Cookie Policy

1. What Cookies Are

Cookies are small text files that a website stores on your device (computer, tablet, or phone) when you visit it. They allow the website to recognise your device, keep you signed in, and remember choices you have made. Similar technologies, such as entries in your browser's local storage, can serve the same purposes; where this policy refers to "cookies", it includes such similar technologies.

This Cookie Policy explains which cookies are set by the Aopy websites and platform (aopy.com and app.aopy.com), why they are set, and how you can control them. It supplements our Privacy Policy, which describes more broadly how Easy Life Tech SRL ("Aopy", "we", "us") processes personal data.

2. Cookies We Set

Our own cookies are first-party and functional: we set no first-party tracking or advertising cookies anywhere. Every cookie below falls into one of two groups: cookies we set ourselves (first-party — strictly necessary, or functional where the table says so), and cookies our analytics/advertising vendors set on our marketing pages, and only once you grant the matching category in our cookie banner.

This policy covers aopy.com and app.aopy.com. If you are visiting an online shop that uses Aopy, the sign-up window and visitor-recognition cookies our software sets on that shop are described in our Data Processing Guidelines, and it is the shop that decides whether and how to ask you for consent to them.

2a. First-party cookies (set by us)

Cookie	Type	Purpose	Duration
aopy_consent	First-party, strictly necessary	Stores your cookie-consent choices for the four categories described below (necessary, functional, analytics, marketing). If you made a choice under our previous cookie name (used under our earlier brand), it was automatically carried over to this cookie so nothing was lost or reset.	12 months (SameSite=Lax; Secure)
*sb--auth-token** (Supabase)	First-party, strictly necessary	Holds your authentication session (a JSON Web Token) and is managed by our authentication provider so that you stay signed in to your account.	For the lifetime of your session, refreshed automatically while you remain signed in
sb-role-reval-at	First-party, strictly necessary	Records when your permissions were last re-checked against our database, so that a change to your role in the platform takes effect straight away instead of waiting for your session token to be renewed.	5 minutes (HttpOnly; SameSite=Lax; Secure)
aopy_lead	First-party, strictly necessary	Set when you submit one of our public marketing forms. It identifies that submission to our server, so the ROAS Calculator can unlock the full report you asked for without making you enter your details a second time. It is not readable by scripts on the page, and it authorises nothing beyond that unlock.	180 days (HttpOnly; SameSite=Lax; Secure)
aopy_lead_hint	First-party, functional	Written at the same moment as the cookie above, and holding only a masked form of the address you gave us (for example `a***@shop.ro`), so that a marketing page can show "we already have your details" instead of asking you to fill the form again. It grants no access: every action that matters re-checks the cookie above on our server. It is not used for analytics or advertising.	180 days (SameSite=Lax; Secure)
roas_access	First-party, strictly necessary	Holds the access token for the ROAS Calculator Pro report you requested, so that the report opens on your device and from the link we email you.	180 days (HttpOnly; SameSite=Lax; Secure)
ga4_oauth_state, gm_oauth_state, meta_oauth_state, meta_oauth_temp, shopify_oauth_state, shopify_integration_name, shopify_install_intent, tiktok_oauth_state, tiktok_oauth_temp, gm_oauth_temp, canva_oauth_state, canva_pkce_verifier, canva_return_to, canva_return_jwt	First-party, strictly necessary	Set only while you are connecting a third-party integration (Google Analytics 4, Google Merchant Center, Meta, Shopify, TikTok or Canva), and read once when that provider sends you back to us. They hold a single-use security token proving the return trip is yours, the matching proof key for it, the name you gave the integration, a short-lived reference to the accounts you can pick from, the Canva return token kept while you sign in, and the page to return you to. They are deleted as soon as the connection completes.	30 minutes, or until the connection completes (HttpOnly; SameSite=Lax; Secure)

2b. Third-party cookies (set only after you grant consent)

On our public marketing pages and our ROAS Calculator, the vendor cookies below are loaded only if you grant the matching category in the cookie banner. If you decline a category, or have not yet made a choice, that vendor's script never loads and none of its cookies are set. These cookies are never set on the app dashboard. Each vendor controls its own cookie lifetime, which can change on their side without our involvement; the durations below are their currently published defaults.

Cookie	Type	Purpose	Duration
_ga, _ga_<container-id>	Third-party (Google Analytics — GA4), Analytics category	Distinguishes visitors and persists session state for our Google Analytics 4 measurement on the marketing pages. Set only if you grant the "Analytics" category.	Up to 13–24 months (Google's current default; see Google's own cookie policy for the authoritative figure)
_fbp	Third-party (Meta Pixel), Marketing category	Used by Meta to measure ad performance and campaign attribution for our marketing pages. Set only if you grant the "Marketing" category.	90 days (Meta's current default)
_ttp, _tt_enable_cookie	Third-party (TikTok Pixel), Marketing category	Used by TikTok to measure ad performance and campaign attribution for our marketing pages. Set only if you grant the "Marketing" category.	~13 months (TikTok's current default)

We do not place any other third-party analytics, advertising, or social-media cookies beyond the ones listed above, and none of them are set unless and until you grant the matching consent category.

3. Consent Categories

Our cookie banner lets you decide per category. The four categories are:

Necessary — required for the websites and the platform to function (for example, authentication and storing your consent choices). These cookies are always on and cannot be disabled; under applicable ePrivacy rules (in Romania, Law no. 506/2004), strictly necessary cookies do not require consent.
Functional — remembers optional preferences and enables enhanced features. One cookie in use: aopy_lead_hint (Section 2a), which lets a marketing page recognise that you have already given us your details and show a short confirmation instead of the form. It is written together with the strictly necessary lead cookie at the moment you submit one of our forms, it holds only a masked form of your own address, and it is never used for analytics or advertising. We set no other functional cookies.
Analytics — helps us understand how our marketing pages and ROAS Calculator are used. In use on our marketing pages: granting this category loads Google Analytics 4 (GA4), which sets the _ga and _ga_<container-id> cookies described in Section 2. Not used on the app dashboard.
Marketing — supports measuring advertising campaigns and conversions on our marketing pages. In use on our marketing pages: granting this category loads the Meta Pixel and TikTok Pixel, which set the _fbp, _ttp, and _tt_enable_cookie cookies described in Section 2. Not used on the app dashboard.

To be clear: cookies in the "necessary" category are always set; cookies in the "analytics" and "marketing" categories are set only on our public marketing pages (including the ROAS Calculator), and only once you grant the matching category — never on the app dashboard, and never before you choose. The one functional cookie we set, aopy_lead_hint, is described in Section 2a and in the "functional" bullet above. If we add further functional cookies, or further analytics/marketing vendors, we will first update this policy and the cookie banner.

4. Managing Your Preferences

You can review and change your cookie choices at any time:

Cookie Preferences link — every page in our legal section carries a "Cookie Preferences" link in the footer that reopens the consent banner, where you can change your choices per category. Withdrawing consent is as easy as giving it.
Browser controls — most browsers let you block or delete cookies through their settings. If you delete the consent cookie, the banner will appear again on your next visit. Note that blocking strictly necessary cookies (such as the authentication cookie) will prevent you from signing in to the platform.

Withdrawing your consent does not affect the lawfulness of any processing carried out before the withdrawal.

5. How We Log Your Consent

When you make a choice in the cookie banner, we record that choice server-side in an append-only audit log. The record includes: a visitor or user identifier, the categories you accepted or declined, the version of the banner you were shown, your IP address, and your browser's user-agent string. Entries in this log are only ever added, never altered.

We keep this log so that we can demonstrate, if required, that consent was validly obtained (accountability under Art. 5(2) and Art. 7(1) GDPR). For how long we retain personal data generally, and for your rights over this data, see our Privacy Policy.

6. Changes to This Policy

We may update this Cookie Policy as the platform evolves — for example, if we introduce a new cookie, add a new third-party vendor, or activate the currently-unused functional category. When we do, we will update the table and statements above and increment the version of the cookie banner; where the change requires it, we will ask for your renewed consent before any new cookie is set.

The date of the latest revision is shown at the top of this page. We encourage you to review this policy periodically.

7. Contact

If you have questions about our use of cookies or about this policy, contact our Privacy Team at privacy@aopy.com, or write to Easy Life Tech SRL, Șos. București-Ploiești, Nr. 15, Imobilul 2 - Spațiu Comercial, Etaj 5, Sector 1, București, Romania.

You also have the right to lodge a complaint with the Romanian supervisory authority: Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, București, www.dataprotection.ro.

8. Language

This Cookie Policy is published in English and in Romanian. In the event of any inconsistency or difference in interpretation between the two versions, the English version prevails.