# Cookie policy

Source: https://chatmerce.eu/en/cookies/
Language: en
Effective: 2026-07-28

---

This Cookie Policy explains what cookies are, which cookies the Chatmerce platform uses, why, and how you can manage them. Our use of cookies complies with Regulation (EU) 2016/679 (GDPR), the EU ePrivacy rules and applicable national law (in Poland: art. 215 of the Electronic Communications Law). The data controller is **Prosit AS** (see the [Privacy policy](/en/privacy)).

## 1. What cookies are

Cookies are small text files stored on your device (computer, tablet, phone) when you use a website or app. They let us recognise your device on return visits and remember your settings. Cookies can be **session** (deleted when you close the browser) or **persistent** (kept for a set time), and either **first-party** (set by us) or **third-party** (set by our providers).

In this policy we treat cookies and similar technologies, such as browser local storage (`localStorage`), in the same way.

## 2. Which cookies we use

We use a minimal set of cookies — only those strictly necessary to run the service or to remember your preferences.

| Category   | Name / Provider      | Purpose                                       | Duration   |
| ---------- | -------------------- | --------------------------------------------- | ---------- |
| Necessary  | `__session` (Clerk)  | Logged-in user session, sign-in               | Session    |
| Necessary  | `cf_bm` (Cloudflare) | Bot protection, security                      | 30 minutes |
| Functional | `chatmerce-theme`    | Theme preference (light/dark), `localStorage` | 12 months  |

**We use no analytics or marketing cookies.** The marketing site has no Meta or Google Ads pixels. We count visits with Cloudflare Web Analytics, which **sets no cookies** and stores nothing else in your browser, builds no profile and does no cross-site tracking — we receive aggregates only (page views, referrer, country, device type). If we introduce analytics or marketing cookies in the future, we will ask for your consent through a banner that makes rejecting optional cookies as easy as accepting them, before any such cookie loads.

## 3. Purpose and legal basis

- **Necessary cookies** — legal basis: art. 6(1)(b) and (f) GDPR (performance of the contract and legitimate interest — security and operation of the service). No consent is required, as they are essential to provide the service.
- **Functional cookies** — legal basis: art. 6(1)(f) GDPR (legitimate interest — usability). They are stored in response to your action (choosing a theme) and can be deleted without affecting core features.

## 4. Managing cookies

You can delete or block functional and necessary cookies in your browser settings. Note that disabling necessary cookies may prevent sign-in and the use of some platform features.

- **Google Chrome:** Settings → Privacy and security → Cookies and other site data
- **Mozilla Firefox:** Settings → Privacy & Security → Cookies and Site Data
- **Safari:** Settings → Privacy → Manage Website Data
- **Microsoft Edge:** Settings → Cookies and site permissions

Because we set no optional (analytics or marketing) cookies, we do not display a consent banner — Cloudflare Web Analytics works without storing anything on your device, so no consent is required for it. When that changes, a consent-management panel will be available from the site footer.

## 5. Third-party cookies

We use providers that may set their own cookies needed for the platform to work:

| Provider         | Service             | Privacy policy                                                            |
| ---------------- | ------------------- | ------------------------------------------------------------------------- |
| Clerk, Inc.      | User authentication | [clerk.com/legal/privacy](https://clerk.com/legal/privacy)                |
| Cloudflare, Inc. | CDN, bot protection | [cloudflare.com/privacypolicy](https://www.cloudflare.com/privacypolicy/) |

The full list of our sub-processors is in the [Privacy policy](/en/privacy) and the [Data Processing Agreement (DPA)](/en/dpa).

## 6. Transfers outside the EEA

Some providers (including Clerk and Cloudflare) are based outside the European Economic Area. Transfers rely on Standard Contractual Clauses (SCC) and EU–U.S. Data Privacy Framework (DPF) certification, in line with Chapter V GDPR.

## 7. Your rights

You have the right to access, rectify, erase and object to the processing of your data — details are in the [Privacy policy](/en/privacy). You may also lodge a complaint with a supervisory authority:

- **Poland:** Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, [uodo.gov.pl](https://uodo.gov.pl)
- **Norway:** Datatilsynet, Postboks 458 Sentrum, 0105 Oslo, [datatilsynet.no](https://datatilsynet.no)

## 8. Changes and contact

We may update this Cookie Policy to reflect changes in law or technology. We will announce material changes on the site. The current version is always available at `chatmerce.eu/cookies`.

For cookie and data-protection matters, email [hello@chatmerce.eu](mailto:hello@chatmerce.eu).

Prosit AS — organisasjonsnummer 932 184 110, registered address to be added after registration in the Norwegian Brønnøysund Register Centre.