REVIENT COOKIE POLICY AND COOKIE CONTROLS
Version: 1.0
Effective date: (EFFECTIVE DATE)
Last updated: (LAST UPDATED DATE)
This Cookie Policy explains how (COMPANY LEGAL NAME) LIMITED, trading as Revient (Revient, we, us, our), uses cookies and similar storage and access technologies on (WEBSITE URL) and within the Revient application.
Privacy email: (PRIVACY EMAIL)
Cookie settings: (COOKIE SETTINGS URL OR IN-APP CONTROL)
1. What this Policy covers
This Policy covers technologies that store information on, or access information from, a browser, computer, mobile device or other terminal equipment. These technologies may include:
- HTTP cookies;
- local storage and session storage;
- pixels and tracking tags;
- scripts and software development kits;
- device or browser identifiers;
- link or navigational measurement technologies; and
- other technologies that perform a comparable storage or access function.
Where use of one of these technologies also involves personal information, the Revient Privacy Notice also applies.
2. What cookies are
Cookies are small files or pieces of information that a website or application can store in a browser or device. Cookies can be used to keep a user signed in, secure a session, remember settings, understand how a service is used, or support other functionality.
Some cookies last only for the browser session. Others remain for a defined period or until removed.
3. First-party and third-party technologies
A first-party cookie or storage technology is set or controlled by Revient's domain or application.
A third-party technology is provided by another organisation and may be used, for example, for authentication, payments, service monitoring, analytics or other functionality.
The actual providers and technologies used by Revient are listed in the Cookie Register below.
4. Our categories
Revient groups storage and access technologies into the following categories.
Strictly necessary
These technologies are necessary to provide a service you request, transmit communications, keep Revient secure or perform other functionality that cannot reasonably operate without the technology.
Examples can include authentication, session management, fraud/security controls, load balancing and storing the user's cookie choice.
Where an applicable exception permits these technologies without consent, they may operate automatically. They cannot be disabled through Revient's preference centre if disabling them would prevent the requested service from functioning, although a user may be able to remove them using browser controls and may then be unable to use part of the Service.
Preferences and appearance
These technologies remember choices or adapt the way Revient appears or functions, such as theme, interface preferences, language, density or similar settings.
Where Revient relies on a legal exception for a technology used solely to adapt appearance or functionality to the user's preference, Revient will provide clear information and a simple, free way to object. Where the exception does not apply, Revient will obtain consent before using the technology.
Analytics and statistics
These technologies help Revient understand aggregate use of the website or application, diagnose performance issues and improve the Service.
Some narrowly configured technologies used solely to collect aggregate statistical information for service improvement may qualify for an exception from consent where the legal conditions are satisfied, including providing clear information and a simple, free way to object.
Analytics that identify, track or profile individual visitors, link activity to advertising, perform cross-service tracking or otherwise fall outside an applicable exception will not be used before required consent is obtained.
Marketing and advertising
These technologies may be used to measure advertising, build advertising audiences, personalise advertising or track users for advertising purposes.
Revient will not activate marketing or advertising storage/access technologies that require consent unless the user has made the required choice.
5. Cookie and storage register
This draft register records the current application's cookie definitions. Browser verification for each connected-provider journey remains part of testing. Legal classification and any production exception or consent decision still require review. The optional controls described later are proposed controls, not a claim that a consent-management interface is already deployed.
| Name / key | Provider | Purpose | Category | Duration | First / third party | Consent or objection status |
|---|---|---|---|---|---|---|
| oweflow_merchant_session | Revient | Merchant sign-in | Session security | Up to 30 days; 12-hour idle timeout | First party | Classification pending final legal review |
| oweflow_partner_session | Revient | Partner sign-in | Session security | Up to 14 days; 12-hour idle timeout | First party | Classification pending final legal review |
| oweflow_staff_session | Revient | Staff sign-in | Session security | Up to 1 day; 1-hour idle timeout | First party | Classification pending final legal review |
| oweflow_prefs_merchant / oweflow_prefs_partner / oweflow_prefs_internal | Revient | Realm-specific appearance and interface preferences | Preferences / appearance | Up to 365 days | First party | User-requested preferences; production exception/objection decision unresolved |
| oweflow_connect_return | Revient | Return to the correct onboarding step after connection | Connection handoff | 15 minutes | First party | Classification pending final legal review |
| oweflow_shopify_app | Revient | Encrypted merchant-app OAuth handoff and state | Connection security | 10 minutes | First party | Only during merchant-specific Shopify OAuth |
| oweflow_squarespace_state | Revient | Bind Squarespace OAuth to the initiating merchant | Connection security | 10 minutes | First party | Only during Squarespace OAuth |
| oweflow_staff_invitation | Revient | Carry a retryable staff invitation securely | Invitation security | 15 minutes | First party | Only during invitation acceptance retry |
| oweflow_webhook_reveal | Revient | One-time display of a newly issued outbound-webhook secret | Security | 120 seconds | First party | Scoped to its endpoint page; unrelated to inbound store webhooks |
| Optional analytics / marketing | None enabled by this integration change | Not active in this testing implementation | Optional | Not applicable | Not applicable | Re-audit before enabling any provider |
| Legacy oweflow_accent / oweflow_mode | Revient | Earlier appearance settings | Legacy preferences | Definitions specify 365 days | First party | Legacy definitions exist; no current page invokes the old setters |
The cookie-choice record, preference-centre URL, external error/performance tooling and any additional production browser storage remain unresolved pending the production audit. They are not listed as active technologies. Google, Microsoft, Shopify, Squarespace and Stripe pages may set their own cookies during provider-hosted flows; their policies govern those pages.
The Cookie Register must reflect the actual production website and application. Revient will not intentionally list a technology as active if it is not deployed.
6. Strictly necessary technologies
Strictly necessary technologies may be used without an optional consent choice where applicable law permits this because the technology is essential to provide a service requested by the user or for another applicable exempt purpose.
They may be used for functions such as:
- keeping a user signed in;
- maintaining a secure session;
- preventing cross-site request forgery or abuse;
- authenticating requests;
- maintaining service availability or load balancing;
- preserving a user's privacy choices; and
- other functionality genuinely required to provide the requested service securely.
Revient will not classify a technology as strictly necessary merely because it is commercially useful or convenient to Revient.
7. Preferences and appearance choices
Revient may store settings such as:
- light, dark or system theme;
- accent or application appearance preferences;
- interface density;
- sidebar preferences;
- language or locale; and
- similar user-requested interface choices.
Where an applicable appearance/functionality exception is relied upon, users will be given a simple way to object or reset the preference. Where consent is required instead, the preference technology will not be used until the relevant choice is made.
8. Analytics and statistics
Revient may use analytics to understand matters such as:
- overall visitor numbers;
- pages or application areas used;
- aggregate user journeys;
- device or browser categories;
- page-loading or application-performance information; and
- aggregate interaction metrics used to improve Revient.
If Revient relies on a statistical-purpose exception rather than consent, the relevant technology will be configured so that its sole purpose is aggregate statistical information used to improve the Revient service or website, it will not be used for advertising or individual profiling, and users will be provided a simple, free means to object.
Where analytics goes beyond those conditions, Revient will obtain consent before activating the technology where required.
9. Marketing and advertising technologies
If Revient introduces advertising pixels or marketing technologies, the Cookie Register will identify the technology, provider, purpose and duration.
Revient will not use a consent-required advertising or behavioural-tracking technology before the relevant consent is obtained.
Rejecting marketing cookies will not prevent a user from creating or using a Revient Account where the Service can operate without those cookies.
10. Authentication and payment providers
Connecting to authentication, commerce, Google, Microsoft or Stripe services may involve the provider setting its own cookies or storage technologies on the provider's pages or embedded components.
Where a user is redirected to a third-party provider, that provider's own cookie and privacy terms apply to its pages and services. Revient's Cookie Register covers technologies Revient controls or causes to operate within Revient's own website/application where disclosure is required.
11. Consent and choices
Where consent is required, Revient will ask for a clear affirmative choice before activating the relevant technology.
Continuing to browse, silence, inactivity or a pre-ticked control will not by itself be treated as consent to a consent-required technology.
Users can choose by category through Revient's cookie banner or preference centre.
12. Objecting where Revient relies on an exception
Where Revient relies on a legal exception for statistical-purpose or appearance/functionality technologies that requires a simple means of objecting, Revient will make that control available free of charge.
An objection will stop future storage or access for the objected purpose on the relevant browser/device, subject to strictly necessary technologies and technical steps required to record the objection itself.
13. Withdrawing or changing a choice
You can change your cookie/storage choices at any time through:
Cookie settings: (COOKIE SETTINGS URL OR IN-APP CONTROL)
Where a technology was based on consent, withdrawing consent affects future use and does not make prior processing unlawful where it was lawful at the time.
Revient will take reasonable steps to stop future activation of the affected technologies after a withdrawal or objection is recorded.
14. Browser and device controls
Most browsers allow users to delete or block cookies and site storage. Browser settings can also affect scripts, local storage or other technologies.
Blocking strictly necessary technologies may prevent sign-in or other requested Revient functionality from working correctly.
Browser controls are additional to Revient's own preference controls and do not replace them where Revient is legally required to provide an in-service choice.
15. Global Privacy Control and similar signals
Where Revient is subject to a law requiring recognition of a valid browser-based opt-out signal, such as Global Privacy Control for qualifying sale or sharing under applicable California law, Revient will process that signal as required.
A browser privacy signal does not necessarily constitute consent or withdrawal for every cookie purpose in every jurisdiction. Revient will apply the signal according to the law that gives it effect.
16. Retention of cookie choices
Revient may retain the user's cookie/storage preference record for (COOKIE CHOICE RECORD RETENTION PERIOD) so that Revient can remember and evidence the choice.
Revient may request a fresh choice after (CONSENT / PREFERENCE REFRESH PERIOD), after a material change in technologies or purposes, when the stored choice is no longer available, or where required by law.
17. Changes to this Cookie Policy
Revient may update this Policy when technologies, providers, purposes or applicable requirements change.
The current version and effective date will be shown at the top. Where a material change requires a new consent or choice, Revient will present that choice before using the affected technology where required.
18. Contact
Questions about cookies, storage technologies or choices can be sent to:
Revient / (COMPANY LEGAL NAME) LIMITED
Privacy email: (PRIVACY EMAIL)
Registered office: (REGISTERED OFFICE ADDRESS)
Cookie settings: (COOKIE SETTINGS URL OR IN-APP CONTROL)
COOKIE BANNER AND PREFERENCE-CENTRE SPECIFICATION
The following section describes the user-facing controls Revient uses to implement the choices described above. It forms part of this Cookie Policy.
19. First-layer banner
Heading
Your privacy choices
Text
We use essential technologies to operate and secure Revient. With your permission, we may also use optional analytics, preference or other technologies to understand and improve the service. You can accept all optional technologies, reject non-essential technologies, or choose your preferences. You can change your choice later from Cookie settings.
First-layer controls
The banner must provide the following controls without requiring the user to open a second screen to reject consent-required optional technologies:
- Accept all
- Reject non-essential
- Manage preferences
The design must not make Reject non-essential materially harder to find or use than Accept all.
20. Default state
Before the user has made a choice:
- strictly necessary technologies may operate where legally permitted;
- consent-required analytics must be off;
- consent-required marketing/advertising must be off;
- other consent-required optional technologies must be off; and
- a statistical-purpose or appearance technology may be on without consent only where Revient has documented that the relevant legal exception applies and the user has a simple, free means to object.
No consent-required category may be pre-ticked or treated as accepted merely because the user continues using the website.
21. Manage preferences screen
The preference centre must show categories separately.
Strictly necessary
Always active where required to provide and secure the service.
No misleading toggle should imply that a user can disable a technology through Revient if doing so would prevent the requested service from functioning.
Preferences / appearance
Used to remember choices such as theme or interface settings.
The control state must match whether the technology is based on consent or a lawful exception with a right to object.
Analytics / statistics
Used to understand how Revient is used and improve performance.
The control must distinguish consent-based analytics from any narrowly configured statistical-purpose technology Revient lawfully operates subject to an objection rather than consent.
Marketing / advertising
Used for advertising or advertising measurement where enabled.
Default: Off until valid consent where consent is required.
Buttons
- Save preferences
- Accept all
- Reject non-essential
22. Effect of “Reject non-essential”
Selecting Reject non-essential must:
- keep strictly necessary technologies active where appropriate;
- withhold or withdraw consent for consent-required optional categories; and
- record an objection to statistical-purpose or appearance technologies where Revient has chosen to include those objection-based purposes within the same control.
The resulting behaviour must match the wording displayed to the user.
23. Effect of “Accept all”
Selecting Accept all may activate all disclosed optional categories for which consent is requested and may indicate no objection to disclosed exception-based statistical/appearance purposes, subject to the exact wording shown at the time.
Revient must not use Accept all to authorise a purpose not disclosed in the banner or preference centre.
24. Persistent access to settings
A Cookie settings link or control must remain available from the public-site footer and, where appropriate, from Account or privacy settings so that users can change their choice later.
25. Consent and choice record
Revient should record sufficient information to demonstrate the user's choice, including where appropriate:
- consent/preference version;
- categories selected;
- whether an objection was recorded;
- date and time;
- jurisdiction or locale where needed to apply the correct control model; and
- a pseudonymous browser/device identifier where reasonably necessary to remember the choice.
Revient should not collect unnecessary personal information merely to prove a cookie choice.
26. Script and tag enforcement
The consent-management implementation must prevent consent-required scripts, pixels, tags and SDKs from firing before the relevant consent state permits them.
A visual banner without corresponding technical blocking is not sufficient.
On withdrawal, Revient must stop future activation of affected technologies. Where technically possible and appropriate, Revient should also remove first-party optional cookies/storage set by Revient for the withdrawn purpose.
27. New technologies
A new production cookie, SDK, pixel, local-storage key or similar technology must not be deployed without:
- identifying its purpose;
- assigning a category;
- determining whether consent, an objection mechanism or another exception applies;
- recording its provider and duration;
- updating this Cookie Register where required; and
- verifying that the consent manager enforces the correct state.