Effective Date: March 4, 2026
Last Updated: March 23, 2026
This Cookie Policy explains how Kosmatic Solutions Inc. ("Kosmatic," "we," "us," or "our") uses cookies and similar technologies on our website https://kosmatic.com and the e-commerce stores where our tracking technology is deployed.
1. What Are Cookies?
Cookies are small text files stored on your device (computer, tablet, or mobile) when you visit a website. They help websites remember your preferences, understand how you use the site, and improve your experience.
We also use similar technologies like:
- LocalStorage and SessionStorage (browser storage)
- Pixels and web beacons (tiny invisible images)
- Browser fingerprinting (cookieless tracking method — see Section 3)
- Server-side event tracking (Meta Conversions API, GA4 Measurement Protocol)
2. Types of Cookies We Use
2.1 Essential Cookies (Required)
These cookies are necessary for the Service to function. You cannot opt out of these.
| Cookie Name | Purpose | Duration |
|---|---|---|
auraflow_token | Authentication (JWT access token) | 15 minutes |
auraflow_refresh | Session refresh token | 7 days |
google_oauth_state | Google login security (CSRF) | Session |
shopify_login_state | Shopify login security (CSRF) | Session |
Legal basis: Strictly necessary for the provision of the Service (ePrivacy Directive Art. 5(3) exemption; not subject to consent).
2.2 Functional Cookies
These cookies remember your preferences and settings.
| Cookie Name | Purpose | Duration |
|---|---|---|
auraflow_consent | Your cookie/tracking consent choices | 90 days |
auraflow_preferences | Dashboard display preferences (card density, auto-refresh) | 90 days |
theme_preference | Light/dark mode | 1 year |
Legal basis: Consent. You may decline these; doing so may limit personalization features.
2.3 Analytics Cookies
These cookies help us understand how visitors interact with our Service.
| Cookie Name | Purpose | Duration |
|---|---|---|
_ga (Google Analytics 4) | Distinguish users | 2 years |
_gid (Google Analytics 4) | Distinguish users | 24 hours |
_gat (Google Analytics 4) | Throttle request rate | 1 minute |
Legal basis: Consent. You may decline these without affecting core functionality.
2.4 Server-Side Tracking (No Cookies)
The following technologies operate server-side and do not place cookies on your device:
| Technology | Purpose | Data Sent |
|---|---|---|
| Meta Conversions API | Advertising attribution (when Merchant enables Meta integration) | Hashed email, conversion events (no raw behavioral data) |
| GA4 Measurement Protocol | Server-side analytics events | Anonymized usage events |
These are activated only when a Merchant configures the relevant integration.
3. Cookieless Tracking (Three-Tier Consent Model)
For visitors who decline cookies or where cookie consent has not been obtained, we use a privacy-preserving cookieless tracking system based on browser fingerprinting.
How It Works
- We collect technical signals from your browser (screen size, browser version, installed fonts, hardware capabilities, canvas/WebGL rendering characteristics)
- These signals are hashed using SHA-256 to create a temporary, probabilistic identifier
- The identifier is held in memory only — it is never written to your device
- The identifier expires after 24 hours and cannot be recovered
- The identifier cannot track you across different websites
Three Data Tiers
| Tier | Identifier | Consent Required | Data Collected | Retention |
|---|---|---|---|---|
| Anonymous | None (aggregate only) | In consent-required regions, yes (via the store's banner); elsewhere opt-out | Scroll velocity, scroll depth, reading pattern, rage/dead clicks, form interaction patterns | Session only |
| Pseudonymous | Ephemeral fingerprint (24h) | In consent-required regions, yes (via the store's banner); elsewhere opt-out | Decision latency, backtracks, mouse hesitation, pricing attention, CTA engagement, exit trajectory, session depth, product attention | 24 hours |
| Identified | Persistent visitor ID | Yes (explicit consent, everywhere) | Email, name, cart value, checkout progress, order history, quiz responses, UTM/campaign data | Configurable (default 90 days) |
Comparison with Traditional Cookies
| Feature | Traditional Cookies | Cookieless Fingerprinting |
|---|---|---|
| Stored on device | Yes | No (memory only) |
| Cross-site tracking | Possible | No |
| Duration | Days to years | 24 hours maximum |
| Personal identification | Yes | No (probabilistic only) |
| Survives browser restart | Yes | No |
| Privacy impact | Higher | Lower |
Legal Basis for Cookieless Tracking
Device fingerprinting reads information from your device, so EU and UK ePrivacy rules (ePrivacy Directive Art. 5(3), PECR) treat it like a cookie: in those jurisdictions it requires consent, whatever the subsequent processing basis. Our tracker is built accordingly:
- Consent-required regions (EU/EEA, UK, and any other region the store's consent banner covers, such as Quebec): no tier runs, including the anonymous tier, until you give consent through the store's banner. The tracker reads the store's consent signal (on Shopify, the Customer Privacy API) and does not start without it. GDPR basis: consent (Art. 6(1)(a)).
- Opt-out regions (most of the US, and other jurisdictions on a notice-and-opt-out model): the anonymous and pseudonymous tiers run by default under the applicable opt-out framework and, where GDPR-equivalent laws apply, legitimate interests. You can opt out at any time: we honor Global Privacy Control and Do Not Track as a hard opt-out everywhere (see Section 5.3), and you can object per Section 5.
- Identified tier: activates only on your explicit action (for example, entering your email into a signup form), everywhere.
4. Third-Party Cookies
Some cookies are placed by our trusted partners:
| Third Party | Purpose | Privacy Policy |
|---|---|---|
| Google Analytics | Usage analytics | Google Privacy (opens in a new tab) |
| Google OAuth | Authentication | Google Privacy (opens in a new tab) |
| Shopify | E-commerce integration | Shopify Privacy (opens in a new tab) |
| Render | Hosting infrastructure | Render Privacy (opens in a new tab) |
We do not allow third parties to use cookies for advertising on our platform without your explicit consent.
5. Managing Your Cookie and Tracking Preferences
5.1 Consent Banner
When you first visit our Site or a Merchant's store where our technology is deployed, you'll see a cookie consent banner. You can:
- Accept All: Allow all cookies and tracking (all three tiers)
- Customize: Choose which categories to allow
- Essential Only: Only required cookies and Anonymous-tier tracking (no fingerprinting, no identified data)
5.2 Browser Settings
You can also control cookies through your browser:
| Browser | Instructions |
|---|---|
| Chrome | Settings → Privacy and security → Cookies |
| Firefox | Settings → Privacy & Security → Cookies |
| Safari | Preferences → Privacy → Cookies |
| Edge | Settings → Cookies and site permissions |
5.3 Global Privacy Control & Do Not Track
We honor the following browser privacy signals as an opt-out:
- Global Privacy Control (GPC) — modern standard for opting out of data sale/sharing
- Do Not Track (DNT) — legacy browser signal
When either signal is present, on stores using our technology we:
- Do not initiate behavioral tracking or device fingerprinting
- Treat it as an opt-out of data "sharing" under CCPA/CPRA
- Do not sync data to advertising platforms (Meta, Google Ads)
We do not use the presence of these signals to identify your device.
5.4 Changing Your Preferences
You can update your cookie and tracking preferences at any time by:
- Clicking the "Cookie Settings" link in our footer
- Clearing your browser cookies (resets consent preferences)
- Contacting us at support@kosmatic.com
5.5 Opting Out of Cookieless Tracking
Even though cookieless fingerprinting does not store data on your device, you have the right to object:
- Enable GPC or DNT in your browser (we honor both)
- Contact the Merchant whose store you are visiting
- Email support@kosmatic.com with identifying details (store visited, approximate date/time)
6. Cookie Duration
| Category | Duration | Rationale |
|---|---|---|
| Essential | Session to 7 days | Security and authentication |
| Functional | 90 days to 1 year | Remember preferences |
| Analytics | 90 days to 2 years | Long-term trend analysis |
| Fingerprinting | 24 hours (memory only) | Temporary visitor identification |
7. Data Collected via Each Technology
Essential & Functional Cookies
- Login session status
- User preferences (theme, display density)
- Consent choices
Analytics Cookies
- Pages visited
- Time on site
- Referral source
- Device and browser information
Cookieless Fingerprinting (Pseudonymous Tier)
- Screen resolution and viewport size
- Browser plugins and installed fonts
- Hardware capabilities (CPU cores, device memory)
- Canvas and WebGL rendering characteristics
- Time zone and language settings
Note: Fingerprinting data is processed in memory and used solely to generate a temporary hash. The raw signals are not stored.
Server-Side Tracking
- Conversion events (purchase, add-to-cart)
- Hashed identifiers (SHA-256 email hash)
- No raw behavioral data transmitted to third parties
8. Updates to This Policy
We may update this Cookie Policy to reflect changes in technology or law. Changes will be posted on this page with an updated "Last Updated" date.
Significant changes will be notified via:
- Email to registered users
- Banner on our website
- Dashboard notification
9. Contact Us
Questions about cookies or tracking?
Email: support@kosmatic.com
Address: Vancouver, British Columbia, Canada
10. Additional Resources
- Privacy Policy
- Terms of Service
- Data Processing Agreement
- GDPR Information (opens in a new tab)
- All About Cookies (opens in a new tab)
- Global Privacy Control (opens in a new tab)
END OF COOKIE POLICY