and refusing navigations that leave it.

Up to 5,000 pages per scan
02

Detect

Every cookie a page sets is recorded — first-party and third-party alike — with its domain, expiry, flags, and the page it appeared on.

Includes HttpOnly and Secure cookies
03

Classify

Each cookie is matched against a known-tracker database. Whatever the database cannot answer goes to the model with its full context.

Open Cookie Database + LLM fallback
04

Publish

Cookie and privacy policies are generated from what the scan actually found, and republished whenever the inventory changes.

13 languages · embed or fetch as markdown
CLASSIFICATION & CONFIDENCE

Every call shows its reasoning.

Each cookie is matched against a database of known trackers first. Anything left over is read in context — who sets it, what the value looks like, how long it lives — and the model returns a category, a purpose in plain language, and a confidence score. Every call is yours to override.

6Cookie categories
13Policy languages
0.5–1.0Confidence on every cookie
_gaGoogle AnalyticsAnalytics
Stores a client ID used to tell visitors apart across sessions. Not required for the site to function.expires 2y · first-party
100%
EXACT MATCH
_fbpMeta PixelMarketing
Browser identifier Meta uses to attribute ad conversions. Set after page load by the Meta pixel.expires 90d · first-party
100%
EXACT MATCH
__stripe_midStripeFunctional
Fraud-prevention identifier set by Stripe.js. Required for card payments to complete.expires 1y · first-party
90%
PATTERN MATCH
sessionidyoursite.comSecurity
Server session token that the login state depends on. HttpOnly and Secure, and exempt from consent under GDPR Art. 5(3).expires session · HttpOnly · Secure
85%
HEURISTIC
kt_exp_vyoursite.comPersonalization
Custom first-party cookie holding a small integer that changes between visits. No database entry, so the model read it in context as an experiment variant flag.expires 7d · first-party
85%
MODEL
SCHEDULE

Re-scans on your cadence

Monthly, weekly or daily depending on plan, without anyone remembering to press the button.

OVERRIDES

The last word is yours

Reclassify any cookie and write your own description per language. Your wording is what visitors and your policy see.

CI / CD

Scan from your pipeline

Trigger a scan from the CLI on every deploy, then export the classified inventory as CSV for the audit trail.

See what's actually on your site.

Add a domain, verify it once with a DNS record or a meta tag, and the first scan runs in about a minute. Free plan, no card.