Cookie Policy

1. What cookies and similar technologies are

Cookies are small text files stored on your device when you visit a website. Similar technologies include local storage, session storage, pixels, and SDK identifiers. These technologies let a site recognise your device and remember information about your visit.

2. How we use cookies

We use cookies for three purposes only:

• To keep you logged in and to protect your session.
• To remember preferences you set, such as your language.
• To measure, in aggregate, how our dashboard is used so we can fix bugs and improve it.

We do not use advertising cookies, cross-site tracking, or fingerprinting. We do not share cookie data with advertising networks.

3. Categories of cookies we set

3.1 Strictly necessary cookies.
Required for the Services to function. You cannot opt out of them; disabling them will break login.

• session cookie — HTTP-only, Secure, SameSite=Lax. Short-lived session token. Expires at end of session or after inactivity.
• refresh_token cookie — HTTP-only, Secure, SameSite=Lax. Long-lived refresh token used to renew your access token silently for up to 30 days. Needed for "remember me" across page loads.
• CSRF tokens — used on form submissions to protect against cross-site request forgery.

3.2 Preference cookies.
These cookies remember choices you make to improve your experience. They are not strictly necessary but carry minimal privacy risk.

• locale — stores your chosen language (en, ja, th). Read by middleware to return the right translations. Expires after one year.

3.3 Analytics cookies (first-party only, inside the merchant dashboard).
We operate privacy-respecting, first-party product analytics inside the merchant dashboard only (app.batoniq.com). Aggregate metrics such as feature usage and error counts are collected so we can improve the dashboard; no cross-site tracking is performed. These are not used on batoniq.com. Where required by law, analytics run only with your consent.

3.4 Third-party cookies.
batoniq.com does not set third-party advertising or analytics cookies. The only third-party cookies that may appear inside the dashboard are those set by services you explicitly connect (for example, the Stripe customer portal when you manage billing). Those cookies are governed by the third party’s own policy.

4. Managing cookies

Most browsers let you block or delete cookies through settings. Instructions are available from your browser vendor (Chrome, Safari, Firefox, Edge, Arc, and others). Blocking strictly necessary cookies will prevent you from logging in.

Where we rely on consent, you can change or withdraw it at any time through the cookie banner or by contacting privacy@batoniq.com.

5. Do Not Track and Global Privacy Control

When we detect the Global Privacy Control (GPC) signal sent by a browser or extension, we treat it as a valid signal to opt out of any non-essential cookies and of any "sale" or "sharing" for the purposes of CCPA/CPRA (we do not sell or share personal information in any event). We also respect "do not track" browser headers where they indicate the same intent.

6. Local storage and session storage

In addition to cookies, the Batoniq dashboard uses browser local storage and session storage to hold non-sensitive application state (for example, the sidebar expand/collapse preference or a draft template being edited). These are not transmitted to our servers and are cleared when you clear browser storage.

7. Changes to this Cookie Policy

If we introduce new cookie categories (for example, new analytics providers) we will update this policy and, where required, ask for your consent again. The "Last updated" date above reflects when this policy was last changed.

8. Contact

Privacy questions: privacy@batoniq.com. If you are in the EEA, the UK, Japan, Thailand, or California and would like to exercise a right under applicable law, please see our Privacy Policy for how to do so.