Cookie Policy

1. The categories we use

• Necessary — cannot be turned off: sign-in, session security, language, remembering your cookie choice, and abuse prevention.
• Analytics — optional: aggregate measurement of platform usage that shows us which pages help and where merchants drop out of registration.
• Advertising and measurement — optional: identifying which advertising campaign brought a new merchant to Fawran, so marketing budget is not spent on what does not work.

2. Cookies we set on your device

• fawran_language — necessary — stores your interface language.
• fawran_consent — necessary — stores the choice you make on this page (up to 180 days).
• fawran_cr_ctx — necessary — a pseudonymous browsing-session id used for security and audit logging. It contains no name or email address.
• fawran_attr — advertising — stores campaign source (utm_source, utm_medium, utm_campaign and the click identifier) for up to 90 days.
• _fbp — advertising — set by the Meta Pixel to recognise the browser.
• _fbc — advertising — derived from the fbclid click identifier when you arrive from a Meta advertisement.

3. Meta Pixel and the Conversions API

When you consent to the advertising category we load the Meta Pixel in your browser and additionally send equivalent events from our own servers to Meta through the Conversions API. Both carry the same event identifier, so Meta counts them as one conversion rather than two.

The events we send are registration milestones only: page view, registration CTA click, account created, store created, verification application submitted, application approved, seller activated. We send no event about your sales, your products or your customers.

4. What reaches Meta — and what never does

• We send one-way SHA-256 hashed identifiers: your email address, your phone number where we hold one, and your internal account identifier. Meta cannot reverse a hash back to the original value.
• We send your IP address and browser type unhashed, because Meta requires those unhashed to match an event.
• We never send: passwords, one-time codes, bank account or IBAN details, verification or identity documents, support ticket contents, internal review notes, or any data about your orders and products.

5. Retention

• Your consent choice: up to 180 days, after which we ask again.
• Campaign source data (fawran_attr): up to 90 days.
• The technical request data needed to deliver a measurement event: erased as soon as the event is delivered.
• What Meta retains after receiving an event is governed by Meta's policies, not ours.

6. How to control your consent

Use the “Cookie preferences” link at the bottom of any public page. You can withdraw consent at any time.

When you withdraw advertising consent we: delete the _fbp and _fbc cookies from your device, remove the click identifier (fbclid) from the fawran_attr cookie, delete the advertising matching identifiers stored against your account on our servers, and stop sending any new measurement event to Meta — including queued events that have not yet been delivered.

What we keep after withdrawal: the name of the campaign your registration came from (utm_source, utm_medium, utm_campaign), in the fawran_attr cookie and on your account record. That data identifies a campaign rather than a person, serves a separate and disclosed purpose — calculating our own merchant acquisition cost in our own books — and is never sent to Meta or any third party on its own. It is retained for at most 90 days.

Withdrawing consent does not affect your ability to use the platform, register, or sell.

You can also clear cookies in your browser settings, or use the ad settings in your own Meta account.

7. Contact

For any question about this policy, or to request access to, correction of, or deletion of your data, contact us at admin@fawra.net.