Cookie Policy
Version 2.0 | Effective: 7 July 2026 | FINTRAC MSB: C10001598
1. What Are Cookies
Cookies are small text files that are placed on your device (computer, tablet, or mobile phone) when you visit a website. They are widely used to make websites work efficiently, to keep users securely signed in, and to supply information to website operators.
Cookies may be set by the website you are visiting (“first-party cookies”) or by third parties whose services the website uses (“third-party cookies”). Cookies can be “session cookies” (which are deleted when you close your browser) or “persistent cookies” (which remain on your device for a set period or until you delete them). A cookie marked “HTTP-only” cannot be read by scripts running in your browser; it is transmitted only between your browser and our servers, which protects it against theft by malicious scripts.
Websites may also use related browser storage technologies — “local storage” (which persists until deleted) and “session storage” (which is cleared when the browser tab is closed). This Policy covers those technologies as well.
This Cookie Policy explains how Glacierpay Inc. (“Glacierpay”, “we”, “us”, or “our”), a corporation incorporated under the laws of the Province of Ontario, Canada, uses cookies and similar technologies on our website at glacier-pay.com (the “Website”), including the client portal. This Policy should be read in conjunction with our Privacy Policy.
2. How We Use Cookies
Glacierpay uses cookies on the Website for the following purposes only:
- Authentication and session management: To keep you securely signed in to the client portal as you navigate between pages, and to renew your session without requiring you to sign in again;
- Security: To protect the sign-in process against cross-site request forgery and interception (state and PKCE values), to hold proof that you have completed a two-factor authentication challenge before sensitive operations such as moving funds, and to automatically sign out inactive sessions;
- Account registration: To carry short-lived provisioning data between the steps of the account signup and email-verification flow;
- Preferences: To remember choices you make on your own device, such as language and display theme (stored in browser local storage, not cookies).
We do not use cookies for analytics, advertising, profiling or cross-site tracking. We do not sell or share cookie data with third parties for their own marketing purposes. Every cookie we set is a first-party cookie, set by Glacierpay itself.
3. Categories of Cookies We Use
Only two categories of first-party browser storage are in use on the Website: strictly necessary cookies and functional storage. No analytics, performance, marketing or advertising cookies are in use.
3.1 Strictly Necessary Cookies
These cookies are essential for the Website to function and cannot be switched off in our systems. They are set only in response to actions you take which amount to a request for services — signing in, completing two-factor authentication, or registering an account.
All of our strictly necessary cookies are HTTP-only (inaccessible to scripts running in your browser), are marked Secure on HTTPS connections, and are restricted to same-site requests (SameSite=Lax). They enable:
- Session management: Maintaining your authenticated session (identity and access tokens) and renewing it via a refresh token;
- Sign-in security: Protecting the sign-in redirect flow with anti-forgery state and PKCE code-verifier values that live for only five minutes and are deleted as soon as sign-in completes;
- Two-factor authentication: Recording, in a signed token, that you have passed a genuine second-factor challenge, which is required before sensitive operations;
- Registration: Carrying provisioning data for ten minutes between the signup and email-verification steps.
These cookies do not require your consent, as they are strictly necessary for the provision of the service you have requested. You can set your browser to block them, but you will not be able to sign in or use the client portal.
3.2 Functional Storage
Glacierpay does not currently set any functional cookies. A small number of functional preferences — your preferred language, display theme, and certain client-portal interface settings — are stored in your browser's local storage on your own device (see Section 5). These values never leave your device as part of a tracking mechanism and are not used to identify you across other websites.
3.3 Analytics, Marketing & Advertising Cookies — Not Used
Glacierpay does not use any analytics, performance-measurement, marketing or advertising cookies, and does not load Google Analytics or any comparable third-party analytics or advertising script on the Website. No cookie set by the Website tracks you across other websites.
If we ever introduce analytics or marketing cookies in the future, they will be deployed only after your prior opt-in consent has been obtained through our cookie banner, and this Policy will be updated first to describe them.
4. Cookie Table
The following table is a complete inventory of the cookies set by the Glacierpay Website. All are first-party cookies set by Glacierpay, all are HTTP-only, and all are strictly necessary.
| Cookie Name | Provider | Purpose | Duration | Type |
|---|---|---|---|---|
| gp_id | Glacierpay (First Party) | Identity token for your authenticated session | 1 hour | Strictly Necessary (HTTP-only) |
| gp_at | Glacierpay (First Party) | Access token used to authorise your requests to our services | 1 hour | Strictly Necessary (HTTP-only) |
| gp_rt | Glacierpay (First Party) | Refresh token that renews your session without requiring you to sign in again | 30 days | Strictly Necessary (HTTP-only) |
| gp_2fa | Glacierpay (First Party) | Signed proof that you have passed a two-factor authentication challenge; required before sensitive operations such as withdrawals | 12 hours | Strictly Necessary (HTTP-only) |
| gp_oauth_state | Glacierpay (First Party) | Anti-forgery (CSRF) protection for the sign-in redirect flow | 5 minutes; deleted when sign-in completes | Strictly Necessary (HTTP-only) |
| gp_oauth_pkce | Glacierpay (First Party) | PKCE code verifier that protects the sign-in code exchange against interception | 5 minutes; deleted when sign-in completes | Strictly Necessary (HTTP-only) |
| gp_oauth_next | Glacierpay (First Party) | Remembers the page you were trying to reach so you can be returned to it after sign-in (restricted to same-origin paths) | 5 minutes; deleted when sign-in completes | Strictly Necessary (HTTP-only) |
| gp_onboarding_provision | Glacierpay (First Party) | Carries account-provisioning data (your company name) between the signup and email-verification steps of registration | 10 minutes | Strictly Necessary (HTTP-only) |
All authentication cookies are deleted when you sign out. No other cookies are set by the Website.
5. Local Storage & Session Storage
In addition to cookies, the Website uses browser storage. Local storage persists until you delete it; session storage is automatically cleared when you close the browser tab. These values are stored on your own device.
| Key | Storage | Purpose | Duration | Type |
|---|---|---|---|---|
| glacier-cookie-consent | Local storage | Records your choice on the cookie consent banner (“all” or “essential”) together with the date of your choice | Until you delete it | Strictly Necessary (consent record) |
| gp-lang | Local storage | Remembers your preferred display language | Until you delete it | Functional |
| gp-theme | Local storage | Remembers your preferred display theme | Until you delete it | Functional |
| gp_last_activity | Local storage | Synchronises the inactivity timer across open portal tabs so idle sessions are signed out automatically | Until you delete it | Strictly Necessary (security) |
| Client-portal interface preferences | Local storage | Remembers interface preferences you set inside the client portal (for example, chart layout settings) | Until you delete them | Functional |
| Temporary registration and verification values | Session storage | Temporary session values required to complete registration and identity verification, and short-lived interface state | Until the browser tab is closed | Strictly Necessary |
None of these values is used for analytics, advertising or cross-site tracking.
6. Managing Your Cookies
Because every cookie we set is strictly necessary for the operation of the Website, blocking them will prevent you from signing in or registering. You nevertheless remain in full control of your browser:
Most web browsers allow you to control cookies and site data through their settings. You can set your browser to block all cookies, block third-party cookies, delete cookies when you close your browser, and clear local and session storage.
Instructions for managing cookies in common browsers:
- Google Chrome:Settings → Privacy and Security → Cookies and other site data
- Mozilla Firefox:Settings → Privacy & Security → Cookies and Site Data
- Apple Safari:Preferences → Privacy → Manage Website Data
- Microsoft Edge:Settings → Cookies and site permissions → Manage and delete cookies and site data
Clearing the Website's site data will delete your consent record, sign you out, and cause the cookie banner to be shown again on your next visit.
7. Consent Mechanism
Our consent mechanism operates as follows:
- Cookie banner:On your first visit to the Website, a clearly visible cookie consent banner is presented. It offers two choices — “Accept All” or “Essential Only” — together with a “Cookie Details” panel describing the storage categories and a link to this Policy;
- No pre-ticked boxes:Nothing is selected by default. The banner requires your affirmative action, and no non-essential cookie or script is loaded before — or after — you make your choice, because none exists on the Website today;
- Essential-only option:Choosing “Essential Only” is as easy as choosing “Accept All” and does not degrade your experience in any way. Because Glacierpay currently sets no non-essential cookies, both choices result in exactly the same cookies being used today; your recorded choice will govern any non-essential cookies we may introduce in the future;
- Consent record:Your choice is recorded, together with the date you made it, in the “glacier-cookie-consent” entry in your browser's local storage (see Section 5). It is stored on your device only;
- Withdrawing or changing your consent:The Website does not currently provide an in-page control for re-opening the banner after a choice has been made. You may withdraw or change your consent at any time by clearing the Website's site data in your browser (which deletes the consent record and causes the banner to be shown again on your next visit), or by contacting us at [email protected].
8. Third-Party Technologies
Glacierpay does not load third-party analytics, advertising or social-media scripts on the Website. One third-party technology may set its own cookies in the course of using our services:
8.1 Sumsub Identity Verification
As part of our regulatory obligations under Canadian anti-money laundering legislation, we use the Sumsub identity-verification service during client onboarding. When you complete identity verification through the Sumsub WebSDK, Sumsub may set its own cookies on your device for the purposes of:
- Managing the verification session;
- Preventing fraud during the identity-verification process;
- Ensuring the security and integrity of submitted documents.
These cookies are strictly necessary for the identity-verification service and are set only when you use it. Sumsub acts as our service provider; for further information about its practices, please refer to Sumsub's own privacy and cookie notices, and to the “recipients” section of our Privacy Policy.
9. Do Not Track & Global Privacy Control
Some web browsers transmit “Do Not Track” (“DNT”) signals or “Global Privacy Control” (“GPC”) signals to the websites you visit, indicating a preference not to be tracked or not to have personal information sold or shared.
Because Glacierpay sets no analytics, advertising or cross-site tracking cookies for any visitor, the Website already behaves in the manner these signals request, regardless of whether your browser sends them. We therefore do not vary the Website's behaviour in response to DNT or GPC signals: there is no tracking to switch off. Should we ever introduce non-essential cookies, we will assess at that time how DNT and GPC signals are honoured and update this Policy accordingly.
10. Legal Frameworks
This Policy is designed to satisfy the transparency and consent requirements of the laws applicable to our use of cookies and similar technologies:
- Canada — PIPEDA: The Personal Information Protection and Electronic Documents Act requires meaningful consent to the collection and use of personal information. Our strictly necessary cookies are used only to deliver services you have requested, and our banner records your express choice;
- Quebec — Law 25: The Act respecting the protection of personal information in the private sector, as amended, requires that technologies which allow a person to be identified, located or profiled are activated only with consent. We use no such tracking, profiling or location technology; the parameters described in this Policy reflect the highest level of confidentiality by default;
- EEA — ePrivacy Directive and GDPR: For visitors from the European Economic Area, Directive 2002/58/EC (as implemented in member-state law) permits cookies that are strictly necessary for a service explicitly requested by the user without consent; all other cookies require prior consent. All of our cookies fall within the strictly necessary exemption, and any personal data processed through them is handled in accordance with Regulation (EU) 2016/679 (GDPR) as described in our Privacy Policy;
- United Kingdom — PECR and UK GDPR: The Privacy and Electronic Communications Regulations 2003 apply the same strictly-necessary exemption and prior-consent rule for visitors from the United Kingdom.
Glacierpay provides services to business clients only. Where clients in the EEA or the United Kingdom access our services, they do so exclusively at their own initiative; this does not change the cookie practices described in this Policy.
11. Changes to This Policy
Glacierpay will update this Cookie Policy whenever our use of cookies or similar technologies changes, and otherwise as required by changes in technology or applicable law. When we make material changes:
- The revised Policy will be published on the Website with an updated Effective Date and version number;
- We will notify you of material changes via a prominent notice on the Website or, where appropriate, via email;
- Where changes involve the introduction of new cookie categories — in particular any analytics or marketing cookies — this Policy will be updated first and your prior opt-in consent will be obtained via the cookie banner before any such cookie is placed on your device;
- Continued use of the Website after the effective date of any changes constitutes acceptance of the updated Policy, save that non-essential cookies will never be deployed on the basis of continued use alone.
We encourage you to review this Policy periodically to stay informed about how we use cookies.
12. Contact
If you have any questions, concerns, or requests regarding this Cookie Policy or our use of cookies — including a request to withdraw consent — please contact us:
| Contact Method | Details |
|---|---|
| [email protected] | |
| Company | Glacierpay Inc. |
| Address | 320 Matheson Blvd West, Suite 211, Mississauga, Ontario, L5R 0H2, Canada |
| Jurisdiction | Ontario, Canada |
| Website | glacier-pay.com |
We will respond to your enquiry within a reasonable timeframe and in accordance with applicable data protection legislation.