Cookie notice
Draft for review by counsel. This is not legal advice. Text in [square brackets] must be filled in or confirmed before publication.
Effective [date]. Version 0.1.
This notice lists every cookie and similar technology that CasinoOS pages and widgets use. CasinoOS uses no advertising or analytics cookies.
1. Cookies and storage
| Name | Type | Set by | Purpose | Lasts | Needs consent? |
|---|---|---|---|---|---|
cos_sid | Cookie, HttpOnly, SameSite=Strict | The hub, when a staff member signs in | Keeps the staff member signed in. | Ends after 12 hours without use, or 7 days at most | No, strictly necessary |
cos_pid | Cookie, HttpOnly, SameSite=Strict | The partner portal, when an affiliate signs in | Keeps the affiliate signed in. | As above | No, strictly necessary |
cos_rid | Cookie, HttpOnly, SameSite=Strict | The SailorDeck partner panel, when a partner signs in | Keeps the partner signed in. | As above | No, strictly necessary |
sd_ref | Cookie, first-party, HttpOnly, SameSite=Lax | sailordeck.com, after someone who opened a SailorDeck partner's personal link (/r/...) chooses "Accept all" in the cookie banner | Holds only the partner's 8-character code, so that a business that contacts SailorDeck later is credited to the partner who sent it. Holds nothing about the visitor. A later link visit does not replace it. | 90 days | Yes. Set only after the visitor accepts. |
sd_consent | Local storage, first-party | sailordeck.com, when the visitor answers the cookie banner | Remembers "Accept all" or "Only necessary" so the banner does not come back. | Until the visitor clears site data | No. Strictly necessary to remember the choice. |
casinoos-chat:conversation | Local storage | The live chat widget, on the operator's website | Keeps the chat id, so the conversation is still there when the page is reloaded. Holds no message text. | Until the visitor clears site data | No, strictly necessary for the chat the visitor opened |
The web form widget sets no cookies and uses no storage. sd_ref is set only on sailordeck.com, never on an operator's site. The affiliate tracking link sets no cookies either. See section 2.
2. Affiliate tracking links
The operator's affiliate programme runs in CasinoOS. When someone clicks an affiliate's tracking link, CasinoOS records the click and sends the visitor on to the operator's site. CasinoOS sets no cookie and reads nothing from the visitor's device. Instead, it adds a reference to the address of the landing page (?btag=...), which tells the operator which affiliate sent the visitor.
If the operator's site wants to keep that reference, so that a visitor who registers on a later visit is still credited to the affiliate, it must store it itself, under its own cookie notice. Under the ePrivacy rules in the EU and the UK's PECR, this generally needs the visitor's consent. The operator should store the reference only after the visitor agrees in its own consent banner. Without consent, the reference can still be passed on when the visitor registers in the same visit.
CasinoOS credits a registration to an affiliate only within the operator's attribution window after the click: 30 days by default, up to 365.
The click record holds the time, the link, the country and hashes of the IP address and browser details. It is personal data, processed for the operator under the data processing agreement.
[Counsel: confirm for each market that a reference in the landing URL and the click record need no ePrivacy consent, and that the operator's first-party storage of the reference falls under the operator's own consent banner.]
2a. SailorDeck partner links
SailorDeck runs its own partner programme, under the partner programme terms. When someone opens a partner's personal link, sailordeck.com counts the visit for that day and shows the home page with the partner's code in the address. The cookie banner then asks whether the visitor accepts the sd_ref cookie. Only if they choose "Accept all" is sd_ref set. If the visitor later sends the contact form, the code in the cookie is stored with the enquiry so that the partner can be paid if the business becomes a customer. The visit count holds no IP address or browser details.
If the visitor chooses "Only necessary", no cookie is set. The partner's code is placed in the "How did you hear about us?" field of the contact form, where the visitor can see it and remove it. The browser remembers the choice in local storage (sd_consent), so the banner does not come back. To change the choice, clear the site data for sailordeck.com.
[Counsel: confirm the banner wording and that placing the code in a visible form field the visitor submits needs no consent.]
3. Third-party requests
The hub and the partner portal load the Plus Jakarta Sans font from Google Fonts (fonts.googleapis.com, fonts.gstatic.com). Google receives the visitor's IP address and browser details when the font is fetched. Google Fonts does not set cookies. [Consider serving the font from CasinoOS's own server, which removes this request.] The legal pages, the chat widget and the web form widget make no third-party requests.
4. Managing cookies
You can delete cookies and site data in your browser settings. If you delete cos_sid, cos_pid or cos_rid, you will be signed out. If you delete sd_ref, a later enquiry is not credited to the partner whose link you used. If you delete the chat storage, the widget starts a new conversation.
5. Contact
Questions about this notice: [privacy contact]. See also the privacy notice.