Cookie Policy

1. What this policy covers

This policy explains how SlashCart Inc. ("Loyal", "we", "us") uses cookies and similar technologies such as local storage, pixels and SDKs. It supplements the Privacy Policy, which explains how we handle the personal information those technologies collect. Terms defined in the Privacy Policy have the same meaning here.

2. What cookies are

A cookie is a small text file that a website stores on your device so that it can recognise your browser on a later visit or across pages of a single visit. Similar technologies include local storage and session storage, which store data in the browser without a cookie, and pixels, which are tiny images that record that a page or email was opened.

Cookies are either session cookies, which are deleted when you close your browser, or persistent cookies, which remain until they expire or you delete them. They are either first party, set by the site you are visiting, or third party, set by another service through that site.

3. Cookies on loyalapp.com

We group cookies on our website into three categories. We ask for your consent before setting anything in the second and third categories where the law requires it, using the banner shown on your first visit. You can change your choice at any time using the cookie settings link in the footer.

Strictly necessary. These are needed for the site to work and cannot be switched off. They remember your cookie choices, keep a form you are filling in from being lost, protect against cross site request forgery, and balance load across our servers. They do not track you across other sites. Legal basis: our legitimate interest in running a working website.

Analytics. These tell us which pages are visited, how visitors arrive, how long they stay and where they leave, so we can improve the site. We use aggregated reports and do not use these cookies to identify individuals. Where we use a third party analytics provider, it is listed on the Subprocessors page and is contractually restricted to processing on our behalf. Legal basis: consent where required, otherwise legitimate interest in understanding how the site is used.

Marketing. These measure whether an advertisement or an email we sent led to a visit or a trial request, and may be used to show relevant advertising to people who have visited loyalapp.com. We do not sell personal information and we do not share it for cross context behavioural advertising as defined by the CPRA. Where a marketing cookie would involve sharing with an advertising platform in a way that counts as a sale or share under a United States state law, we do not set it unless you have opted in. Legal basis: consent.

The trial and demo forms on the site collect what you type into them. That is not a cookie and is covered by section 4.5 of the Privacy Policy.

Decision needed before publishing. Insert a table of the specific cookies loyalapp.com actually sets, with name, provider, purpose, category and expiry. This list must come from a scan of the live site, not from memory, and it must be re scanned whenever a tool is added or removed. Until the table is in place, keep the category descriptions above and add the sentence: "A full list of the cookies currently in use is available on request at support@slashcart.com."

4. Cookies in the Loyal app

Loyal runs inside your Shopify admin as an embedded app. In that context we use only strictly necessary technologies:

• a session token issued through Shopify's App Bridge that identifies your store and staff account to our servers for the duration of a session;
• local storage in your browser to remember interface preferences such as which tab you last opened or a dismissed banner;
• a cookie or storage key to protect requests against cross site request forgery.

We do not set analytics or marketing cookies in the app. Product usage described in section 4.1 of the Privacy Policy is recorded on our servers from the actions you take, not through a browser cookie, and is not shared with an advertising platform.

Shopify sets its own cookies in the admin, which are governed by Shopify's cookie policy and are outside our control.

5. Cookies in the customer portal on a merchant's storefront

The customer portal is a page or widget that a merchant places on its storefront so that subscribers can manage their subscriptions. When a subscriber uses it, the portal sets:

• a session cookie or token that authenticates the subscriber for the length of their visit and lets us record who made each change and when, as described in section 4.3 of the Privacy Policy;
• a storage key to protect against cross site request forgery.

These are strictly necessary for the portal to function and are set on the merchant's domain. We do not set analytics or marketing cookies through the portal, and we do not track subscribers across sites.

Everything else on the merchant's storefront, including the merchant's own analytics, advertising and consent banner, is the merchant's responsibility under its own cookie policy. The merchant is the controller of subscriber data and should list the portal's cookies in its own policy where the law requires it. If you are a subscriber with a question about cookies on a store, contact the store.

6. How to manage cookies

On loyalapp.com, use the cookie banner on your first visit or the cookie settings link in the footer to accept or decline analytics and marketing cookies. Your choice is stored in a strictly necessary cookie so we can honour it on later visits. Clearing your cookies will also clear that choice and the banner will appear again.

In any browser, you can block or delete cookies through the browser's settings, and most browsers let you block third party cookies separately from first party cookies. Instructions are available in the help pages for Chrome, Safari, Firefox and Edge. Blocking strictly necessary cookies will stop parts of loyalapp.com, the app and the customer portal from working.

Email pixels can be blocked by turning off image loading in your email client. You can also unsubscribe from marketing email using the link in any message we send.

7. Global Privacy Control and Do Not Track

We honour Global Privacy Control signals on loyalapp.com where the law recognises them as a valid opt out. If your browser sends a GPC signal, we treat it as a decline for marketing cookies and as an opt out of any sale or sharing, without you needing to use the banner.

There is no accepted industry or legal standard for how online services should respond to Do Not Track browser signals, so we do not currently respond to them. Section 18 of the Privacy Policy says the same.

8. Changes to this policy

We revise this policy when the technologies we use or the law change. The current version date appears at the top of the page. Where a change adds a new category of cookie that requires consent, we will ask for consent again before setting it. Prior versions are available on request.

9. Contact

SlashCart Inc. 131 Continental Drive, Suite 305 Newark, DE 19713 United States

All enquiries, including cookies and privacy: support@slashcart.com

This policy should be read together with our Privacy Policy, Terms of Service, Data Processing Addendum and Subprocessors page, which together form the agreement governing use of Loyal.