Cookie policy

loyalty_token — keeps you signed in to your account. Expires after 90 days, or immediately on sign-out.

loyalty_tenant_id — remembers which business dashboard you're viewing, if you manage more than one. Expires after 90 days.

platform_token — keeps a platform administrator signed in. Session-based.

platform_impersonation_tenant_id — set only while platform support is temporarily viewing a business's dashboard to help with an issue. Session-based.

All four are strictly necessary for the service to function — signing in, and staying signed in, doesn't work without them. Under the ePrivacy rules, strictly necessary cookies don't require consent, so these are set without asking.

We also store your answer to the cookie banner in your browser's local storage, so you are not asked again on every visit. Storing that answer is what the law requires of us, and it is never used for anything else.

TikTok Pixel — tells us whether our TikTok ads actually bring anyone to this site, and which pages those visitors read. It sets a cookie named _ttp in your browser, and it reads the ttclid value TikTok adds to the address when you arrive from one of our ads.

It is loaded only after you accept it in the banner. Until then the pixel's code is not downloaded at all, so no request — and no IP address — reaches TikTok. Declining, or simply ignoring the banner, keeps it that way.

It runs on the public marketing pages only. It is never loaded on a signed-in page: not your account, not a business dashboard, and not a stamp card check-in.

TikTok processes what the pixel sends under its own privacy terms, as a separate controller. Accepting means data about your visit — including your IP address — goes to TikTok, which may transfer it outside the EU.

Microsoft Clarity — shows us how these pages are actually used: what people click, how far they scroll, and where a page confuses them. It records a replay of the pages you saw, and sets cookies in your browser (named _clck and _clsk) to recognize the same visit across pages. Text you type into forms is masked before it is sent.

It is covered by the same single answer as the pixel, and it is loaded the same way: nothing is downloaded from clarity.ms, and no request reaches Microsoft, until you have accepted. It runs on the public marketing pages only, never on a signed-in page, and it stops recording the moment you open one.

Microsoft processes what Clarity records under its own privacy terms, as a separate controller, and may transfer it outside the EU.

Google Analytics — counts how many people read these pages, which pages they read and how they found us. It sets cookies in your browser (named _ga, and _ga_ followed by our property id) to recognize the same visit across pages and to tell a returning reader from a new one.

It is covered by the same single answer as the other two, and it is loaded the same way: nothing is downloaded from googletagmanager.com, and no request reaches Google, until you have accepted. It runs on the public marketing pages only, and never on a signed-in page.

Google processes what the tag sends — including your IP address — under its own privacy terms, as a separate controller, and may transfer it outside the EU.

Use the controls at the bottom of this page. Accepting takes effect immediately; declining withdraws consent from the pixel, Clarity and Google Analytics and stops all three reporting anything further from that moment. Withdrawing is as easy as giving consent, and costs you nothing here — every page works the same either way.

Declining also deletes the identifiers already set in your browser — _ttp, _tt_enable_cookie, ttcsid, _clck, _clsk and _ga, _ga_…, _gid — so a later acceptance starts you as a new visitor rather than picking up where the old one left off. The cookies TikTok, Microsoft and Google keep on their own domains are not ours to delete; withdrawing consent is what stops those being used.

Data already sent to TikTok, Microsoft or Google before you withdrew is handled by them; ask each to delete it through the rights described in its own privacy policy.

You can also block or delete cookies through your browser's settings. Since every cookie we set ourselves is required to sign in, blocking those will sign you out and keep you from signing back in.

If this policy changes in a material way, we'll update the date at the top of this page.

Questions about this policy can be sent to the address on our contact page.