Cookie Policy

_Last updated: 3 August 2026_

This Cookie Policy explains how TrustRating ("we", "us") uses cookies and similar technologies on trustrating.ai, business.trustrating.ai and our embeddable widgets, what each cookie does, how long it lives, and how you can control it. It supplements the Privacy Policy. You can change your choices at any time in the cookie settings panel — reachable from this page, from the cookie banner, and from the "Cookie settings" link in the footer of every page.

1. What cookies are

Cookies are small text files that a website stores on your device so it can recognise your browser between page views or visits. Without them, every page view would be a stranger arriving: you could not stay signed in, a form could not remember its steps, and a site could not even remember that you asked it not to use cookies. Related technologies serve the same purpose: local storage keeps data in your browser without sending it to the server on every request; session storage does the same for a single tab session; pixels are tiny images used to confirm an email or page was opened. When this Policy says "cookies" it covers all of these unless stated otherwise.

Cookies set by us are "first-party" cookies. Cookies set by other companies whose services are embedded in our pages — for example a payment provider during checkout — are "third-party" cookies, and those companies process them under their own privacy policies.

2. How we group cookies

We use four groups. Only the first is always on; the rest run only with your consent, and the banner you saw on your first visit records that choice per group.

Strictly necessary. Required for the Service to function at all: signing you in, keeping your session secure, remembering which linked identity (personal or business) is active, protecting forms against cross-site request forgery, remembering your cookie choices themselves, and applying essential preferences such as language. These cannot be switched off; without them the site simply does not work.

Functional. Quality-of-life preferences that are helpful but not essential — for example remembering a dismissed banner, a preferred list layout, or keeping your place in a multi-step form. Turning these off never breaks core functionality, it only makes the site slightly less convenient.

Analytics. Help us understand, in aggregate, how the Service is used: which pages are visited, how search is used, where errors happen. We use this to fix problems and improve features. Analytics data is processed for our own statistics, is not used to build advertising profiles, and is not sold — TrustRating shows no third-party advertising and sets no advertising or cross-site tracking cookies.

Attribution. If you arrive through an affiliate or referral link (a link under /a/), we set a first-party attribution cookie recording which partner referred you, so that a commission can be credited if you later subscribe to a paid business plan. This cookie identifies the referring partner, not your identity, and expires automatically at the end of the attribution window. Details of the program are in the API, Webhooks & Affiliate Program Terms.

3. The cookies we set

The exact set can evolve with the product; this list is kept current and describes each cookie's purpose and lifetime. Where a cookie spans both our consumer and business subdomains, that is deliberate — it lets you stay signed in as you move between the public site and the business panel.

• Session / authentication cookies — identify your signed-in session, carry its security token and expiry, and mark which of your linked identities is active. Lifetime: session or up to 30 days with "stay signed in". Strictly necessary.
• CSRF protection cookie — pairs each form submission with your session so third-party sites cannot submit forms in your name. Lifetime: session. Strictly necessary.
• Cookie-consent cookie — records the groups you accepted or declined so we do not ask again on every visit and never fire declined groups. Lifetime: up to 12 months. Strictly necessary (it stores the proof of your choice).
• Preference cookies — language/locale and similar interface preferences. Lifetime: up to 12 months. Functional.
• Analytics identifiers — a random identifier that lets us count unique visits and page flows without knowing who you are. Lifetime: up to 13 months. Analytics, consent-based.
• Affiliate attribution cookie — the referral code of the partner whose link brought you here. Lifetime: the attribution window of the program (typically 30–90 days). Attribution, consent-based.

Third-party cookies during payment. If you subscribe to a paid plan, the checkout and card pages are provided by Stripe (or NOWPayments for cryptocurrency payments). Those providers set their own cookies for fraud prevention and payment security on their domains, as described in their privacy policies. We receive only the outcome of the payment, never your card details — see the Payments & Refunds Policy.

Widgets. Our embeddable widgets are designed to display trust data on business websites without tracking visitors: they do not set advertising cookies and do not build profiles of the visitors of the sites that embed them. Aggregate impression counts may be recorded server-side for the business's own analytics. See the Widget & Embedding Terms.

Local and session storage. Alongside cookies, the Service keeps a small amount of data in your browser's local and session storage — draft text of a review you are writing so a mislaid tab does not destroy your work, interface state such as which panel you last had open, and short-lived caches that make navigation feel instant. This data stays on your device, is not transmitted with every request the way cookies are, and is cleared when you clear your browser's site data.

Email pixels. Transactional emails we send (invitations you asked a business to send, notifications, billing documents) may include a delivery/open pixel so we can detect broken delivery and show businesses whether their invitations arrive. We use this for deliverability and feature statistics, not to build marketing profiles, and the underlying processing is described in the Privacy Policy.

4. Your choices

The banner. On your first visit you can accept all groups, reject all optional groups, or configure them individually. We do not use "cookie walls": rejecting optional cookies never blocks access to the Service.

The settings panel. You can reopen the panel at any time from the footer or from this page and change any choice. Changes take effect immediately; already-set optional cookies are deleted when you withdraw consent for their group. Your choice is stored per browser and device — a laptop and a phone each keep their own consent — and signing in does not copy consent between devices, because the consent belongs to the browser, not the account.

What declining actually does. Declining the analytics group means your visits are simply absent from our aggregate statistics; declining attribution means affiliate referrals cannot be credited from your browser; declining functional cookies means small conveniences reset between visits. None of it hides content, slows the site, or nags you to reconsider.

Your browser. Every modern browser lets you view, block and delete cookies — globally, per site, or automatically at the end of each session. Look under Settings → Privacy in Chrome, Edge, Firefox or Safari. Two things to know: blocking strictly necessary cookies will break sign-in and forms on this and most other websites, and deleting the consent cookie will simply make our banner appear again.

Do Not Track and Global Privacy Control. Where your browser sends a recognised opt-out signal such as GPC, we treat it as a refusal of optional cookie groups for that browser.

5. Cookies and personal data

Some cookies contain or are linked to personal data (for example your session token is linked to your account). All such processing is covered by the Privacy Policy, including the legal bases we rely on: strictly necessary cookies are grounded in our legitimate interest in — and contractual obligation of — providing a secure, working service; all optional groups run on your consent under the applicable ePrivacy rules, which you may withdraw at any time with effect for the future.

6. How long consent lasts

Your consent choice is stored for up to 12 months, after which we ask again. We also re-ask whenever we add a new cookie group or materially change the purpose of an existing one, so your choice is always informed by the current facts.

7. Managing cookies in your browser, step by step

If you prefer browser-level control over our settings panel, every major browser offers it. Chrome: Settings → Privacy and security → Third-party cookies and Site settings → Cookies; from there you can block third-party cookies globally, list sites that may never or always set cookies, and clear existing cookies for a single site by clicking the icon left of the address bar. Edge: Settings → Cookies and site permissions → Manage and delete cookies and site data, with the same per-site controls. Firefox: Settings → Privacy & Security, where Enhanced Tracking Protection blocks known trackers by default and the Cookies and Site Data section lets you clear or block per site; Firefox also offers automatic deletion of cookies when the browser closes. Safari: Preferences → Privacy on macOS (Settings → Safari on iOS), where "Prevent cross-site tracking" is on by default and "Manage Website Data" lists every site's stored data for selective removal. On mobile browsers, the equivalent options sit in the browser's settings app under Privacy.

Two practical consequences to keep in mind. Blocking all cookies (including first-party) prevents signing in to TrustRating and virtually every other website with accounts — if you want maximal restriction with a working login, block third-party cookies and leave first-party allowed, which loses you nothing on this Service since we set no advertising cookies anyway. And clearing cookies removes the consent cookie too, so the banner will greet you again on your next visit — that is the system working, not a malfunction.

8. Frequently asked questions

Do I have to accept cookies to read reviews? No. Reading profiles, reviews and scores works with strictly necessary cookies alone, and those exist for security and preferences, not tracking.

Will rejecting optional cookies change what I see? Content is identical. The only differences are conveniences (remembered layouts) and that your visits are absent from our aggregate statistics.

Does TrustRating show me ads based on my browsing? No. There is no third-party advertising on the Service and no advertising cookies, so there is nothing to personalise.

Why did I see the banner again? Either your consent reached its 12-month expiry, you cleared cookies, you switched browsers or devices (consent is stored per browser), or we changed the cookie groups materially and re-asked everyone.

What is the affiliate cookie doing exactly? If you arrived through a partner's referral link, it remembers the partner's code so that, if you later buy a business plan, the partner is credited under the affiliate terms. It contains no name, no email, no browsing history — just the referral code and its timestamps — and if you decline the attribution group it is simply never set.

Can a business embedding a TrustRating widget track me through it? The widget shows the business's live score and reviews; it does not set advertising cookies on the embedding site and does not report your identity to anyone. See the Widget & Embedding Terms.

Is my consent choice itself tracked? We keep the minimal proof the law requires — which groups you accepted or declined, and when — inside the consent cookie in your own browser. That record is what lets us honour your refusal; deleting it just means being asked again.

Who can I ask about something not covered here? The help center answers the practical questions; the contact page reaches the privacy team for everything else.

9. Changes to this Policy

When we add, remove or change cookies we update this page and, where the change is material, refresh the consent banner. The "Last updated" date above always reflects the current version.

10. Contact

Questions about cookies or this Policy: use the contact page. For broader privacy questions and data-subject requests, see the Privacy Policy.