Cookie Policy

1. What cookies and similar technologies are

A cookie is a small text file a website asks your browser to store on your device, which the browser may send back on later visits. Similar technologies include local storage (data your browser keeps on your device for a site but does not automatically send to any server) and software development kits embedded in the app.

• First-party vs third-party - a first-party cookie is set by VultPay; a third-party cookie is set by another organisation whose service is used on our pages (for example, our analytics provider).
• Session vs persistent - a session cookie is deleted when you close your browser; a persistent cookie or stored value remains for a set period or until you clear it.
• Strictly necessary vs optional - strictly necessary cookies are required to deliver a service you have asked for and are exempt from consent; optional cookies (such as analytics) are only used with your consent.

2. The categories of cookies we use

We keep our use of cookies deliberately narrow for a payments service. We use three categories only: strictly necessary, functional / preference, and analytics. We do not use advertising, marketing, or cross-site tracking cookies, and we do not use cookies to build profiles of you or to sell or share your data with data brokers.

3. Strictly necessary cookies and storage

These are essential to operate the service securely and cannot be switched off through our banner, because without them the parts of the service you have asked for would not work. They do not require your consent. They are set by VultPay (first-party).

• vultpay_session (cookie, first-party) - keeps a signed-in seller authenticated between pages. It is an httpOnly, Secure cookie with a SameSite restriction, so it is not readable by page scripts and is sent only to VultPay over HTTPS. It lasts for the length of your signed-in session and is cleared when you sign out.
• vultpay_seller_session (local storage, first-party) - lets the dashboard app remember your active session in the browser. Removed when you sign out.
• vultpay_cookie_consent (local storage, first-party) - records your analytics choice (accepted or declined) so we do not ask again on every visit. Persistent until you clear it or withdraw the choice.
• Security, fraud-prevention, and reliability essentials - values used to protect against fraud and abuse and to route requests reliably. These are part of delivering the service and cannot be disabled while you use it.

4. Functional and preference storage

These remember choices you make so the service is more convenient. We store them on your device (primarily in local storage rather than cookies), so they are not transmitted to our servers as cookies. They are set by VultPay (first-party) and persist until you clear them.

• vultpay_theme (local storage) - remembers your light or dark appearance preference.
• vultpay_lang (local storage) - remembers your language choice (English or Nigerian Pidgin).
• vultpay_buyer_contact_[link] (local storage) - on a checkout page, remembers the name, phone, and email you entered for that payment link so you do not have to retype them if you return. It stays on your device and is scoped to that payment link.

5. Analytics cookies (optional, consent-based)

With your consent, we use Google Analytics 4 to understand, in aggregate, how the product is used so we can improve it. Analytics is only present on builds where it is configured, and even then it loads only after you choose "Accept" on our cookie banner. Nothing is set for analytics before you make a choice, and choosing "Decline" means it never loads.

• _ga and _ga_[id] (cookies, set by Google) - distinguish devices and sessions so usage can be measured in aggregate. Google typically sets these to persist for up to two years unless you clear them.
• We harden analytics for a payments context: Google Signals and advertising / ad-personalisation features are turned off, IP addresses are anonymised, page addresses are scrubbed before they are sent (the payment-link token in a checkout address is masked and query strings are dropped, so secrets and personal data are not shared), and our internal staff tools are never included in analytics.
• We do not use analytics to advertise to you, to track you across other websites, or to make decisions about you as an individual.

6. Our position on third-party cookies

We take a restrictive position on third parties. We do not permit advertising networks, social media trackers, or cross-site tracking cookies on our site, and we do not sell or rent your data. The only third party we allow to set cookies through our own site is our analytics provider (Google), and only after you have consented and with advertising features disabled, as described above.

Separately, when you make or receive a payment you may be taken to, or interact with, pages operated by our payment and banking partners - for example our payment processor (Paystack) and our safeguarding / partner bank - and identity verification may involve our verification provider (Dojah). Those providers may set their own cookies on their own pages under their own cookie and privacy policies, which we do not control. We encourage you to review the relevant provider's policy when you are on their page.

We also use an error-monitoring service (Sentry) to detect and diagnose crashes so we can keep the service reliable. It is configured not to record session replays and not to collect IP addresses or cookies, and error addresses are scrubbed of secrets; it is a similar technology used for security and reliability, not a tracking cookie.

7. Legal basis and consent

Strictly necessary and functional cookies are used on the basis that they are needed to provide a service you have requested (and, where relevant, our legitimate interest in keeping the service secure and reliable); they do not require consent under the NDPA or, for EEA / UK visitors, the ePrivacy rules. Analytics cookies are used only on the basis of your consent, which is freely given, specific, and informed, and which you can withdraw at any time as easily as you gave it, without affecting the lawfulness of processing before withdrawal.

8. How long cookies and stored values last

Retention depends on the item. Session items last only while you are signed in or until you close the browser. Persistent items last for a set period or until you clear them: your consent choice and preferences remain until you remove them or change them, and analytics cookies set by Google typically persist for up to two years. Clearing your browser's site data for VultPay removes cookies and local-storage values held on your device.

9. Managing your cookie preferences

You are in control of optional cookies, and you can also manage all cookies through your browser.

• Cookie banner - when analytics is available, a banner appears on your first visit so you can Accept or Decline analytics. Declining leaves only strictly necessary and functional items in place.
• Change or withdraw consent - you can change your mind at any time. Clearing the stored consent choice (for example by clearing site data, or through the in-product privacy controls where available) brings the banner back so you can choose again. Withdrawing consent stops analytics from loading on your next visit.
• Browser controls - every major browser (Chrome, Safari, Firefox, Edge, and mobile browsers) lets you block or delete cookies and clear site storage in its settings, usually under Privacy or Site settings. Blocking or clearing data will also remove your saved preferences, so items such as your theme, language, or saved checkout details may reset.
• Global Privacy Control / Do Not Track - because we do not run advertising or cross-site tracking and load analytics only on your explicit consent, these signals do not change what we collect; if you have not consented, no analytics cookies are set regardless.
• Effect of declining or blocking - the service continues to work. Strictly necessary items remain because they are required to sign in and transact safely; only optional analytics is affected.

10. Children

VultPay is intended for adults (18 and over) and is not directed to children. We do not knowingly use cookies to collect data from anyone under 18.

11. Changes to this Cookie Policy

We may update this policy to reflect changes to our technologies, providers, or legal obligations. When we make a material change, we will update the version and effective date shown at the top and, where the change affects optional cookies, prompt you to review your choice again. Please check this page periodically.

12. Contact us

If you have questions about this Cookie Policy or how we use cookies, contact our Data Protection Officer at support@vultpay.co. You also have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC).