Cookie Notice
About This Notice
This Cookie Notice explains how VaultifyUK Labs ("we", "us", "our"), operated by VaultifyUK Limited (Company Number: 16878679), uses cookies and similar technologies in connection with our Services.
"Services" has the same meaning as in our Privacy Policy. This Notice supplements our Privacy Policy and should be read alongside it.
What Are Cookies?
Cookies are small text files placed on your device by a website or application when you visit or use it. They are widely used to make services work correctly, to remember your preferences, and to provide information to the operators of websites and applications.
Cookies are not the only technology used to store or access information on a device. Similar technologies include local storage, session storage, and pixel tags. References to "cookies" in this Notice include all such similar technologies unless otherwise stated.
How Our Services Use Cookies
Our Services consist primarily of embedded applications delivered within third-party platform environments (such as the Shopify Admin). In this context:
- Our Services run inside a platform-controlled frame, not as standalone websites visited directly.
- Authentication and session continuity are provided by the Shopify App SDK, which sets a small number of strictly necessary session cookies during the OAuth authentication flow.
- We do not use cookies for analytics, advertising, personalisation, or any purpose beyond what is strictly necessary to operate the authenticated application session.
Where any of our Services are accessed via a standalone website (for example, a documentation site or landing page), that website may set additional cookies for session security. Any such cookies will be described in a notice specific to that website.
Cookies We Set
Strictly Necessary Cookies
The following cookies are set during the authentication process. They do not require consent under UK PECR because they are strictly necessary to provide a service explicitly requested by the user.
| Cookie | Provided by | Purpose | Duration |
|---|---|---|---|
| OAuth state cookie | VaultifyUK Labs (via Shopify App SDK) | A temporary token used to protect against Cross-Site Request Forgery (CSRF) attacks during the OAuth authentication handshake. Automatically deleted once authentication completes. | Approximately 1 minute; deleted after the authentication callback |
| OAuth state signature cookie | VaultifyUK Labs (via Shopify App SDK) | Allows the server to verify the OAuth state cookie has not been tampered with. Deleted alongside the state cookie. | Approximately 1 minute; deleted after the authentication callback |
The specific cookie names used are determined by the Shopify App SDK and may vary between SDK versions. Both cookies are HttpOnly (inaccessible to JavaScript) and Secure (HTTPS only).
Once authentication is complete, this application operates entirely as an embedded app within the Shopify Admin. In this context, authentication is maintained using short-lived session tokens (JWTs) issued and managed by Shopify App Bridge and transmitted via HTTP headers — not browser cookies. VaultifyUK Labs does not set any persistent session cookies on your device during normal application use.
Cookies We Do Not Set
We do not currently use, and have not deployed, any of the following:
Analytics cookies. No analytics platform (such as Google Analytics, Mixpanel, or Plausible) is currently integrated into our Services. We do not track page views, user journeys, or behavioural data through cookies.
Advertising and targeting cookies. We do not use cookies for advertising, remarketing, or audience targeting.
Social media cookies. We do not embed social sharing buttons or social platform widgets that would set third-party cookies.
Performance or preference cookies. We do not currently use cookies to remember user preferences or to measure application performance through third-party tools.
This section will be updated if any of the above are introduced.
Third-Party Cookies
Shopify Admin Environment
Our Shopify-integrated applications are delivered within the Shopify Admin interface. When you use the Shopify Admin, Shopify Inc. sets its own cookies on the myshopify.com and shopify.com domains. These cookies are governed by Shopify's Cookie Policy and are outside our control.
No Other Third-Party Cookies
We do not embed third-party scripts, widgets, or pixels that would cause other parties to set cookies on your device.
Managing Cookies
Browser settings
You can control and delete cookies through your browser settings. Most browsers allow you to:
- view cookies that have been set,
- delete cookies individually or all cookies from a domain, and
- block cookies from specific sites or all sites.
Instructions for the most common browsers are available at:
Important: Deleting or blocking the strictly necessary session cookies described in this Notice will prevent you from using our authenticated Services. You will need to re-authenticate if session cookies are deleted.
Withdrawing consent
Our current Services do not use non-essential cookies, so there is no consent to withdraw in respect of our own cookies. If we introduce non-essential cookies in the future, we will provide a mechanism to manage consent at that time.
Updates to This Notice
We may update this Notice from time to time to reflect changes to our Services or applicable law. The "Last updated" date at the top of this Notice reflects the most recent revision. Where changes are material, we will notify you in accordance with our Privacy Policy.
Contact
For questions about this Cookie Notice or our use of cookies:
VaultifyUK Labs Email: privacy@labs.vaultifyuk.co.uk