Cookie policy

1. Cookies we set

ordyum.session_token (with the __Secure- prefix over HTTPS): keeps you signed in. Strictly necessary. It lasts up to 30 days and is renewed while you use Ordyum.

Short-lived sign-in cookies: created during two-step verification or «Continue with Google / Microsoft» and removed when that step ends.

ordyum.impersonation: only for our support staff when an agency asks them to look at its account. It expires on its own and every access is recorded in the agency’s audit log.

2. Stored in your browser (not cookies)

Your language, light or dark theme, last workspace, the email remembered on the sign-in page (only if you choose it) and whether you have seen the latest changes are kept in your browser’s local storage. They never leave your device and you can clear them from your browser settings.

3. Speed measurement without cookies

To keep pages fast we record anonymous speed metrics (Core Web Vitals) with the page template and device type: no cookie, no user and no IP address. They are deleted after 30 days.

4. Forms on agencies’ websites

Ordyum forms embedded on an agency’s website can read that website’s own ad click cookies (_fbc, _fbp) if the site has already set them, to attribute the lead to its campaign. Those cookies belong to the agency’s website and are covered by its cookie policy and consent banner.

5. Third parties

Cloudflare, which protects and speeds up the site, may set strictly necessary security cookies (such as __cf_bm) to filter automated traffic. Stripe and PayPal payment pages set their own cookies under their policies.

6. Managing cookies

You can delete or block cookies in your browser settings. If you block the session cookie, you will not be able to sign in.