Cookie policy

In effect from 16 September 2026

Kartaak sets a few cookies that the site cannot work without, and, only if you agree, cookies from Google and TikTok that help us see how people use our website and whether our ads work.

Where optional cookies can be used

Only on our public pages: the home page, these policies and the sign-in page. They are never used inside a shop’s dashboard, on a loyalty card, on the sign-up page behind a shop’s counter code, or on the scanner. Those pages carry a security policy that stops the browser loading either company’s tags at all, so this does not depend on anybody remembering.

Necessary cookies

These are set by Kartaak itself and are needed for the site to work.

kartaak_dashboard

Keeps a shop owner or a member of staff signed in. Lasts 30 days for an owner, and 12 hours for a cashier who signed in at the till with a PIN. It cannot be read by scripts on the page.

kartaak_admin

Keeps Kartaak staff signed into our support console. Lasts 12 hours, and is only ever sent back to this site.

kartaak_device

Marks a tablet at a shop’s counter as a till the shop enrolled, so cashiers can sign in with a PIN. Set only on a device somebody deliberately enrolled. Lasts a year, and stops working the moment the shop removes that till.

kartaak_cards

Remembers which loyalty cards this phone already holds, so scanning a shop’s counter code goes straight to your card instead of asking for your number again. It holds card references and nothing else, cannot be read by scripts on the page, and lasts a year.

kartaak_consent

Remembers what you chose about optional cookies, so we do not ask on every page. Holds your choice, when you made it, and a random reference. Lasts six months, after which we ask again.

Optional cookies, only if you agree

These come from Google and TikTok, through Google Tag Manager. Tag Manager itself sets no cookies on our site; it loads the tags that do, and only after you agree. The durations below are those companies’ own defaults.

Analytics

_ga

Set by Google Analytics to tell one visitor from another, so we can count visitors and see how people move through the site. Lasts two years.

_ga_ followed by an identifier

Set by Google Analytics to keep track of a visit as it happens. Lasts two years.

Advertising

_gcl_au

Set by Google’s advertising tags to connect a visit to the ad that brought it, so we can tell whether an ad led to a sign-up. Lasts 90 days.

_ttp

Set by the TikTok pixel to give your browser an identifier, so TikTok can tell whether one of our ads led to a sign-up. Lasts 13 months.

_tt_enable_cookie, and other cookies beginning with tt

Set by the TikTok pixel to check that your browser accepts its cookies, and to follow a single visit. Some last 13 months, others only until you close the tab.

Google’s own advertising cookies

If you allow advertising, Google may also use cookies on its own domains, such as google.com and doubleclick.net, to show our ads to people who have visited us. Those cookies belong to Google, and we cannot see or remove them.

How Google uses this information is explained on how Google uses information from sites that use its services and in Google’s privacy policy. What TikTok does with what its pixel collects is set out in TikTok’s privacy policy.

What we never do

• Send Google your name, email address, phone number, or anything you type into a form.
• Load tags from any company other than Google and TikTok. If that changes, it is named here first.
• Make the site depend on your answer. Refusing costs you nothing.
• Sell browsing information, or share it for anybody else’s marketing.

Changing your mind

Use Cookie settings, at the bottom of every page on our website. If you withdraw something you allowed, we stop the tags, delete the Google and TikTok cookies set on our own domain, and reload the page without them. That matters most for TikTok, whose cookies last 13 months. Cookies Google or TikTok set on their own domains can only be cleared from your browser settings, or from your account with them.

The record we keep of your choice

So that we can show we asked and did what you said, we keep a record of each choice: the random reference from your consent cookie, what you allowed, which version of the choice you saw, and when. It does not include your IP address or anything else that identifies you, and it is deleted after two years.

Blocking cookies in your browser

You can block or delete cookies in your browser settings. Blocking the optional ones changes nothing about how the site works. Blocking the necessary ones will stop signing in, and returning to your card, from working.

Questions

Write to saeed@kartaak.com. What we do with personal data more broadly is set out in the privacy policy.