Cookie Policy

1.1 A cookie is a small text file that a website asks your browser to keep and to send back on later visits. Browsers also offer other storage, such as local storage, that works in a similar way and that we cover in this policy under the same word.

1.2 A session cookie is deleted when you close your browser or after a fixed time. A persistent cookie stays until it expires or you delete it. A first-party item is set by the site you are on. A third-party item is set by another organisation.

1.3 This policy should be read with the Privacy Policy, which explains how we handle personal information.

2.1 Everything we set is either strictly necessary for the service to work, or a preference that remembers a display choice you made. There are no other categories.

2.2 We do not use cookies or similar technologies for analytics, for measuring or profiling your behaviour, for advertising, for retargeting or for conversion tracking. We do not load advertising or analytics scripts, tracking pixels or social media plug-ins.

2.3 We do not set third-party cookies on THEMIS pages.

2.4 If we ever add something outside those two categories, we will ask for your consent first, update this page and show the date.

The law does not require consent for cookies that are strictly necessary to provide a service that you have asked for, such as keeping you signed in. Our preference items are used only to remember a choice you made in the interface, on your own device, and are never sent to us. Because we set nothing else, there is no cookie banner. If that changes, a banner will appear and nothing outside the necessary items will be set until you agree.

The tables below list every cookie and storage item the service sets. All of them are first-party and none is used for tracking.

Cookies:

• themis_session. Type: cookie, first-party. Purpose: keeps you signed in. It holds a signed identifier that cannot be altered, and is HTTP-only so that scripts in the page cannot read it, and secure so that it is sent only over an encrypted connection. Duration: up to ten hours. Category: strictly necessary.
• sh_ followed by a short code. Type: cookie, first-party, limited to the shared-document pages. Purpose: remembers that you have entered the access code for a document that someone shared with you, so that you do not have to enter it for every file. Duration: one hour. Category: strictly necessary. Set only if you enter an access code.

Browser storage (local storage), which stays on your device and is not sent to us:

• themis.theme. Purpose: remembers whether you chose the light or the dark display. Duration: until you clear it. Category: preference.
• themis.rail. Purpose: remembers whether you made the side menu narrow or wide. Duration: until you clear it. Category: preference.
• themis.menu. Purpose: remembers which groups in the side menu you opened. Duration: until you clear it. Category: preference.
• themis.shell.dismissed and themis.ribbon. Purpose: remember that you closed a banner or prompt, so that it does not return on every page. Duration: until you clear it. Category: preference.
• review.hidden followed by an identifier. Purpose: remembers which columns you hid in a tabular review. Duration: until you clear it. Category: preference.

The links we send to clients, signers and guests carry a token in the address. A token is not stored on your device. It identifies the one workspace or document the link was made for.

5.1 Some features send you to another organisation's page, such as the payment page for a subscription or the page where an identity check is completed. That organisation sets its own cookies on its own pages under its own policy, and we do not control them. We name the providers on the Sub-processors page.

5.2 The website's typeface is delivered from our own servers. If you choose a Google font in the document editor, or open a document that already uses one, your browser asks Google's font service for that font file, and Google receives your IP address and the font requested as a result. Nothing else is shared, and no cookie is set by us for it.

6.1 Cookie settings. The Cookie settings page lets you see the items stored in your browser and clear the display preferences with one button. It does not need to switch anything off, because nothing optional is used.

6.2 Your browser. Every browser lets you block or delete cookies and local storage, block third-party cookies, and clear them when you close the browser. Instructions are in your browser's help pages. If you block the session cookie you will not be able to sign in. If you clear local storage, your display preferences reset.

6.3 Signals. Because we do not track you, there is nothing for a Do Not Track or Global Privacy Control signal to switch off. We respect them in any case.

The cookies and storage in this policy do not send personal information anywhere. The session cookie is sent to our servers in Ireland with each request you make so that we know who you are. The Privacy Policy and the Data Processing Agreement explain how information in your account is handled and transferred.

We will update this policy if we change what we set, and we will show the date at the top. If a change would add anything beyond strictly necessary items and display preferences, we will ask for your consent first.

You can reach us at privacy@olympuspay.co for data protection matters, legal@olympuspay.co for legal notices, and support@olympuspay.co for help. Our address for notices is 1111B S Governors Ave, STE 25834, Dover, DE 19904, USA. A written notice sent to that address, or an email to legal@olympuspay.co, is treated as delivered when received.