Cookie Policy

This Cookie Policy explains how Aboundo ("we," "us," or "our") uses cookies and similar technologies (such as local storage) when you use the Service, and what is set by third parties we rely on. It should be read together with our Privacy Policy.

1. What Cookies Are

Cookies are small text files placed on your device by a website you visit. "Similar technologies" includes things like browser local storage, which behaves like a cookie for the purpose of remembering information on your device but is not sent back to a server automatically.

2. Legal Basis for Cookies and Similar Technologies (EU ePrivacy Directive / UK PECR)

Article 5(3) of the EU ePrivacy Directive (as implemented by EU member states) and Regulation 6 of the UK Privacy and Electronic Communications Regulations ("PECR") require that storing information on, or accessing information already stored on, your device have either your consent or fall within a narrow exemption from consent — most relevantly, storage or access that is strictly necessary to provide a service you have explicitly requested. This requirement is technology-neutral: it applies to cookies and to similar technologies such as browser local storage in the same way.

For each item below, we state a classification — Strictly Necessary (relying on the exemption, no consent sought) or Functional/Preference (which would require consent) — and the reasoning for that classification. Everything we currently set falls into the Strictly Necessary category. We do not set, and this Service does not use, any Functional/Preference, analytics, or advertising cookies or local storage; if that changes, we will update this policy and put a consent mechanism in place before doing so.

3. Cookies We Set

Aboundo sets exactly one cookie:

• kiss_session — Classification: Strictly Necessary. Keeps you signed in to the admin application after you log in. It is a first-party, httpOnly cookie (not readable by page scripts), marked Secure in production so it is only sent over HTTPS. It is set only when you sign in and expires with your session.
  Legal basis: strictly necessary to provide the authenticated Service you explicitly request by logging in (the "service explicitly requested by the user" exemption under Art. 5(3) ePrivacy Directive / PECR reg. 6(4)) — not the transmission-only exemption, and not consent. Without it, you cannot stay signed in to the admin application.

We do not use advertising, analytics, or cross-site tracking cookies of any kind — those would be Functional/Preference or Advertising category and would require your consent, which we do not currently collect through a cookie banner because we do not set anything that would need it.

4. Local Storage

The admin application uses your browser's local storage — not a cookie, and not transmitted to us — to remember one piece of interface state on your device: which leads you've already been notified about, so you aren't re-notified for leads you've already seen once you enable browser notifications. This data stays on your device and is not accessible to other websites.

Classification: Strictly Necessary (not Functional/Preference). Legal basis and reasoning: we rely on the same "strictly necessary to provide a service explicitly requested by the user" exemption described in Section 2, for three reasons: (1) nothing is written to local storage for this purpose until you take an affirmative action to enable browser notifications — it is never set for a Tenant user who hasn't opted in, and never for form visitors; (2) it exists solely to make that explicitly-requested feature behave correctly (avoiding duplicate notifications for leads you've already seen), not for analytics, advertising, profiling, or any purpose beyond that feature; and (3) it is never transmitted to us or to any third party — it stays on your device. We do not seek consent for this storage on the basis of this exemption. If you disable browser notifications or clear this value in your browser, no further writes occur.

5. Cookies on the Forms You Publish

Forms you build and publish with Aboundo — whether accessed via a hosted link or embedded on your own website — do not set cookies by default. If you add your own tracking or analytics tooling to a page that embeds an Aboundo form, that tooling is yours, governed by your own privacy and cookie disclosures to your visitors, not this policy.

6. Cookies Set by Third Parties

If you're a Customer managing billing, subscribing to a plan, starting a free trial, or updating payment details, your browser is redirected away from our site to a page hosted entirely on our payment processor's own domain (Stripe Checkout or the Stripe Billing Portal). We do not load any Stripe script, tag, or cookie on our own pages — Stripe only sets cookies once you've left our site and are on its hosted page, to process your payment securely and prevent fraud. Those cookies are governed by Stripe's Cookie Policy, not this one, and we do not control them.

No other third-party cookies are set through the Service.

7. "Do Not Sell or Share" and Opt-Out Preference Signals

We do not sell or share personal information, as those terms are defined under the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA"), and we do not use cookies for cross-context behavioral advertising or targeted advertising. Because that activity doesn't occur here, this site does not display a "Do Not Sell or Share My Personal Information" link — there is nothing for it to opt you out of. If your browser or an extension sends an opt-out preference signal, such as Global Privacy Control ("GPC"), we honor it as a valid opt-out request to the extent it would ever apply, even though it currently has no effect on how we handle your data. See our Privacy Policy for the full statement of your rights under California, Colorado, Virginia, Texas, and other US state privacy laws.

8. Managing Cookies

Most browsers let you block or delete cookies through their settings. Because kiss_session is strictly necessary for signing in, blocking it will prevent you from using the admin application, but will not affect your ability to view a hosted or embedded form as a visitor. You can clear the local storage described in Section 4 through your browser's site-data settings; doing so simply means you may be re-notified for leads you've already seen.

9. Changes to This Policy

We may update this policy as the Service changes. We will notify you by email before material changes take effect, consistent with our Terms of Service.

10. Contact

Questions about this Cookie Policy? Contact us at privacy@aboundo.com.