KARRABO
0%
This policy covers cookies and similar client-side storage used across Karrabo’s web properties — the Manager Dashboard and Checkout — and how each one uses them.
| Property | What it is | Production domain |
|---|---|---|
| Manager Dashboard | Client-facing dashboard + onboarding portal | dashboard.karrabo-development.com |
| Checkout | Standalone payment checkout widget, used full-page or embedded in a merchant’s site via <iframe> | checkout.karrabo-development.com |
Each runs on its own subdomain and does not share cookies with the other — a cookie set on dashboard.karrabo-development.com is not readable on checkout.karrabo-development.com, and vice versa. This policy also covers localStorage and sessionStorage, since browsers and regulators generally treat both as “similar technologies” requiring the same disclosure.
This policy does not cover the Karrabo sign-in page you’re redirected to when you log in — it runs on a separate domain, manages its own session, and is governed by its own cookie practices.
| Name | Purpose | Type | Expiry | Notes |
|---|---|---|---|---|
| refreshToken | Keeps you signed in; used server-side to obtain new access tokens and gate access to the dashboard | Strictly necessary | 30 days | Security-flagged (HttpOnly, Secure) — not readable by JavaScript. Deleted on logout or failed refresh. |
| invitation_data | Carries a signed record of a prospective client’s onboarding invitation through the multi-step onboarding flow | Strictly necessary | 1 hour | Security-flagged, signed and tamper-proof. Only set if you arrive via an onboarding invitation link. |
| sidebar_state | Remembers whether the dashboard sidebar is expanded or collapsed | Preference | 7 days | Plain client-side value, no personal data. |
localStorage: stores your access token, used to keep you signed in across page reloads and browser tabs and to authorize requests to our servers. Encrypted at rest. Cleared when you log out.
The checkout widget sets no cookies at all.
| Storage | Key | Purpose | Notes |
|---|---|---|---|
| sessionStorage | wallet payment session snapshot | Resumes an in-progress wallet payment after the customer is redirected out to a wallet provider’s OAuth page and back (/wallet/callback) | Cleared once the payment resumes or completes. Scoped to the browser tab; gone when the tab closes. |
When embedded via <iframe> on a merchant’s own site, the widget communicates size/state to the parent page via postMessage, not cookies. Because it sets nothing, it is unaffected by browser third-party-cookie blocking.
Neither property loads third-party analytics, advertising, or social-media trackers (e.g. Google Analytics, Meta Pixel, Hotjar).
We may update this policy as our cookies or storage change. Material changes (e.g. a new tracker or a new purpose for an existing cookie) will be reflected here with an updated “Last updated” date.
For questions about this policy, contact Karrabo Financial Solutions Limited through your normal account/support channel.
Reach out and we’ll help you understand how it applies to you.
Contact us