Cookies

1. Introduction

We publish this policy so that visitors to flopay.com can see exactly what runs in their browser when they land on the site, what it implies for their data, and what choices they have. It complements our Privacy Policy, which describes how FloPay handles personal information more broadly.

2. Scope

This policy applies to the FloPay website at flopay.com, including the developer documentation and changelog served under flopay.com/docs (the former docs.flopay.com redirects there). Our developer and demo subdomains (including api.flopay.com and demo.flopay.com) and the FloPay platform, SDKs, APIs, dashboards, the Agent Vault, and the MCP Server may use cookies and similar technologies for authentication, security, and product functionality. Those uses are described in the documentation and notices for each Service.

It also applies to flopay.link, the branded short-link domain used by FloPay partners. flopay.link sets no cookies and stores nothing in your browser. It answers with an HTTP redirect to a page on flopay.com and records that the link was followed, so the partner who shared it can be credited. That record holds the partner’s key, the time, the destination page, the country the request came from, and whether the request came from a phone, tablet, desktop browser, or an automated link-preview service. It holds no IP address, no user-agent string, no cookie, and no identifier for you, and nothing in it can be linked back to an individual visitor.

To count how many separate people followed a link rather than how many times it was followed, flopay.link derives a short-lived, one-way value from the network address and browser of the request. That value is held in memory for at most 24 hours, is re-keyed every day so it cannot be used to recognize the same client on a later day, and is never written to permanent storage. It is used only to mark a second visit on the same day as a repeat.

3. What Are Cookies

Cookies are small text files that a website asks your browser to store on your device. They are used to remember information between page loads and visits: for example, to keep you signed in, remember a preference, or measure how the site is used.

“Similar technologies” we treat the same way as cookies for this policy include:

• Local storage and session storage: browser-side key/value stores scoped to a site.
• Pixels and tracking beacons: small images or scripts used to record that a page or email was opened.
• SDKs and tag managers: third-party libraries that may set their own cookies or local storage entries when loaded.

Cookies can be first-party (set by flopay.com) or third-party (set by another domain whose resources we load). They can be session cookies that expire when you close your browser, or persistent cookies that remain until they expire or you delete them.

4. Cookies On flopay.com Today

flopay.com uses Google Analytics. Google Analytics may set the first-party cookies _ga and _ga_<container-id>. By default, Google documents both cookies as lasting for up to two years: _ga distinguishes users, while _ga_<container-id> preserves session state.

We use the resulting aggregate measurements to understand site traffic and how visitors navigate the marketing site. Google Analytics is loaded for us by Google Tag Manager (see Section 5). The tag manager is a container that decides which measurement tags run, not a measurement tool in itself: it sets no cookies on flopay.com and collects nothing about you on its own.

flopay.com uses Google Ads conversion tracking. Through the same tag manager, we load a Google Ads conversion tag so we can measure whether a click from a Google ad leads to a submitted enquiry: either the homepage demo contact details, or the contact form. Google’s conversion linker may set the first-party cookie _gcl_au, which Google documents as lasting for up to 90 days. It stores a click identifier so a later lead can be attributed to the ad that brought the visitor. We do not use remarketing, retargeting, or A/B-testing tools on the marketing site.

flopay.com uses Sentry Session Replay. Sentry records a reconstruction of browser sessions on the marketing site so that we can diagnose errors and broken journeys. Recording currently applies to all sessions. Text shown on marketing pages is captured as part of the recording; text you type into form fields is masked and is not captured, and the hosted card-entry step runs inside a separate PCIVault frame that replay cannot record. Sentry stores a session identifier in your browser’s sessionStorage under sentryReplaySession, which is cleared when you close the tab.

Partner-arrival measurement. When you arrive from a partner short link, flopay.com sends a single first-party message to our own server recording that an arrival for that partner happened. It carries the partner’s key and the page you landed on, sets no cookie, stores nothing in your browser, and contains no identifier for you. It exists so we can tell how many partner links reached a real browser rather than an automated link-preview fetch.

Our own site code stores one entry in local storage, flopay_attribution, recording which campaign or referring site brought you to flopay.com. It is read back only if you later submit a form or start a checkout, so the enquiry can be attributed. It holds no name, email, or identifier for you.

5. Third-Party Resources

flopay.com loads five third-party resources that are relevant to this policy:

• Google Fonts. We load web fonts from Google’s font-hosting service to render typography on the site. Google does not receive cookies from this request when it is made to fonts.googleapis.com, but as with any HTTP request your IP address, user-agent string, and the referring URL are visible to Google as part of normal network delivery. Google’s use of that information is governed by Google’s own privacy terms.
• Google Tag Manager. We load Google Tag Manager container GTM-TQ42PTJ6, which decides which measurement tags run on flopay.com and loads them for us. It exists so that adding or removing a tag does not require changing the site’s code. The container sets no cookies on flopay.com and performs no measurement of its own; as with any request to a third-party host, your IP address and user-agent string are visible to Google as part of delivering the container script. The container currently loads Google Analytics and Google Ads conversion tracking, described next.
• Google Analytics. Through the tag manager above, we load Google’s gtag.js script using measurement ID G-X8H170MPGB to measure visits and site usage. Google Analytics receives usage and device information and may set the first-party analytics cookies described in Section 4. You can read more in Google Analytics’ data safeguards.
• Google Ads conversion tracking. Through the tag manager above, we load Google’s conversion tag to measure whether a paid click results in a lead. Google Ads receives that a conversion happened, the page it happened on, and the click identifier from _gcl_au when one is present. It does not receive the name or email you typed into the form. You can read more in Google Ads conversion tracking.
• Sentry. We load Sentry’s browser SDK to capture JavaScript errors, performance traces, and the session recordings described in Section 4. Sentry receives error and device information and the recorded session, and stores the sentryReplaySession identifier in sessionStorage. Sentry acts as a processor for FloPay under its own privacy terms.

Apart from the tag-management container described above, we do not currently load third-party social, video, or remarketing resources on flopay.com. If we add a tag to the container, or load a new resource, we will update this page before that change goes live, and any cookies it requires will be handled as described in Section 8.

External links from flopay.com to FloPay’s other surfaces (for example, api.flopay.com and demo.flopay.com) or to third-party sites are not in scope for this policy; once you follow such a link, the destination site’s own cookie practices apply.

6. Cookie Categories

We classify cookies and similar technologies using the categories below. These are the same categories most consent-management frameworks use.

• Strictly necessary. Required for the site to function: for example, preserving a security token across a navigation. These cannot be switched off in a consent banner because the site relies on them. We do not currently set any on the marketing site.
• Preferences. Remember choices you make to personalize the experience: for example, language, theme, or whether you have dismissed a banner. We do not currently use preference cookies on the marketing site.
• Analytics. Help us understand how visitors use the site so we can improve it. The Google Analytics cookies described in Section 4 are in this category.
• Marketing. Used to measure the effectiveness of marketing campaigns or to deliver advertising. The Google Ads conversion-linker cookie _gcl_au described in Section 4 is in this category. We use it only to attribute a lead to a Google ad click. We do not use it to show you ads on other sites.

7. How To Manage Cookies

You can control or remove the Google Analytics and Google Ads cookies used on flopay.com through the following options:

• Browser settings. Every major browser (including Chrome, Safari, Firefox, and Edge) lets you view stored cookies, block third-party cookies, clear cookies for a specific site, or block all cookies. Look in your browser’s privacy or site-settings panel.
• Google Analytics opt-out. Google provides a browser add-on that prevents Google Analytics measurement on sites you visit.
• Google Ads settings. Google provides an Ads Settings page where you can control how Google uses data for advertising, including conversion measurement.
• Private or incognito mode. Most browsers offer a private-browsing mode that discards cookies and local storage when you close the window. It does not necessarily prevent analytics measurement during the private session.

Blocking or deleting analytics or marketing cookies does not prevent you from using the marketing site’s core content.

8. Consent & Changes

Google Tag Manager, and the Google Analytics and Google Ads conversion tags it loads, are non-essential and begin loading when you visit flopay.com. You can prevent or limit that measurement using the controls in Section 7.

We will update this policy before introducing other new non-essential cookie categories. Where applicable law requires additional consent controls, we will surface a mechanism that lets visitors accept or reject those categories.

9. Related Policies

This policy should be read together with our other legal documents:

• Privacy Policy, which describes how FloPay collects, uses, shares, and protects personal information.
• Terms, which govern your use of flopay.com and the FloPay Services.

10. Changes To This Policy

We may update this policy from time to time: for example, when we add or remove a third-party resource, change the categories we use, or introduce a consent mechanism. When we do, we will revise the “Effective” date above and, for material changes, give prominent notice on the Website. Your continued use of flopay.com after the effective date constitutes acceptance of the updated policy.

11. Contact

Questions, requests, or complaints about this policy can be sent to hello@flopay.com.