---
title: "Cookie Policy, Mercemur"
description: "Which cookies Mercemur sets, why, how long they last, and how you can re-manage your consent."
canonical_url: "https://mercemur.com/legal/cookies"
last_updated: "2026-09-15"
---

Legal

# Cookie Policy

Which cookies Mercemur sets, why, how long they last, and how you can re-manage your consent.

1.  [Home](https://mercemur.com/)
3.  [Legal](https://mercemur.com/legal)
5.  Cookie Policy

Last updated: May 30, 2026Version 1.0

On this page

1.  [What cookies are](https://mercemur.com/legal/cookies#what-are-cookies)
2.  [Categories we use](https://mercemur.com/legal/cookies#categories)
3.  [Cookie inventory](https://mercemur.com/legal/cookies#inventory)
4.  [Consent mechanics](https://mercemur.com/legal/cookies#consent-mechanics)
5.  [Re-manage your consent](https://mercemur.com/legal/cookies#re-manage)
6.  [Browser controls](https://mercemur.com/legal/cookies#browser-controls)
7.  [Do Not Track and GPC](https://mercemur.com/legal/cookies#do-not-track)
8.  [Changes to this policy](https://mercemur.com/legal/cookies#changes)
9.  [Contact](https://mercemur.com/legal/cookies#contact)

## What cookies are

Cookies are small text files that websites store in your browser. They are used for authentication, preferences, analytics, and marketing. Similar technologies (local storage, session storage, web beacons, pixels, SDKs) work the same way for the purposes of this policy.

## Categories we use

### Strictly necessary

Required for the platform to function. No consent required under GDPR or ePrivacy. These include the auth session, CSRF token, the consent state itself, and language preference. Disabling these will break sign-in and core checkout.

### Performance and analytics

Help us understand which pages and features people use so we can improve them. Consent required in EEA and UK. Includes Cloudflare bot detection and our internal product analytics.

### Functional

Remember the preferences you set: theme, layout, recently viewed items in the admin. Used under consent or legitimate interest.

### Marketing

Consent-required, opt-in only. Mercemur itself does not run advertising cookies on mercemur.com today. If a merchant enables advertising on their storefront, that merchant discloses those cookies in their own cookie notice.

## Cookie inventory

A summary of cookies set by Mercemur or by third parties we integrate.

| Name | Set by | Category | Purpose | Duration | Host | GDPR class |
| --- | --- | --- | --- | --- | --- | --- |
| mercemur\_session | Mercemur | Strictly Necessary | Auth session | Session | .mercemur.com | Exempt |
| mercemur\_csrf | Mercemur | Strictly Necessary | CSRF token | Session | .mercemur.com | Exempt |
| mercemur\_consent | Mercemur | Strictly Necessary | Consent state | 12 months | .mercemur.com | Exempt |
| mercemur\_locale | Mercemur | Strictly Necessary | Language preference | 12 months | .mercemur.com | Exempt |
| \_\_cf\_bm | Cloudflare | Performance | Bot detection | 30 min | .mercemur.com | Consent in EEA |
| \_ph\_\* | Product analytics | Analytics | Product usage | 12 months | .mercemur.com | Consent |

## Consent mechanics

-   First-visit banner with granular per-category toggles. Strictly necessary cookies are always on; other categories are off by default in the EEA and UK.
-   "Save preferences", "Accept all", and "Reject all" buttons are given equal visual weight. Pre-ticked boxes are prohibited under GDPR.
-   Consent log retained for 13 months per CNIL guidance: decision, timestamp, IP truncated to /24, user agent.
-   We honor "Do Not Track" and "Global Privacy Control" signals where browsers send them.

## Re-manage your consent

You can change your cookie preferences at any time. Open the consent banner from the footer link "Manage cookies", or click below:

Manage cookie preferences

The button reopens the consent banner via the global window.dispatchEvent(new Event("mercemur:consent:open")) hook the chrome layer listens for.

## Browser controls

You can also block or delete cookies in your browser settings. Blocking strictly necessary cookies will prevent sign-in and checkout from working.

-   [Cookie settings in Google Chrome](https://support.google.com/chrome/answer/95647)
-   [Cookie settings in Firefox](https://support.mozilla.org/en-US/kb/cookies-information-websites-store-on-your-computer)
-   [Cookie settings in Safari](https://support.apple.com/guide/safari/manage-cookies-sfri11471/mac)
-   [Cookie settings in Microsoft Edge](https://support.microsoft.com/en-us/microsoft-edge/delete-cookies-in-microsoft-edge-63947406-40ac-c3b8-57b9-2a946a29ae09)

## Do Not Track and GPC

We honor the Global Privacy Control signal. The Do Not Track header has no standardized semantics, so we treat it as a request to disable non-essential cookies, matching our GPC handling.

## Changes to this policy

Material changes trigger a banner re-prompt and a public post. Current version 1.0, effective May 30, 2026.

## Contact

For cookie-related questions, write to [support@mercemur.com](mailto:support@mercemur.com). For everything else privacy-related, see our [Privacy Policy](https://mercemur.com/legal/privacy).

## Sitemap

- [Site index (llms.txt)](https://mercemur.com/llms.txt): every public page, described
- [Sitemap (sitemap.md)](https://mercemur.com/sitemap.md): every public URL with its last-modified date
- [AGENTS.md](https://mercemur.com/AGENTS.md): how to build against the platform
- [Developer documentation](https://docs.mercemur.com/llms.txt): API reference, CLI, MCP