Cookie Policy

This Cookie Policy explains the cookies and similar technologies used on the RapidCents websites, what each one does, how long it lasts, and how you decide which of them run. Where you are decides what happens before you choose. If you are in the United States or in a Canadian province or territory other than Quebec, analytics and marketing are on from your first page and no pop-up asks you first: Google Analytics, Microsoft Clarity, RapidCents’ own record of your visits, the Meta pixel and Google’s advertising measurement run until you turn them off, and if you then send an enquiry through the contact form, how you reached the site and the pages you viewed are stored with it. To turn them off, choose “Cookie settings” at the foot of any page, then “Essential only”. If you are in Quebec, in Canada where your province cannot be determined, or anywhere else, or if the site cannot tell where you are, a notice asks first and nothing in either category runs until you accept, apart from the cookieless signals Google’s tag sends, which section 5 describes.

1. What a cookie is, and what else this policy covers

A cookie is a small file a website leaves in your browser. This policy also covers local storage, which does the same job a different way.

A cookie is a small text file that a website asks your browser to keep and to send back on your next request. It lets a site recognize that two page views came from the same browser, which is how a preference survives a reload. A cookie set by rapidcents.com is a first-party cookie; one set by another domain whose content appears on the page is a third-party cookie.

This policy uses “cookies” to cover cookies and the similar technologies that serve the same purpose, principally browser storage. Local storage keeps a value in your browser until it is cleared; session storage keeps one only until you close the tab. Neither, unlike a cookie, is attached to network requests by the browser, but a page’s own script can read one and send what it holds, and section 3 says where this site does. Most of the items RapidCents sets are storage entries rather than cookies, and each is identified as which, because a policy that calls everything a cookie makes it harder to find and clear them.

This policy applies to the RapidCents marketing websites at rapidcents.com and their Canadian and United States locales. The merchant dashboard and the payment interfaces used at checkout are governed by the agreements and notices that apply to those products.

2. The three consent categories, and what is on before you choose

There are three categories. The first is always on. The other two are on from your first page in the United States and in Canada outside Quebec, until you turn them off. Everywhere else they are off until you turn them on.

The cookie notice offers three categories, and the site uses no others. The names below are the names used in the notice itself — “Strictly necessary”, “Analytics” and “Marketing” — so that what you chose and what this policy describes are the same thing.

Strictly necessary items are not subject to consent, because without them the site cannot deliver the page you asked for, keep your session consistent, serve it in the right language or apply the choices this policy describes. What happens with analytics and marketing before you choose depends on where you are.

In the United States, and in every Canadian province and territory except Quebec, analytics and marketing are on when you arrive. No pop-up appears and nothing asks you first: this policy and the Privacy Policy are the notice that they run. Both stay on until you turn them off with the “Cookie settings” control in the footer of every page, which opens the notice described in section 4; choosing “Essential only” there stops both categories at once.

In Quebec, in Canada where your province cannot be determined, everywhere else in the world, and wherever the site cannot determine where you are, the notice appears on your first visit, and nothing in either category runs until you accept: no cookie or storage entry in either category is written, and nothing is sent to Meta, to Microsoft or to RapidCents’ record of visits. Google’s tag still loads and sends Google the cookieless signals described in section 5.

• Strictly necessary — security, language and session handling. Always on. These make the site function: routing your request to the correct country and language version, keeping that choice consistent from page to page, protecting form submissions, recording your choice in the notice and the default that applies where you are, and noting the pages a browser tab has visited so that an error report can show what led to it.
• Analytics — which pages are read, how visitors arrive, and which visits become enquiries. This category is Google Analytics; Microsoft Clarity, which records how a page is used — clicks, scrolling and pointer movement; and RapidCents’ own record of the visits a browser makes, described in section 3 under rc-journey. It is not anonymous. The visit record carries a random identifier for your browser, and if you send an enquiry through the contact form while this category is on, how you reached the site and the pages you viewed are stored with the enquiry, beside the name and contact details you typed.
• Marketing — measuring the advertising that brings merchants here. This category is the Meta pixel and the Meta Conversions API, which tell Meta about page views and about an enquiry once it is stored, and the advertising signals of Google’s tag, which permit Google to store advertising cookies, to receive data about your visit for advertising, and to use it to personalise advertising. Section 5 sets out what each receives.

Where you are is worked out from the IP address your browser connects from: the country, and the province or state, as reported by the network that serves the site or, where that report gives no country, or no province for a visitor in Canada, by an IP-location service the site asks. The site keeps the answer, not the address: your browser keeps it in the rc-consent-region entry described in section 3 and relies on it for 24 hours. Google’s tag works out the same thing for itself, from the same address.

RapidCents can switch the site to ask first everywhere. Where it does, the notice appears for every visitor and nothing in either category runs anywhere until it is accepted.

Two things change what applies to you. An answer you give in the notice replaces the default for where you are. And a Global Privacy Control signal from your browser turns the Marketing category off in every region, whatever you answered, as section 6 explains.

3. The items this site sets, and what loads from elsewhere

The items below are grouped by who sets them and by category. Each is listed with what it holds, why it exists and how long it lasts, and each is identified as a cookie or as a storage entry.

Apart from rcsc_draft, which holds what you type into the fee comparison form, none of the items RapidCents sets contains your name, your email address or any other contact detail. The four cookies RapidCents sets for its own use — rc-locale, rc-geo, rc-consent-analytics and rc-consent-marketing — are sent to rapidcents.com with the requests your browser makes to it, as cookies are, and to no other site: they are set with SameSite=Lax and a path of “/”. The storage entries are read by the page in your browser; the entries for rcsc_session, rcTrail and rc-journey say when what they hold is sent to RapidCents. Local storage survives closing the browser; session storage is discarded when you close the tab. The cookies listed last are Google’s, Meta’s and Microsoft’s, and their values reach those companies.

• rc-locale — a first-party cookie holding the country and language you chose in the footer switcher, such as en-ca, fr-ca or en-us. It exists so that a deliberate choice outranks automatic detection: once it is set, the site stops trying to send you somewhere else. Strictly necessary. Lifetime: about twelve months from the last time you made a choice.
• rc-geo — a first-party cookie holding the single value 1, set when automatic country, province or language routing has already sent you once. It exists so that you are never redirected twice, and so that a visitor who navigates back is left alone. Strictly necessary. Lifetime: about twelve months.
• rc-theme — a browser local storage entry holding light or dark, written when you use the theme toggle in the header. The site defaults to dark; this entry is read before the page paints so a stored light choice does not flash dark at you. Strictly necessary. Lifetime: until you clear it or clear the site’s data.
• rc-cookie-consent — a browser local storage entry holding your answer to the notice: your Analytics and Marketing choices, the fact that strictly necessary items are on, the date and time you answered, and the version of the notice you answered; and, if you saved your preferences leaving a category on that was already on by default where you are, a note that it was left at the default rather than accepted. It is written only when you answer by choosing a button in the notice, never for a default. It exists so that the notice does not ask again, so that your choice is applied on every page, and so that it can be evidenced. Strictly necessary. Lifetime: until you clear it or clear the site’s data; where the notice appears on its own, a refusal more than twelve months old is put to you again.
• rc-consent-region — a browser local storage entry holding the country, and the province or state code, that the site reported for the IP address your browser connects from, with the time it was reported. It is used only to decide which default in section 2 applies to you. It is written only while that matters — before you have answered the current notice, or when a refusal is more than twelve months old — and it is refreshed after 24 hours. It does not hold the IP address. Strictly necessary. Lifetime: until you clear it or clear the site’s data; it is not relied on after 24 hours.
• rc-consent-analytics and rc-consent-marketing — two first-party cookies, each holding 0, 1 or 2: the category is off, you accepted it in the notice, or it is on by the default for where you are. They exist so that RapidCents’ server applies the same choice your browser does when it records a visit, stores an enquiry or forwards an event to Meta, because the server cannot read browser storage. Strictly necessary. Lifetime: twelve months, written again on each page you view.
• rcsc_draft — a browser session storage entry set only once you start filling in the fee comparison form, at /pricing/fee-check and wherever else the site opens it. It holds what you have typed into that form so far, which includes your email address and the other details the form asks for, so that a reload or a step backwards does not make you enter them again. The consent checkbox is deliberately not among the values kept. Strictly necessary. Lifetime: until you close the tab.
• rcsc_session — a browser session storage entry set by the same form, holding the reference and access token for the comparison you have started, which the form sends with its requests so that it can resume where you left off. It holds no content from your statement. Strictly necessary. Lifetime: until you close the tab, or until you choose to start over, which clears it.
• rcTrail — a browser session storage entry holding the paths of the last thirty steps taken in that tab — pages viewed, links to other pages of the site followed, returns to a previous page and departures — with their times, and no query string. It stays in your browser unless a page reports a fault — a script error, a file that fails to load, a request to the site that fails, or a page slower to load than the limit RapidCents sets: then it is sent to RapidCents with that report, so that the fault can be traced to what led to it. It is set whatever you choose in the notice. Strictly necessary. Lifetime: until you close the tab.
• rcRewriteProbed — a browser session storage entry holding the value 1, recording that the site has made its one check per tab session that its own pages can be reached. It is set whatever you choose in the notice. Strictly necessary. Lifetime: until you close the tab.
• rc-fee-check-activity — a browser local storage entry holding two numbers, a random starting point and a position, which choose the next sample merchant profile shown in the fee check activity panel, so that a reload does not repeat the last one. The profiles are illustrations, not records of real merchants. It holds nothing about you or your visit and is not sent anywhere. It is set whatever you choose in the notice, on pages that show the panel. Strictly necessary. Lifetime: until you clear it or clear the site’s data.
• rc-journey — a browser local storage entry in the Analytics category. It holds a random identifier for your browser, beginning “v.”; the date of your first visit; counts of your visits and of the pages you have viewed; for your first arrival, and for the latest one that came from a campaign, an advertisement or another site, the page you landed on, the host name of the site that sent you, the campaign parameters utm_source, utm_medium, utm_campaign, utm_term, utm_content and utm_id, and the advertising click identifiers gclid, gbraid, wbraid, dclid, fbclid, msclkid, ttclid and li_fat_id; and the paths of the last thirty pages you viewed, with their times. Nothing typed into a form is read into it. It is never written unless Analytics is on, and it is deleted when you turn Analytics off, which “Essential only” does. While Analytics is on, each page view is sent to RapidCents to keep the record of your browser’s visits that the Privacy Policy describes, and when you send the contact form what this entry holds is sent with your enquiry and stored with it, including the identifier, which links the record of your browser’s visits to that enquiry. The identifier can be read in your browser’s developer tools, under this site’s local storage; quoting it lets RapidCents find and delete the visit record for your browser. Lifetime: until you clear it, clear the site’s data or turn Analytics off.
• _ga, and _ga_ followed by the Google Analytics property identifier — first-party cookies set by Google Analytics, holding a random identifier for your browser and the state of your current visit, so that Google can count visits and visitors. Analytics; not set while Analytics is off. Lifetime: up to two years.
• _fbp and _fbc — first-party cookies in Meta’s format. _fbp holds a random identifier for your browser; _fbc holds the click identifier Meta adds to links followed from its apps and sites, including its advertisements, and is set only when you arrive by such a link. The site’s own script writes them when the Meta pixel starts, so that the first page view carries them, and Meta’s pixel then uses them; their values are sent to Meta with each event. To find the right domain for them, the script writes a cookie named rc-probe and removes it at once. Marketing; not set while Marketing is off. Lifetime: 90 days.
• _clck and _clsk — first-party cookies set by Microsoft Clarity. _clck holds a random identifier for your browser; _clsk ties together the pages of one visit for the recording. Analytics; not set while Analytics is off, and cleared by Clarity when you turn Analytics off. Lifetime: about one year for _clck and one day for _clsk.
• _gcl_au, and _gcl_aw after a click on a Google advertisement — first-party cookies Google’s advertising tag can set to connect a later visit or enquiry with a Google advertisement. Marketing; not set while Marketing is off. Lifetime: 90 days.

Google, Meta and Microsoft can also read and set cookies on their own domains when your browser contacts them — for example the cookies Meta holds for you if you use Facebook or Instagram in the same browser. Those are governed by their policies rather than by this one, and your browser’s settings decide whether they are sent.

Two security checks run whatever you choose, because they are strictly necessary. The fee comparison form is protected by a bot-detection check supplied by an outside security provider, loaded from that provider’s own domain when you reach the step that uses it. Where RapidCents has switched it on, the contact form and the job application form are protected in the same way by Cloudflare’s Turnstile check, which loads with the form. Loading either check discloses your IP address and browser to its provider, and anything it stores in your browser is stored under its domain and governed by its policy rather than by this one. Section 9 of the Subprocessors page at /legal/subprocessors publishes the register. It names both of the providers the fee comparison check can be configured to use, because which of the two is loaded is a RapidCents setting rather than something the page you receive discloses, and it sets out how to ask for the country a provider processes in where the register does not state one.

The pages also request their typefaces from Google Fonts, on every page and whatever you choose. That request discloses your IP address and browser to Google.

4. The notice, and how your choice is recorded, changed and withdrawn

The notice has two equal buttons, “Accept all” and “Essential only”. In the United States and in Canada outside Quebec it does not appear on its own; open it with “Cookie settings” at the foot of any page. You can change your choice there at any time.

The notice is titled “Cookies on RapidCents” and appears at the bottom of the screen without blocking the page. It names Google and Meta, says whether their cookies are on or off for you, and links to this policy. It offers two buttons of identical size and style, each a single click: “Accept all”, which turns Analytics and Marketing on, and “Essential only”, which turns both off. A third control, “Manage preferences”, opens separate Analytics and Marketing checkboxes showing what is in effect for you at that moment — both unticked where nothing runs until you accept — and a “Save preferences” button. Strictly necessary items are shown there too, as always on and not adjustable, so that you can see what they are. If your browser sends a Global Privacy Control signal, the notice says that advertising cookies stay off whatever you choose.

Where the notice appears on its own — in Quebec, in Canada where your province cannot be determined, everywhere outside Canada and the United States, and wherever the site cannot determine where you are — it appears on your first visit, and nothing in either category runs until you accept, apart from the cookieless signals described in section 5. Not answering is not treated as an answer: you can go on reading, and nothing in either category runs. In the United States and in Canada outside Quebec, the notice does not appear on its own.

A “Cookie settings” control in the footer of every page opens the same notice at any time, wherever you are. It is how you turn analytics and marketing off where they are on by default, and how you change or withdraw a choice anywhere, without clearing your browser’s data.

When you answer, your choice is written to the rc-cookie-consent entry described in section 3, with the date and time and the version of the notice you answered, and copied into the rc-consent-analytics and rc-consent-marketing cookies so that RapidCents’ server applies it too. It takes effect on the page you are on. It is kept in your browser rather than in an account, which has two consequences worth knowing: in a different browser or on a different device you start again from the default for where you are, and clearing your browser data erases the record. RapidCents cannot change that record for you; the “Cookie settings” control is the way to change it.

A refusal is remembered. Where the notice appears on its own, it is put to you again once your refusal is more than twelve months old, and the refusal stays in force until you answer. In the United States and in Canada outside Quebec, a refusal stays in force until you change it. If the notice is changed so that it covers more than it did — a new recipient or a new purpose — an acceptance given to the earlier notice is not carried over: where the notice appears on its own, you are asked again and nothing in either category runs until you answer; in the United States and in Canada outside Quebec, the default for where you are applies until you choose. A refusal given to an earlier notice stands. The current notice is the one that names Google and Meta and covers the visit history stored with an enquiry.

Turning a category off takes effect at once, on the page you are on. Turning Analytics off tells Google’s tag that analytics storage is refused, tells Microsoft Clarity to stop recording and to clear its cookies, deletes the rc-journey entry from your browser, and tells RapidCents to delete the record of your browser’s visits. Turning Marketing off stops the Meta pixel, so that nothing further is sent to Meta from your browser or from RapidCents’ server, and tells Google’s tag that its advertising signals are refused. “Essential only” does both.

Turning a category off does not undo what happened while it was on. Cookies Google and Meta have already set are not deleted by it — the site’s tags stop using them, and you can delete them in your browser — and what Google, Meta and Microsoft received before you chose stays with them. If you sent an enquiry while Analytics was on, the visit history stored with that enquiry is not removed by “Essential only”: ask RapidCents to delete it, as the Privacy Policy explains. Strictly necessary items are not consent-based and are not removed either.

To have RapidCents delete the record of your browser’s visits or an enquiry you sent, contact RapidCents using the details in section 8.

5. Analytics and marketing partners

Google, Meta and Microsoft. What each receives depends on which categories are on for you. Meta may use what it receives for its own purposes.

Google. Google’s tag, loaded through Google Tag Manager, carries Google Analytics and Google’s advertising measurement, and the site tells it through Google Consent Mode which categories are on for you. With Analytics on, Google Analytics sets its cookies and receives each page view and the events the site reports — that an enquiry or a job application was sent and from which form, and that a link to RapidCents’ sign-up page or to its online ordering site was followed, with the link’s address and wording — together with the page address, the referring page, information about your browser and device, and the IP address your browser connects from. With Marketing on, Google’s advertising signals are granted. Nothing you type into a form is sent to Google.

Google’s tag loads whatever you choose. With Analytics off, it does not read or write the Google Analytics cookies; with Marketing off, Google’s advertising signals are refused. With both off — which is what “Essential only” sets — it reads and writes none of its cookies and sends Google cookieless signals about the pages and events, which carry no cookie identifier but, like any request from a browser, reach Google from your IP address with your browser’s details.

Meta. The Meta pixel runs in your browser, and the Meta Conversions API sends the same events from RapidCents’ server under the same event identifiers, so that Meta counts each once. Both run only while Marketing is on, and neither runs on dashboard, sign-in, payment or other account pages. They report a page view on every page, a content view on product, pricing and comparison pages, a “Lead” event once an enquiry sent through the contact form has been stored, and a “SubmitApplication” event once a job application has been stored. Each event carries the page address, the values of the _fbp and _fbc cookies, your IP address and your browser’s user agent; a Lead or SubmitApplication sent from the server also carries a hashed copy of the reference number RapidCents gives the enquiry or application. The pixel’s automatic reading of page content is switched off.

A hashed (SHA-256) copy of the email address, phone number and name you typed into the contact form is added to the Lead event only if you accepted Marketing in the notice, or if you are in the United States, Marketing is on there by default and your browser sends no Global Privacy Control signal. Where Marketing is on by default, leaving its box ticked when you save your preferences is not an acceptance. It is never added on the default in Canada, and never to the SubmitApplication event for a job application. Hashing replaces each value with a fixed-length code; Meta matches that code against the same values hashed from its own records, which is what it is sent for: to connect the enquiry with the advertisement that led to it. Meta may use what it receives under its own terms.

The address of the page you see after sending the contact form includes your enquiry’s reference number, and Google’s and Meta’s tags read the page address there as they do on any page.

Microsoft. Microsoft Clarity runs only while Analytics is on. It records how a page is used — clicks, scrolling and pointer movement — so that visits can be replayed and summarised, and sends that to Microsoft with the page address and information about your browser and device, from your IP address. When Analytics is turned off, Clarity is told to stop recording and to clear its cookies.

Section 9 of the Subprocessors page at /legal/subprocessors publishes the register, which lists Google, Meta and Microsoft for these purposes. They provide these services under their own terms, which set what each may do with what it receives, and the register says so. Google, Meta and Microsoft process what they receive in the United States and in other countries. The Privacy Policy governs that transfer and, for merchants, so does the Data Processing Addendum, which applies to every merchant without a separate signature, as clause 19 of that addendum states.

6. Browser controls, Do Not Track and Global Privacy Control

Your browser can block or clear cookies. Blocking all of them will break the language, country and theme settings and the memory of your choice. A Global Privacy Control signal turns Marketing off; Do Not Track is not acted on.

Every current browser lets you see the cookies and storage a site has set, delete them, block third-party cookies, block all cookies, or clear everything when you close the window. Private or incognito windows discard the lot at the end of the session. These controls sit outside this site and override anything set here.

Blocking cookies and storage entirely is your right, and the site is built to survive it: the switcher still navigates and the theme toggle still works for the page you are on. What you lose is memory. Your country and language choice will not persist, automatic country routing may run again on a later visit, the theme will return to the dark default, and the site cannot remember where you are or what you chose: the notice will appear on each page, the Meta pixel, Microsoft Clarity and the record of your visits will not start, and Google’s tag cannot keep its cookies.

Do Not Track is a signal some browsers can send to indicate that you do not want to be tracked across sites. It was never standardized into an agreed obligation and most browsers have withdrawn it. The RapidCents sites do not act on it: what runs follows the default for where you are and the choices described in this policy, whether the signal is present or not.

Global Privacy Control is the successor signal and, unlike Do Not Track, is recognized as a valid opt-out under several privacy laws. Where your browser sends it, the site turns the Marketing category off, in every region and even if you accepted marketing earlier: the Meta pixel and the Meta Conversions API send nothing, and Google’s advertising signals are refused. The notice says so when it detects the signal. The signal does not turn the Analytics category off; to do that, use “Cookie settings” and choose “Essential only”, or untick Analytics.

7. How this policy relates to the Privacy Policy

This policy describes the mechanism: what is stored in your browser, why, and how you control it. The Privacy Policy describes the substance: what personal information RapidCents collects, the purposes for which it is used, how long it is kept, who it is disclosed to, and the rights you have in relation to it, including the right to access and correct it and how to make a complaint.

Where information read from a cookie or storage entry is personal information under applicable privacy law, the Privacy Policy governs how it is handled, and this policy does not narrow it. Where the two documents describe the same thing, read them together; if they conflict, the Privacy Policy prevails on questions of collection, use and disclosure, and this policy prevails on the description of the specific items set.

8. Changes to this policy, and how to reach us

RapidCents will update this policy when the categories offered by the notice change, when an item listed in section 3 is added, renamed or removed, when what runs before you choose changes, or when the law requires it. The revision date at the head of this page changes with every edit; the effective date changes only when the substance does.

Where a change would broaden what runs on your visit — a new category, a new recipient, or an existing category used for a materially different purpose — RapidCents changes the version of the notice, and an acceptance given to the earlier notice is not carried over, as section 4 describes: where the notice appears on its own, you are asked again; in the United States and in Canada outside Quebec, the default for where you are applies until you choose. Continuing to use the site after a purely descriptive change takes effect indicates acceptance of the revised text.

To change or withdraw a choice, use “Cookie settings” at the foot of any page. Questions about this policy, or a request to delete the record of your browser’s visits or an enquiry you sent, can be sent through the contact page at /contact, by telephone at +1-844-957-2743 in Canada or +1-202-902-6226 in the United States, or by mail to RapidCents Inc., 515 Consumers Road, Unit 210, North York, Ontario, M2J 4Z2, Canada.