Legal

Cookie policy

Which cookies and browser storage [Company legal name] uses on this website, why, and for how long.

Draft — pending legal review; not legal advice.

This page describes how the platform works today. It has not yet been approved by counsel, and bracketed items such as [Company legal name] are placeholders the operator still has to fill in. Last updated 28 Sept 2026.

1.In short

We use one cookie to keep you signed in and, only when you follow a partner’s tracking link, two cookies that help credit the right partner for a sale. We do not use advertising cookies, and the site loads no third-party analytics or tracking scripts — its security policy only allows content from our own domain.

2.Cookies we set

Name	Purpose	Set	Lasts
spm_refreshStrictly necessary	Keeps you signed in. Holds a refresh token that is exchanged for a short-lived access token; rotated on every use and revoked when you sign out or reset your password.HttpOnly · SameSite=Strict · sent only to the sign-in API path · Secure in production	When you sign in	Up to 30 days (configurable by the operator)
spm_clickAttribution (functional)	Remembers the id of the partner tracking link you followed, as a fallback for attributing a purchase to that partner. The id is also passed to the vendor’s site in the page address.SameSite=Lax · Secure in production	When you follow a partner’s tracking link (/r/…)	The program’s cookie window (for example 30 days)
spm_vidAttribution (functional)	A random visitor id used to connect several clicks from the same browser, for programs that have multi-click attribution switched on. It does not identify you by name.HttpOnly · SameSite=Lax · Secure in production	When you follow a partner’s tracking link (/r/…)	365 days

3.Other browser storage

Selected organisation (spm_org, session storage): if your login belongs to more than one organisation, remembers which one you are working in. Cleared when you close the tab.
Your access token is kept only in the page’s memory, never in cookies or storage, and disappears when you close the page.

4.Why attribution cookies are used

When you follow a partner’s link, the redirect records the click (with a keyed hash of your IP address and browser, not the raw values) and forwards you to the vendor’s website with a click id in the address. The vendor sends that id back when you pay, and our servers check it against the click log. The cookies above are a fallback for when the id cannot be passed along.

They are used only to decide which partner, if any, earns a commission on a purchase you make from the vendor. Whether this processing requires your consent, and how consent is collected, is [to be confirmed by counsel].

5.Your choices

You can block or delete cookies in your browser settings. If you block spm_refresh you will need to sign in again on each visit. Blocking the attribution cookies does not stop you buying software; it may mean a partner who referred you is not credited.

6.Changes and contact

We will update this page when the cookies we use change; the date at the top shows the latest version. Questions: contact us or write to [privacy contact email].