This policy explains the cookies and similar technologies used on Paffle’s website, application and investor and affiliate portals. It should be read with our Privacy Policy. In this policy, “Paffle”, “we”, “us” and “our” mean Paffle Pay Inc., the company that operates Paffle.
What these technologies do
Cookies are small files stored by your browser. Similar technologies include local storage, session storage, pixels and scripts that store or access information on your device. Some keep a service secure or remember a choice; others can measure activity or support advertising.
A session cookie generally lasts for a browsing session. A persistent cookie has a set lifetime. Your browser may preserve sessions or delete information sooner, and a cookie can be refreshed when a service is used.
Our marketing website
Where we use the website’s built-in analytics, they measure website activity without cookies or persistent visitor identifiers. Additional scripts, form tools and embedded content may use cookies or similar technologies.
Website forms may collect information you choose to submit. Security and spam protection may process technical information. Our Privacy Policy explains how we use that information and the service categories involved.
Additional tools can change the technologies used on the website. Where a tool requires consent, it must stay blocked until you choose to enable it. A published cookie policy does not itself block scripts or provide that choice.
Application and portal cookies
Our application and portals use the following technologies when relevant to the feature you request. The table covers the application and portals; the marketing website is assessed separately. Names can have security prefixes or numbered chunks in a secure deployment.
Cookie or storage | Purpose | Usual lifetime |
|---|---|---|
next-auth.session-token, including secure prefixes or chunks | Maintains authenticated access to the application or portal. | A rolling window of about 23 minutes 30 seconds from issue or refresh. An active tab signs out after 18 minutes without activity unless you continue. |
next-auth.csrf-token | Protects sign-in and related forms against forged requests. | Browser session. |
next-auth.callback-url | Returns you to the requested destination after sign-in. It can carry a referral code supplied with that journey. | Browser session. |
next-auth.state and next-auth.pkce.code_verifier | Protects a Google or Microsoft sign-in exchange. | Up to 15 minutes; normally removed when the exchange completes. |
paffle.sign_in_challenge | Carries the protected challenge between password entry and the second sign-in step. | Up to 5 minutes. |
paffle.active_business | Remembers the business you selected. It does not grant access to it. | Up to one year. |
paffle.theme, paffle.lang and paffle.sidebar | Remembers your theme, language and side-menu choice. | Up to one year. |
Local storage for assistant width and budget display choices | Remembers device-specific interface settings. | Until cleared or replaced. |
paffle:session-activity in local storage, when used as a fallback | Coordinates session activity across tabs. It does not extend sign-in beyond the server’s session rules. | Until overwritten or cleared. |
Maintenance-notice dismissal in session storage | Remembers that you dismissed a particular maintenance notice. | The browsing session; a changed notice or a later stage may be shown again. |
paffle.excel.connection.v1 in local storage | Stores the selected business identifier and business connection key for the Excel add-in. Access tokens, user identity and downloaded rows are not persisted there. | Until disconnected, removed or replaced; server expiry or revocation can end access sooner. |
Authentication and security technologies are used to provide the requested service safely. Preference storage is used to remember your choices. We do not treat every possible preference or analytics technology as automatically exempt from consent requirements.
Paffle’s application and portal cookies are scoped to the host that sets them. They are not shared across all paffle.com subdomains. A choice made on the marketing website does not itself authorize an unrelated tracker on the application or a portal.
Referral links can carry a code in the URL and generate an attribution record. We do not set a separate long-lived referral tracking cookie simply because you follow one.
Your choices
You can change Paffle’s available display preferences in the interface and remove stored information through your browser. Blocking authentication or security cookies may prevent sign-in or make a requested feature work incorrectly. Clearing a preference normally resets it.
Where a technology requires consent, it must not run before you agree, and you must be able to refuse or withdraw that choice. Where an applicable exception requires an objection route, that route must be provided. The controls depend on the technologies enabled on the published site. Continuing to browse is not consent to optional tracking.
For a service you visit outside Paffle, including a sign-in provider, verification page or external payment page, that provider’s cookie information and controls apply.
Updates and contact
We update this policy when the technologies or their purposes change. The date at the top identifies the current version. For questions about cookies or privacy, email privacy@paffle.com.