Cookie Policy
Version 2.0 | Effective: 7 July 2026 | FINTRAC MSB: C10001598
1. What Are Cookies
Cookies are small text files that are placed on your device (computer, tablet, or mobile phone) when you visit a website. They are widely used to make websites work efficiently, to keep users securely signed in, and to supply information to website operators.
Cookies may be set by the website you are visiting (“first-party cookies”) or by third parties whose services the website uses (“third-party cookies”). Cookies can be “session cookies” (which are deleted when you close your browser) or “persistent cookies” (which remain on your device for a set period or until you delete them). A cookie marked “HTTP-only” cannot be read by scripts running in your browser; it is transmitted only between your browser and our servers, which protects it against theft by malicious scripts.
Websites may also use related browser storage technologies — “local storage” (which persists until deleted) and “session storage” (which is cleared when the browser tab is closed). This Policy covers those technologies as well.
This Cookie Policy explains how Glacierpay Inc. (“Glacierpay”, “we”, “us”, or “our”), a corporation incorporated under the laws of the Province of Ontario, Canada, uses cookies and similar technologies on our website at glacier-pay.com (the “Website”), including the client portal. This Policy should be read in conjunction with our Privacy Policy.
2. How We Use Cookies
Glacierpay uses cookies on the Website for the following purposes only:
- Authentication and session management: To keep you securely signed in to the client portal as you navigate between pages, and to renew your session without requiring you to sign in again;
- Security: To protect the sign-in process against cross-site request forgery and interception (state and PKCE values), to hold proof that you have completed a two-factor authentication challenge before sensitive operations such as moving funds, and to automatically sign out inactive sessions;
- Account registration: To carry short-lived provisioning data between the steps of the account signup and email-verification flow;
- Preferences: To remember choices you make on your own device, such as language and display theme (stored in browser local storage, not cookies);
- Analytics and conversion measurement: If you select “Accept All,” Google Analytics helps us understand how visitors use the Website, and Google Ads records whether an ad visitor successfully creates a business account.
We do not sell cookie data. Google Analytics and Google Ads conversion measurement are disabled by default, and the Google tag is not loaded unless you give prior opt-in consent.
3. Categories of Cookies We Use
The Website uses strictly necessary cookies, functional storage, and, with your prior consent, analytics and conversion-measurement cookies.
3.1 Strictly Necessary Cookies
These cookies are essential for the Website to function and cannot be switched off in our systems. They are set only in response to actions you take which amount to a request for services — signing in, completing two-factor authentication, or registering an account.
All of our strictly necessary cookies are HTTP-only (inaccessible to scripts running in your browser), are marked Secure on HTTPS connections, and are restricted to same-site requests (SameSite=Lax). They enable:
- Session management: Maintaining your authenticated session (identity and access tokens) and renewing it via a refresh token;
- Sign-in security: Protecting the sign-in redirect flow with anti-forgery state and PKCE code-verifier values that live for only five minutes and are deleted as soon as sign-in completes;
- Two-factor authentication: Recording, in a signed token, that you have passed a genuine second-factor challenge, which is required before sensitive operations;
- Registration: Carrying provisioning data for ten minutes between the signup and email-verification steps.
These cookies do not require your consent, as they are strictly necessary for the provision of the service you have requested. You can set your browser to block them, but you will not be able to sign in or use the client portal.
3.2 Functional Storage
Glacierpay does not currently set any functional cookies. A small number of functional preferences — your preferred language, display theme, and certain client-portal interface settings — are stored in your browser's local storage on your own device (see Section 5). These values never leave your device as part of a tracking mechanism and are not used to identify you across other websites.
3.3 Analytics and Conversion-Measurement Cookies — Optional
If you select “Accept All” in our cookie banner, we load Google Analytics 4 (GA4) and Google Ads conversion measurement through the Google tag. GA4 measures Website usage such as pages viewed, visit timing, referral source, approximate location, and device/browser information. Google Ads records a conversion only after a new business account is created successfully. Google may set the first-party cookies described in Section 4.
We use a basic consent implementation: before consent, the Google tag is not downloaded and no analytics or advertising-measurement data is sent to Google. Choosing “Essential Only” leaves both Google Analytics and Google Ads conversion measurement disabled. We do not use this implementation for remarketing.
4. Cookie Table
The following table lists cookies used by the Glacierpay Website. Strictly necessary cookies are always active. Analytics and conversion-measurement cookies are used only after you select “Accept All.”
| Cookie Name | Provider | Purpose | Duration | Type |
|---|---|---|---|---|
| gp_id | Glacierpay (First Party) | Identity token for your authenticated session | 1 hour | Strictly Necessary (HTTP-only) |
| gp_at | Glacierpay (First Party) | Access token used to authorise your requests to our services | 1 hour | Strictly Necessary (HTTP-only) |
| gp_rt | Glacierpay (First Party) | Refresh token that renews your session without requiring you to sign in again | 30 days | Strictly Necessary (HTTP-only) |
| gp_2fa | Glacierpay (First Party) | Signed proof that you have passed a two-factor authentication challenge; required before sensitive operations such as withdrawals | 12 hours | Strictly Necessary (HTTP-only) |
| gp_oauth_state | Glacierpay (First Party) | Anti-forgery (CSRF) protection for the sign-in redirect flow | 5 minutes; deleted when sign-in completes | Strictly Necessary (HTTP-only) |
| gp_oauth_pkce | Glacierpay (First Party) | PKCE code verifier that protects the sign-in code exchange against interception | 5 minutes; deleted when sign-in completes | Strictly Necessary (HTTP-only) |
| gp_oauth_next | Glacierpay (First Party) | Remembers the page you were trying to reach so you can be returned to it after sign-in (restricted to same-origin paths) | 5 minutes; deleted when sign-in completes | Strictly Necessary (HTTP-only) |
| gp_onboarding_provision | Glacierpay (First Party) | Carries account-provisioning data (your company name) between the signup and email-verification steps of registration | 10 minutes | Strictly Necessary (HTTP-only) |
| _ga | Google Analytics | Distinguishes visitors for Website usage measurement | Up to 2 years | Analytics (opt-in) |
| _ga_<container-id> | Google Analytics | Persists session state for Website usage measurement | Up to 2 years | Analytics (opt-in) |
| _gcl_* | Google Ads | Stores ad-click attribution so a successful account signup can be measured as a conversion | Up to 90 days | Conversion measurement (opt-in) |
Authentication cookies are deleted when you sign out. Google Analytics and Google Ads cookie durations may be refreshed when data is sent after consent.
5. Local Storage & Session Storage
In addition to cookies, the Website uses browser storage. Local storage persists until you delete it; session storage is automatically cleared when you close the browser tab. These values are stored on your own device.
| Key | Storage | Purpose | Duration | Type |
|---|---|---|---|---|
| glacier-cookie-consent | Local storage | Records your choice on the cookie consent banner (“all” or “essential”) together with the date of your choice | Until you delete it | Strictly Necessary (consent record) |
| gp-lang | Local storage | Remembers your preferred display language | Until you delete it | Functional |
| gp-theme | Local storage | Remembers your preferred display theme | Until you delete it | Functional |
| gp_last_activity | Local storage | Synchronises the inactivity timer across open portal tabs so idle sessions are signed out automatically | Until you delete it | Strictly Necessary (security) |
| Client-portal interface preferences | Local storage | Remembers interface preferences you set inside the client portal (for example, chart layout settings) | Until you delete them | Functional |
| Temporary registration and verification values | Session storage | Temporary session values required to complete registration and identity verification, and short-lived interface state | Until the browser tab is closed | Strictly Necessary |
The storage values in this table are not used by Google Analytics, advertising, or cross-site tracking.
6. Managing Your Cookies
Blocking strictly necessary cookies will prevent you from signing in or registering. Analytics cookies are optional and can be refused without affecting the Website. You remain in control of your browser:
Most web browsers allow you to control cookies and site data through their settings. You can set your browser to block all cookies, block third-party cookies, delete cookies when you close your browser, and clear local and session storage.
Instructions for managing cookies in common browsers:
- Google Chrome: Settings → Privacy and Security → Cookies and other site data
- Mozilla Firefox: Settings → Privacy & Security → Cookies and Site Data
- Apple Safari: Preferences → Privacy → Manage Website Data
- Microsoft Edge: Settings → Cookies and site permissions → Manage and delete cookies and site data
Clearing the Website's site data will delete your consent record, sign you out, and cause the cookie banner to be shown again on your next visit.
7. Consent Mechanism
Our consent mechanism operates as follows:
- Cookie banner: On your first visit to the Website, a clearly visible cookie consent banner is presented. It offers two choices — “Accept All” or “Essential Only” — together with a “Cookie Details” panel describing the storage categories and a link to this Policy;
- No pre-ticked boxes: Nothing is selected by default. The banner requires your affirmative action, and no non-essential cookie or Google tag is loaded before you make your choice;
- Essential-only option: Choosing “Essential Only” is as easy as choosing “Accept All” and does not degrade your experience. This choice keeps Google Analytics and Google Ads conversion measurement disabled and prevents the Google tag from loading;
- Consent record: Your choice is recorded, together with the date you made it, in the “glacier-cookie-consent” entry in your browser's local storage (see Section 5). It is stored on your device only;
- Withdrawing or changing your consent: The Website does not currently provide an in-page control for re-opening the banner after a choice has been made. You may withdraw or change your consent at any time by clearing the Website's site data in your browser (which deletes the consent record and causes the banner to be shown again on your next visit), or by contacting us at [email protected].
8. Third-Party Technologies
Glacierpay uses the following third-party technologies. We do not load social-media tracking scripts. Google Analytics and Google Ads conversion measurement load only after prior opt-in consent.
8.1 Google Analytics
After you select “Accept All,” Google Analytics processes Website usage data on our behalf to provide aggregate traffic and engagement reports. The Google tag is completely blocked before consent. See Sections 3.3 and 4 for the data categories and cookies involved.
8.2 Google Ads Conversion Measurement
After you select “Accept All,” Google Ads records a conversion when a new business account is created successfully. This allows us to measure whether our advertisements generate genuine account signups. The conversion event does not include the password or form contents. The Google tag is blocked before consent.
8.3 Sumsub Identity Verification
As part of our regulatory obligations under Canadian anti-money laundering legislation, we use the Sumsub identity-verification service during client onboarding. When you complete identity verification through the Sumsub WebSDK, Sumsub may set its own cookies on your device for the purposes of:
- Managing the verification session;
- Preventing fraud during the identity-verification process;
- Ensuring the security and integrity of submitted documents.
These cookies are strictly necessary for the identity-verification service and are set only when you use it. Sumsub acts as our service provider; for further information about its practices, please refer to Sumsub's own privacy and cookie notices, and to the “recipients” section of our Privacy Policy.
9. Do Not Track & Global Privacy Control
Some web browsers transmit “Do Not Track” (“DNT”) signals or “Global Privacy Control” (“GPC”) signals to the websites you visit, indicating a preference not to be tracked or not to have personal information sold or shared.
We do not currently vary the Website's behaviour automatically in response to DNT or GPC signals. You can prevent the optional Google tags from loading by selecting “Essential Only” in the cookie banner, or withdraw consent as described in Section 7.
10. Legal Frameworks
This Policy is designed to satisfy the transparency and consent requirements of the laws applicable to our use of cookies and similar technologies:
- Canada — PIPEDA: The Personal Information Protection and Electronic Documents Act requires meaningful consent to the collection and use of personal information. Our strictly necessary cookies are used only to deliver services you have requested, and our banner records your express choice;
- Quebec — Law 25: The Act respecting the protection of personal information in the private sector, as amended, requires that technologies which allow a person to be identified, located or profiled are activated only with consent. Google Analytics remains disabled unless the visitor gives prior opt-in consent;
- EEA — ePrivacy Directive and GDPR: For visitors from the European Economic Area, Directive 2002/58/EC (as implemented in member-state law) permits cookies that are strictly necessary for a service explicitly requested by the user without consent; all other cookies require prior consent. We rely on consent before loading Google Analytics, and process related data as described in our Privacy Policy;
- United Kingdom — PECR and UK GDPR: The Privacy and Electronic Communications Regulations 2003 apply the same strictly-necessary exemption and prior-consent rule for visitors from the United Kingdom.
Glacierpay provides services to business clients only. Where clients in the EEA or the United Kingdom access our services, they do so exclusively at their own initiative; this does not change the cookie practices described in this Policy.
11. Changes to This Policy
Glacierpay will update this Cookie Policy whenever our use of cookies or similar technologies changes, and otherwise as required by changes in technology or applicable law. When we make material changes:
- The revised Policy will be published on the Website with an updated Effective Date and version number;
- We will notify you of material changes via a prominent notice on the Website or, where appropriate, via email;
- Where changes involve the introduction of new cookie categories — in particular any analytics or marketing cookies — this Policy will be updated first and your prior opt-in consent will be obtained via the cookie banner before any such cookie is placed on your device;
- Continued use of the Website after the effective date of any changes constitutes acceptance of the updated Policy, save that non-essential cookies will never be deployed on the basis of continued use alone.
We encourage you to review this Policy periodically to stay informed about how we use cookies.
12. Contact
If you have any questions, concerns, or requests regarding this Cookie Policy or our use of cookies — including a request to withdraw consent — please contact us:
| Contact Method | Details |
|---|---|
| [email protected] | |
| Company | Glacierpay Inc. |
| Address | 320 Matheson Blvd West, Suite 211, Mississauga, Ontario, L5R 0H2, Canada |
| Jurisdiction | Ontario, Canada |
| Website | glacier-pay.com |
We will respond to your enquiry within a reasonable timeframe and in accordance with applicable data protection legislation.