Cookie Policy

This Cookie Policy explains the cookies and similar technologies used on the RapidCents websites, what each one does, how long it lasts, and how you decide which of them run. It covers the consent banner you see on your first visit, the three categories that banner offers, the small number of first-party items the site sets so that it can remember your language, your country, your appearance settings and a form you have started, and the one third-party security check the site loads.

1. What a cookie is, and what else this policy covers

A cookie is a small file a website leaves in your browser. This policy also covers local storage, which does the same job a different way.

A cookie is a small text file that a website asks your browser to keep and to send back on your next request. It lets a site recognize that two page views came from the same browser, which is how a preference survives a reload. A cookie set by rapidcents.com is a first-party cookie; one set by another domain whose content appears on the page is a third-party cookie.

This policy uses “cookies” to cover cookies and the similar technologies that serve the same purpose, principally browser storage. Local storage keeps a value in your browser until it is cleared; session storage keeps one only until you close the tab; and neither, unlike a cookie, is attached to network requests. Four of the six items described in section 3 are storage entries rather than cookies, and each is identified as which, because a policy that calls everything a cookie makes it harder to find and clear them.

This policy applies to the RapidCents marketing websites at rapidcents.com and their Canadian and United States locales. The merchant dashboard and the payment interfaces used at checkout are governed by the agreements and notices that apply to those products.

2. The three consent categories

There are three categories, and only three. The first is always on because the site cannot work without it. You choose the other two.

The consent banner offers three categories, and the site uses no others. The names below are the names used in the banner itself, so that what you agreed to and what this policy describes are the same thing.

Strictly necessary items are not subject to consent, because without them the site cannot deliver the page you asked for, keep your session consistent, or serve it in the right language. Analytics and marketing are off unless you turn them on, and technologies in either category are not loaded before a consent record exists that permits them.

• Strictly necessary — security, language and session handling. Always on. These make the site function: routing your request to the correct country and language version, keeping that choice consistent from page to page, protecting form submissions, and recording your consent decision itself.
• Analytics — page views and conversion measurement. Not used to identify you. These count which pages are read, which paths lead to an application or a quote, and where a page fails people, in aggregate. They are not used to build a profile of you or to work out who you are.
• Marketing — attribution for the campaigns that bring merchants here. These record that a visit followed a particular advertisement or referral so that campaign spending can be measured against results.

3. The items this site sets, and the one check it loads from elsewhere

Six items are set by RapidCents itself. Four of them are set anywhere on the site; the last two are set only on the fee comparison page at /pricing/fee-check, and only once you start filling in the form there. None of them contains your name, your email address or any other contact detail, and none is shared with an advertiser. Each is listed below with what it holds, why it exists and how long it lasts.

The two cookies are set with SameSite=Lax and a path of “/”, which means they are sent only to rapidcents.com and only on ordinary navigation to it. The four storage entries are never transmitted at all: they are read by the page in your browser and stay there. Local storage survives closing the browser; session storage is discarded when you close the tab.

• rc-locale — a first-party cookie holding the country and language you chose in the footer switcher, such as en-ca, fr-ca or en-us. It exists so that a deliberate choice outranks automatic detection: once it is set, the site stops trying to send you somewhere else. Strictly necessary. Lifetime: about twelve months from the last time you made a choice.
• rc-geo — a first-party cookie holding the single value 1, set when automatic country, province or language routing has already sent you once. It exists so that you are never redirected twice, and so that a visitor who navigates back is left alone. Strictly necessary. Lifetime: about twelve months.
• rc-theme — a browser local storage entry holding light or dark, written when you use the theme toggle in the header. The site defaults to dark; this entry is read before the page paints so a stored light choice does not flash midnight at you. Strictly necessary. Lifetime: until you clear it or clear the site’s data.
• rc-cookie-consent — a browser local storage entry holding your consent record: your analytics and marketing choices, the fact that strictly necessary items are on, and the date and time the decision was recorded. It exists so that the banner does not ask again and so that your choice can be honoured and evidenced. Strictly necessary. Lifetime: until you clear it or clear the site’s data.
• rcsc_draft — a browser session storage entry set only on the fee comparison page, holding what you have typed into that form so far, so that a reload or a step backwards does not make you enter it again. The consent checkbox is deliberately not among the values kept. Strictly necessary. Lifetime: until you close the tab.
• rcsc_session — a browser session storage entry set only on the fee comparison page, holding the reference and access token for the comparison you have started so the form can resume where you left off. It holds no content from your statement. Strictly necessary. Lifetime: until you close the tab, or until you choose to start over, which clears it.

One third-party technology also runs on the pages this policy covers. The fee comparison form is protected by a bot-detection check supplied by an outside security provider, loaded from that provider’s own domain when you reach the step that uses it. Loading it discloses your IP address and browser to that provider, and anything it stores in your browser is stored under its domain and governed by its policy rather than by this one. The check is strictly necessary — it is what keeps the form from being submitted automatically at scale — so it runs whether or not you have consented to analytics or marketing, and it runs nowhere else on the site. Section 9 of the Subprocessors page at /legal/subprocessors publishes the register. It names both of the providers this check can be configured to use, because which of the two is loaded is a RapidCents setting rather than something the page you receive discloses, and it sets out how to ask for the country a provider processes in where the register does not state one.

4. How your consent is captured, stored and withdrawn

The banner appears once. “Essential only” turns analytics and marketing off. To change your mind later, clear this site’s data in your browser and the banner comes back.

On your first visit, a banner titled “Cookies on RapidCents” appears at the corner of the page. It offers three actions: Accept all, which turns on analytics and marketing; Essential only, which turns both off; and Manage preferences, which opens a panel where analytics and marketing are separate checkboxes you set individually before choosing Save preferences. Strictly necessary items appear in that panel as well, shown as always on and not adjustable, so that you can see what they are.

Your decision is written to the rc-cookie-consent entry described in section 3, together with the date and time it was made. It is kept in your browser rather than in an account record, which has two consequences worth knowing: the banner will ask again in a different browser or on a different device, and clearing your browser data will erase the record.

That is also how you withdraw or change consent. Clearing cookies and site data for rapidcents.com in your browser removes the consent record along with the other items listed in section 3, and the banner will ask again on your next visit, where you can make a different choice. Withdrawing consent does not affect anything done lawfully before it was withdrawn, and does not remove strictly necessary items, which are not consent-based.

If you would rather not do this yourself, contact RapidCents using the details in section 8 and your request will be actioned.

5. Analytics and marketing partners

Where you have consented to the analytics or marketing category, measurement and attribution may be carried out with the assistance of service providers engaged by RapidCents. Those providers act on RapidCents’ instructions for the purpose described in the category you consented to, and are not permitted to use what they process for their own purposes.

The Subprocessors page at /legal/subprocessors sets out the categories of service provider RapidCents engages, what each category is engaged to do, what personal information it can reach, and the commitments made about every provider before it is engaged. The names of the individual providers, with what each is engaged to do and, where the register states one, the country it processes in, are held in a maintained register that section 9 of that page publishes; the same section states that the register is not the whole supply chain and sets out how to obtain the current full list. This policy restates neither, so that they cannot fall out of step. If you have consented only to strictly necessary items, no analytics or marketing provider processes anything about your visit.

Where a provider processes personal information outside Canada, the transfer is governed by the Privacy Policy and, for merchants, by the Data Processing Addendum, which applies to every merchant without a separate signature, as clause 19 of that addendum states.

6. Browser controls, Do Not Track and Global Privacy Control

Your browser can block or clear cookies. Blocking all of them will break the language, country and theme settings.

Every current browser lets you see the cookies and storage a site has set, delete them, block third-party cookies, block all cookies, or clear everything when you close the window. Private or incognito windows discard the lot at the end of the session. These controls sit outside this site and override anything set here.

Blocking cookies and storage entirely is your right, and the site is built to survive it: the switcher still navigates and the theme toggle still works for the page you are on. What you lose is memory. Your country and language choice will not persist, automatic country routing may run again on a later visit, the theme will return to light, and the consent banner will reappear each time because the record of your decision cannot be kept.

Do Not Track is a signal some browsers can send to indicate that you do not want to be tracked across sites. It was never standardized into an agreed obligation and most browsers have withdrawn it. Because the RapidCents sites do not run analytics or marketing technologies without your consent in the first place, a Do Not Track signal does not change what happens: with no consent, nothing in those categories runs, whether the signal is present or not.

Global Privacy Control is the successor signal and, unlike Do Not Track, is recognized as a valid opt-out under several privacy laws. Where a Global Privacy Control signal is received from your browser, RapidCents treats it as a withdrawal of consent to the analytics and marketing categories and does not load technologies in those categories, regardless of any earlier banner choice.

7. How this policy relates to the Privacy Policy

This policy describes the mechanism: what is stored in your browser, why, and how you control it. The Privacy Policy describes the substance: what personal information RapidCents collects, the purposes for which it is used, how long it is kept, who it is disclosed to, and the rights you have in relation to it, including the right to access and correct it and how to make a complaint.

Where information read from a cookie or storage entry is personal information under applicable privacy law, the Privacy Policy governs how it is handled, and this policy does not narrow it. Where the two documents describe the same thing, read them together; if they conflict, the Privacy Policy prevails on questions of collection, use and disclosure, and this policy prevails on the description of the specific items set.

8. Changes to this policy, and how to reach us

RapidCents will update this policy when the categories offered by the banner change, when an item listed in section 3 is added, renamed or removed, or when the law requires it. The revision date at the head of this page changes with every edit; the effective date changes only when the substance does.

Where a change would broaden what runs on your visit — a new category, or an existing category used for a materially different purpose — consent will be requested again through the banner rather than assumed from a previous decision. Continuing to use the site after a purely descriptive change takes effect indicates acceptance of the revised text.

Questions about this policy, or a request to change or withdraw a consent choice, can be sent through the contact page at /contact, by telephone at +1-844-957-2743 in Canada or +1-202-902-6226 in the United States, or by mail to RapidCents Inc., 515 Consumers Road, Unit 210, North York, Ontario, M2J 4Z2, Canada.