DRAFT — requires review by Canadian privacy counsel before publication. Not in force.
Last updated: 1 November 2026 · Effective: [DATE OF PUBLICATION] · Français
This notice explains the cookies and similar technologies (browser storage, scripts and signals) used (A) on Nysroc's own sites — nysroc.com, our sign-up, sign-in and account pages, the website editor and workspaces — and (B) on websites that our customers build and host with Nysroc. It forms part of our Privacy Policy.
In one sentence: we use only first-party technology, nothing optional runs until you say yes, and we honour Global Privacy Control and Do Not Track.
We use only strictly necessary and preference cookies here. We do not use advertising or cross-site tracking cookies, and we do not load third-party advertising or analytics scripts.
| Name | Set by / where | Purpose | Type | Lifetime |
|---|---|---|---|---|
nysroc_session |
Nysroc Accounts (nysroc.com) | Keeps you signed in to your account page; signed and tamper-proof, HttpOnly, Secure | Strictly necessary | Browser session; server-enforced expiry after 8 hours |
nysroc_oidc |
Nysroc Accounts | Protects the sign-in flow (security state while you sign in) | Strictly necessary | 10 minutes, deleted after sign-in |
nysroc_pos_tenant |
Nysroc Accounts | Remembers which workspace is connecting a point-of-sale account during the connection | Strictly necessary | 10 minutes |
nysroc_lang |
Nysroc Accounts | Remembers your language (English or French) | Preference | 1 year |
| Nysroc Login session cookies (several) | Nysroc Login (sign-in service) | Single sign-on, multi-factor authentication and protection against cross-site request forgery | Strictly necessary | Session, or up to the maximum sign-in session length you or your administrator set |
Workspace session cookies (for example sid) |
Your workspace (yourbusiness.nysroc.com/app) |
Keep you signed in to your workspace and remember display settings | Strictly necessary | Session / workspace session length |
| Payment page cookies | Stripe, on Stripe's own checkout and billing pages (not on nysroc.com) | Payment security and fraud prevention, under Stripe's cookie policy | Strictly necessary (third party, on its own domain) | Set by Stripe |
| Google sign-in | Google, on Google's own pages, only if you choose "Sign in with Google" | Authenticating you with your Google account | Strictly necessary (third party, on its own domain) | Set by Google |
Fonts. nysroc.com, the sign-up and account pages, the sign-in pages and websites built on Nysroc serve the Plus Jakarta Sans typeface from Nysroc's own servers (the site's own address). No request goes to Google Fonts or any other font service.
Abuse protection without CAPTCHA. Our forms use a
proof-of-work check that runs in your browser (pow.js). It
stores nothing and contacts no third party.
Because only strictly necessary and preference cookies are used here, no consent banner appears on nysroc.com. If we ever add optional measurement to nysroc.com, it will use the same opt-in banner as section B.
Every published Nysroc website loads Nysroc
Analytics: a first-party script (/_n/a.js) served
from the website's own domain, which sends measurements
only to that same domain (/_n/collect). The business that
owns the website decides to use it and is responsible for it; Nysroc
processes the data on the business's behalf (see Privacy Policy section
3).
| Category | What it does | What is stored in the visitor's browser | Lifetime |
|---|---|---|---|
| Always on (no identifier) | Counts page views, referrer, campaign tags (UTM), whether an ad link was followed (not the ad click ID), form submissions, store purchases, phone-link clicks. Uses a daily-rotating, non-reversible visitor key computed on the server from the site, IP address and browser type with a secret that changes daily; the IP address is never stored; visits cannot be linked across days. | nysroc_lt in sessionStorage: the
landing-page campaign tags and referrer for the current visit, so a form
submitted later in the same visit is credited to the right source |
Until the tab or browser session ends |
| Site measurement ("Mesure d'audience") | Recognises returning visitors on this site only and remembers the first source that brought the visitor | _nya first-party cookie (random
20-character ID); nysroc_ft in
localStorage (first-visit source) |
_nya: about 13 months (395 days);
nysroc_ft: until cleared or consent withdrawn (withdrawing
consent, or turning on Global Privacy Control, deletes both
_nya and nysroc_ft) |
| Advertising (attribution) ("Publicité (attribution)") | Keeps the ad click identifier from the link (gclid, gbraid, wbraid, msclkid, fbclid, li_fat_id, ttclid) so the business can see which ad worked, and — if the business runs ads through Nysroc Ads — lets Nysroc send that conversion server-to-server to the business's own ad account with SHA-256-hashed email/phone. No pixel or tag from any ad network is loaded in the browser. | Click ID kept with the visit data (sessionStorage) | Visit |
| Consent record | Remembers the visitor's choice so the banner does not reappear | nysroc_consent in localStorage:
{analytics, marketing, at, v} |
Until cleared, or the visitor changes it |
A business can add its own code (for example a chat widget or a video
embed) to its Nysroc site. Anything it adds is its responsibility and
should be disclosed in its own privacy notice. Every Nysroc site gets a
starter privacy notice at /privacy (in the site's language)
that the business should review and complete; the consent banner and the
site footer link to it. A business can replace it with its own page at
the same address.
Questions: privacy@nysroc.com · Privacy Officer, Nysroc — Scopien Technologies Inc., 300-416 North Service Road East, Oakville, Ontario L6H 5R2, Canada.