Cookie Policy

1. The short version

Vouchley uses a small number of strictly-necessary cookies and browser storage items to keep you signed in and to hold your cart between checkout steps. That’s it.

We do notcurrently use analytics, behavioural-tracking, advertising, or social-media cookies on any Vouchley surface. If we ever add cookies in those categories, we’ll ask for your consent first via a cookie banner.

Our cookie posture is GDPR-equivalent everywhere, even though Vouchley is an Australia-only B2B platform — opt-in for any non-essential cookie, applied globally. It costs us nothing to be strict here (we have no non-essential cookies today) and it protects you whether you visit us from Sydney, Singapore, or Stockholm.

2. What is a cookie, and what is browser storage?

A cookieis a small text file a website stores in your browser. The next time you visit the website, your browser sends the cookie back — so the website knows it’s the same browser as last time. That’s how sign-ins work, how shopping carts remember what you put in them, and (less helpfully) how third-party trackers follow people across the web.

Browser storage(localStorage, sessionStorage) is a related concept. It’s data your browser stores for a specific website. We treat browser storage the same way we treat cookies in this policy.

3. The cookies Vouchley sets today

Every cookie Vouchley sets at MVP is strictly necessary — without these the platform would not function (you could not sign in, your shopping cart would reset between pages). These do not require your consent under Australian or EU rules.

All Clerk cookies are HttpOnly, Secure, and SameSite=Lax— they can’t be read by JavaScript on other sites and they only travel over HTTPS.

Stripe Checkout cookiesare set on checkout.stripe.com when you pay a cash top-up, not on vouchley.com.au. Stripe’s own cookie policy applies there. We disclose this because Stripe is in our processing chain; we don’t and can’t set Stripe’s cookies ourselves.

4. What we do NOT use

We have audited our codebase. At MVP, Vouchley does not use:

• Analytics cookies — no PostHog, no Vercel Analytics, no Google Analytics, no Mixpanel, no Amplitude, no Hotjar, no FullStory.
• Advertising / marketing cookies — no Facebook Pixel, no Google Ads conversion pixel, no LinkedIn Insight Tag, no Google Tag Manager.
• Cross-site tracking — Vouchley does not participate in advertising networks or behavioural- profiling exchanges.
• Session replay or screen recording — we use Sentry for error monitoring, but Sentry session replay is not enabled. We see error stack traces, not your screen.

If we ever add a cookie in any of those four categories, we’ll show a cookie banner asking for your consent first, before the cookie is set. Until then, the banner is not shown — there’s nothing to consent to.

5. The four cookie categories (for when we add more)

The cookie infrastructure on Vouchley is built around four categories. At MVP only the first has any cookies in it; the other three are placeholders for if and when we add anything.

• Strictly necessary — required for the platform to work. Cannot be turned off (turning them off breaks sign-in and checkout). Listed in §3 above.
• Functional — would store preferences you set yourself (e.g. dashboard layout, theme, dismissed tooltips). None at MVP.
• Analytics — would let us understand which pages and features participants use, so we can improve the platform. None at MVP.
• Marketing — would support advertising or campaign-effectiveness measurement. None at MVP. (We may never add anything in this category — our growth model is direct sales + content, not paid advertising.)

6. Our consent posture

When we add any non-essential cookie, the banner will offer three primary actions with equal visual weight:

• Accept all— turn on every category you’ve been offered.
• Reject all — keep only strictly-necessary cookies; reject every category. Same number of clicks as Accept all. No fine print, no shrunken button.
• Customise — pick category-by-category.

No category will be pre-ticked. Closing the banner or pressing Escape will be treated as “Reject all”, not “Accept all”. You can change your mind at any time from the link in §7 below.

We record your choice in a first-party cookie (vouchley_cookie_consent_v1) and in our database (for evidence that consent was given, and to honour your choice across browsers when you’re signed in). Consent records are retained for 6 years as evidence under the Australian Privacy Act.

We’ll re-ask for your consent if:

• you clear your cookies;
• we materially change what we set (new categories, new providers);
• 12 months have passed since you last confirmed.

7. Managing your cookie preferences

You can revisit your cookie choices at any time using the button below — it opens the same preferences panel as the cookie banner, pre-loaded with your current choices. (At MVP there are no non-essential cookies to toggle, so opening it today shows the four categories with only strictly-necessary switched on. The moment we add anything, your saved choice is honoured here and across your devices when you’re signed in.)

You can also reach this panel from:

• the “Cookie preferences” link in the footer of every page;
• your account settings at /me/comms-preferences (signed-in users); or
• a link from the Privacy Policy.

While no non-essential cookies are in use (so the consent banner is dormant), you can also:

• Clear all Vouchley cookies via your browser settings. This will sign you out and reset your cart, but the platform will work again next time you sign in.
• Block all cookies in your browser. This will prevent you from signing in to the Vouchley platform (we need the auth cookie to know who you are) — the marketing site at vouchley.com.au will still work.

All major browsers (Chrome, Safari, Firefox, Edge) have cookie management in their Settings > Privacy section.

8. Mobile app

The Vouchley mobile app (when published) does not use cookies — it uses native secure storage instead. The same consent posture applies: nothing non-essential without your opt-in. We’ll publish a separate mobile-app data- handling note when the mobile app ships.

9. Changes to this Cookie Policy

If we change what cookies we set, we’ll update this page and (if the change is material — e.g. we add a new analytics provider, or change the category of an existing cookie) we’ll re-prompt you with the cookie banner so you can review your choices.

The current version is always available at vouchley.com.au/cookies. Previous versions are archived and available on request.

10. Related documents

• Privacy Policy — what personal information we collect and how we handle it
• Terms of Service — the agreement between you and Vouchley when you use the platform

11. Contact

Questions about cookies, browser storage, or this policy: privacy@vouchley.com.au.

The Vouchley platform is operated by Vouchley Pty Ltd (ACN 699 968 655) (ABN 75 699 968 655), an Australian proprietary company limited by shares. A postal address is available on request — email privacy@vouchley.com.au.

— Vouchley, Cookie Policy v1.0.2, 2026-07-31.