Cookies

This page lists everything merchantcure.com stores in your browser. It is short, because there is not much.

What is active right now

Nothing, if you are reading. No analytics tag and no advertising tag are configured on this site at the moment, so browsing merchantcure.com sets no cookies and no consent banner appears. When that changes, this page changes with it and the date at the top moves.

Signing in sets one. The customer application at app.merchantcure.com sets a session cookie when you log in, and only then. It is a necessary function rather than a choice, and it is described below.

The four things that can exist

1. The session cookie, when you sign in

Name mc_session. Set by the customer application at app.merchantcure.com, only at the moment you sign in — never by browsing the marketing site, and never before you have a login link in your hand.

It is a strictly necessary cookie: without it, being signed in is not a thing a browser can remember, and there is no consent to ask for because there is no alternative that still delivers what you asked for.

It is signed, and it carries your user id and an expiry — nothing else. There is no server-side session record, which has one consequence we would rather write down than leave you to discover: it cannot be revoked before it expires. Signing out stops your browser sending it, but a copy of the string would keep working until it lapses. The counterweight is a short life: 14 days, after which it stops working on its own.

The same limitation is stated on the privacy page and in your account.

2. Your consent choice

Stored in your browser's local storage under mc-consent, holding one word: either granted or denied. It is not a cookie, it is never sent to our server, and it exists only so we do not ask you the same question on every page.

To change your answer, clear site data for merchantcure.com in your browser and the question comes back.

3. Cloudflare Web Analytics

Counts page views. It sets no cookie and stores no identifier, which is why it needs no consent and why we chose it over the alternatives. It cannot follow you to another site.

4. Google Ads conversion measurement

This one does set cookies, and it is the only reason a consent banner exists. It tells us whether someone who clicked an ad went on to send a scan request. It is never loaded until you actively accept it.

Before you answer, Google Consent Mode is set to denied for every category on this site — advertising storage, user data, ad personalisation and analytics storage. That is the starting state, not something applied after you decline.

Paying happens on Stripe's own page

When you buy, you are sent to Stripe’s payment page and come back afterwards. We do not embed Stripe’s scripts, so no Stripe cookies are set on our domain — and no card details reach us at any point.

What happens while you are on Stripe’s page is covered by Stripe’s own cookie and privacy policies, not by this one. We cannot speak for them and do not try to.

What we do not use

• No third-party trackers or advertising pixels other than the one above.
• No social media embeds, and no share buttons that phone home.
• No session recording, no heatmaps, no scroll tracking.
• No external fonts or scripts from a CDN. This site’s content security policy names the permitted hosts explicitly, so a tag added by accident fails instead of quietly collecting data. It lists no payment hosts, which is correct: the checkout is not on this site.

Declining costs you nothing

Every page, the Quick Scan form and everything you can read work identically whether you accept or decline. The two buttons on the banner are the same size and the same weight, on purpose. A consent you were nudged into is not a consent.

Questions

Email hello@merchantcure.com. See also Privacy.