Cookie Policy

1. What Are Cookies

Cookies are small text files placed on your device when you visit a website. We also use related browser storage technologies (localStorage, sessionStorage) which serve similar purposes. Throughout this policy "cookies" refers to all of these technologies.

This policy covers cookies and storage set by the marketing website (openboxes.cloud) and by the customer portal (app.openboxes.cloud).

2. How We Use Cookies

We use cookies to:

• Keep you signed in to your customer portal account
• Remember your cookie-consent preference so we don't ask again on every visit
• Understand how visitors use our marketing website — which pages and sections get read, and for how long — and, via FullStory session replay, how visits to the website, the customer portal, and the public demo instance unfold, so we can improve them (see Section 3.2 for exactly what runs, and when)
• Protect against cross-site request forgery and other security threats

We do not use cookies for advertising and we never track you across other websites. One honest caveat about "profiles": our own analytics assigns your browser a random identifier so we can tell returning visits apart, and if you reach out to us — by requesting demo access, joining the waitlist, or leaving your details with our chat assistant — we may associate your prior browsing on this site only with your inquiry, so we can respond knowledgeably. That association never includes activity on any other website, is never sold or shared, and is removed when your inquiry is deleted — and the underlying browsing data ages out of our systems within 180 days regardless. If you opt out (Section 5.1), none of this happens.

3. Cookies and Storage We Use

3.1 Strictly Necessary

These items are required for the website and portal to function and cannot be disabled. No consent is required under applicable privacy law for strictly necessary technology.

3.2 Analytics (Optional)

Three optional analytics systems run subject to the consent rules below. Our own first-party analytics (data goes only to our servers) and Google Analytics 4 run on the marketing website only — never on the customer portal. FullStory session replay runs on the marketing website, the customer portal, and the public demo instance at demo.openboxes.cloud. On the website it follows the consent rules below; in the signed-in customer portal it runs under our Terms of Service and is controlled by the "Session replay & analytics" toggle in the portal's Settings, not by this banner; the demo instance has no consent banner — replay there is disclosed on the demo request page, in the access email, and in our Privacy Policy, which describes what is recorded.

When they run: for most visitors, analytics runs by default and the banner lets you opt out at any time. Two groups are opted in instead — nothing runs until they explicitly accept: visitors whose browser sends the Global Privacy Control signal, and visitors whose device timezone indicates the EU or UK (a best-effort technical check — it can be wrong for travelers and VPN users, and we treat it as a good-faith control, not a guarantee).

Our first-party analytics stores these identifiers (random values — they contain nothing about you):

What the first-party system records: pages viewed, time spent reading each page section, scroll depth, and clicks on our own buttons and links — plus your browser's reported referrer, screen size, language, and timezone. That system never stores your IP address (only a keyed one-way code derived from it, used for abuse protection), never records what you type, and its raw data is deleted after 180 days. FullStory, described below, works differently — it does record what you do on the page, including text you type into forms.

Google Analytics sets:

FullStory session replay records how your visit unfolds — mouse movement, clicks, scrolling, the page content you see, and text you type into forms (payment card and bank account details are entered in Stripe-hosted frames that FullStory cannot see). Recordings are uploaded to FullStory, Inc. and hosted in its United States (na1) environment. FullStory sets:

While you have not consented (you opted out on a previous visit, or you are in an opt-in group and have not accepted), Google Analytics and FullStory scripts are not loaded on page load, no _ga or fs_uid cookies are written, and our first-party analytics sends nothing. If you opt out during a visit where analytics was already running: our first-party analytics stops immediately and your lift_* identifiers are removed; Google Analytics receives a consent-denied signal and we send it no further events (an already-loaded script cannot be unloaded mid-page, but from your next page load it is not loaded at all); and FullStory stops recording immediately. One honest limitation: opting out stops future recording, but the portions of your session that were uploaded to FullStory before you opted out are not recalled by the opt-out — they are retained by FullStory and deleted under its retention policy.

3.3 Marketing

We do not currently use marketing or advertising cookies (no Facebook Pixel, no Google Ads conversion pixels, no LinkedIn Insights, no remarketing tags). If we add any in the future we will update this policy at least 30 days in advance and require fresh consent.

4. Third-Party Services

Some third-party services we use may set their own cookies in your browser when you interact with their parts of the experience:

• Google Analytics (marketing website only, subject to the consent rules in Section 3.2) — see Google's Privacy Policy.
• FullStory (session replay on the marketing website and the customer portal, subject to the consent rules in Section 3.2; it also runs on the public demo instance at demo.openboxes.cloud, where it sets the same cookie — what it records there is described in our Privacy Policy) — FullStory, Inc. sets the fs_uid cookie to recognize your browser across visits; recordings are hosted in FullStory's United States (na1) environment. See FullStory's Privacy Policy.
• Stripe (during checkout / payment-method update) — sets cookies for fraud prevention. See Stripe's Cookie Settings.
• Keycloak (self-hosted by us on auth.openboxes.cloud) — sets authentication-related cookies for the single-sign-on flow. These are part of our infrastructure and listed under Strictly Necessary above.

For the complete list of third parties that process customer data, see our Sub-Processor List.

5. Managing Cookies

5.1 Cookie Consent Banner

When you first visit our marketing website you will see a banner where you can accept analytics or opt out. For most visitors analytics runs by default until you choose; for Global Privacy Control and likely-EU/UK visitors it stays off until you accept (Section 3.2). Your choice is stored in localStorage as cookie-consent and respected on subsequent visits; opting out also takes effect immediately and removes the lift_* identifiers.

You can change your preference at any time using the "Cookie preferences" link in the site footer, which reopens the banner — or by clearing browser storage for openboxes.cloud (which will cause the banner to reappear on next visit).

5.2 Browser Settings

Most browsers allow you to control cookies and storage through their settings:

• Block all cookies
• Block third-party cookies only
• Clear cookies when you close the browser
• Receive alerts before cookies are set

Blocking strictly necessary cookies will prevent you from signing in to the customer portal and using OpenBoxes Lift.

5.3 Opt-Out for Google Analytics

You can opt out of Google Analytics tracking globally by installing the Google Analytics Opt-Out Browser Add-on, or by rejecting our cookie banner.

6. Changes to This Policy

We may update this Cookie Policy from time to time. Material changes — including the introduction of any new categories of cookies — will be announced with at least 30 days' notice via the cookie banner and the "Last updated" date at the top of this page.

7. Contact Us

For questions about our use of cookies, contact privacy@openboxes.cloud.