Cookie Policy

This Cookie Policy explains how Crederoom Inc. ("Crederoom", "we", "us", "our") uses cookies, pixel tags, local storage objects, SDKs and similar tracking technologies on crederoom.com, in our mobile applications, inside the investor dashboard, and across any related digital properties operated by Crederoom (collectively, the "Platform"). It should be read together with our Privacy Policy and Terms of Use, which together form the complete framework governing how we handle your personal information and interactions with our services.

We believe transparency is the foundation of trust in financial technology — especially in autonomous AI investing. That is why this Cookie Policy avoids legal theatre and corporate jargon wherever possible, and instead explains, in plain English, exactly what cookies we deploy, why we deploy them, how long they live on your device, how you can control them, and what happens if you disable them. By continuing to use crederoom.com, you confirm that you have read, understood and consented to the use of cookies as described below. If you do not agree with any part of this policy, please adjust your browser settings or exit the Platform.

1. What Are Cookies?

Cookies are small text files — typically no more than a few kilobytes in size — that are placed on your device (desktop, laptop, tablet or mobile phone) by the websites you visit. They are a standard web technology used by virtually every modern online service, from your bank's online portal to your favourite streaming platform. Cookies allow websites to remember your actions and preferences (such as login state, language, currency, timezone, consent choices and dashboard layout) over a period of time, so you do not have to re-enter them every time you return to the site or move between pages.

Alongside traditional HTTP cookies, Crederoom may also use a handful of adjacent technologies that serve similar purposes:

• Pixel tags (web beacons) — tiny transparent images embedded in web pages or emails to measure engagement;
• Local Storage & Session Storage — browser-based storage APIs holding larger pieces of data than classic cookies;
• IndexedDB — client-side database used to speed up the investor dashboard and cache market charts;
• Mobile SDK identifiers — technical IDs used within the Crederoom mobile app for crash reporting and secure session management;
• Device fingerprinting — a combination of non-sensitive technical signals (user-agent, timezone, screen size) used solely for fraud prevention and 2FA.

Throughout this document, the word "cookies" is used as a convenient umbrella term that covers all of the technologies listed above, unless we specifically indicate otherwise.

2. First-Party vs. Third-Party Cookies

Cookies on crederoom.com fall into two broad categories based on who sets them:

• First-party cookies — set directly by Crederoom under the crederoom.com domain. These are essential for the Platform to work correctly and are fully under our control. We use first-party cookies primarily for authentication, security, session management and remembering your preferences.
• Third-party cookies — set by trusted external service providers whose scripts run on parts of our Platform. Examples include payment processors, KYC-verification providers, analytics vendors (such as privacy-respecting alternatives to Google Analytics) and live-chat software. Third-party cookies are governed by the privacy policies of their respective providers, which we encourage you to review.

3. Session vs. Persistent Cookies

Cookies can also be grouped by lifespan:

• Session cookies — temporary cookies that exist only for the duration of your browsing session and are automatically deleted when you close your browser. We use them for login state, CSRF protection and in-session dashboard behaviour.
• Persistent cookies — cookies that remain on your device for a predefined period (ranging from a few hours to 24 months) or until you manually delete them. We use them to remember your language, dashboard theme, two-factor-authentication trust and other long-lived preferences.

4. Categories of Cookies We Use

Crederoom classifies every cookie it deploys into one of four well-defined categories. This classification powers our Cookie Consent Banner and allows you to granularly accept or decline each category.

4.1 Strictly Necessary Cookies (always on)

These cookies are absolutely essential for crederoom.com to function. Without them, you simply cannot log in, maintain a secure session, submit a withdrawal or receive 2FA codes. Because they are indispensable, these cookies cannot be disabled through our consent banner — only by blocking all cookies in your browser, which will make the Platform entirely unusable.

Examples include:

• Session authentication tokens (secure, HttpOnly, SameSite=Strict);
• CSRF (Cross-Site Request Forgery) protection tokens;
• Load-balancer stickiness identifiers;
• Cookie-consent record itself (so we know you have expressed a preference);
• Fraud-prevention and bot-detection signals;
• Rate-limiting counters that protect the API from abuse.

4.2 Functional Cookies (opt-in)

Functional cookies enhance your user experience by remembering choices you make and personalising crederoom.com accordingly. They are not strictly required for the Platform to run but are strongly recommended for a smooth day-to-day experience.

Examples include:

• Preferred interface language (EN, UK, ES, DE, FR, AR, ZH);
• Timezone and date-format preferences;
• Dashboard layout and widget arrangement;
• Dark/light theme toggle;
• Default fiat/crypto display currency;
• "Remember this device" state for 2FA;
• Pinned trading pairs and favourite charts;
• Unsent message drafts in the live-chat window.

4.3 Performance & Analytics Cookies (opt-in)

Performance cookies collect anonymised, aggregated information about how investors interact with crederoom.com — which pages are most popular, where users encounter friction, how fast different parts of the dashboard load, and which features actually drive value. This data helps Crederoom continuously improve the Platform and spot issues before they affect many users.

Where possible, we use privacy-first analytics (such as self-hosted Plausible or Matomo configured without cross-site tracking) that do not create persistent user profiles and do not share data with advertising networks. Examples include:

• Page-view and click-path tracking (aggregated, not individual);
• Dashboard performance and error reporting;
• A/B-test variant assignments for UX improvements;
• Front-end crash telemetry;
• Core Web Vitals (LCP, FID, CLS) measurements.

4.4 Marketing & Attribution Cookies (opt-in)

Marketing cookies help Crederoom understand how new investors discover the Platform and measure the effectiveness of our outreach campaigns. They may also be used — only where you have explicitly opted in — to serve relevant content and offers on third-party platforms.

Examples include:

• Referral/affiliate attribution identifiers;
• UTM campaign parameters;
• Conversion pixels from major advertising networks (Meta, Google Ads, TikTok, Reddit) — only loaded with your consent;
• Retargeting audiences for personalised banner ads;
• Social-sharing widgets that count outbound shares.

5. Detailed Cookie Inventory

For maximum transparency, the table below lists the specific cookies that Crederoom most commonly deploys, their purpose, type, duration and category. The exact set of active cookies may evolve as the Platform grows; the live Cookie Preference Center on crederoom.com always reflects the most current inventory.

6. Third-Party Services Deployed on crederoom.com

Crederoom carefully vets every third-party service before integrating it. The current list of external providers whose cookies or SDKs may run on the Platform includes, among others:

• Cloudflare — DDoS protection, bot management and content delivery;
• Stripe — card payment processing (only loaded on payment pages);
• Sumsub / Onfido — KYC and identity verification;
• Plausible / Matomo — privacy-first web analytics;
• Sentry — real-time error reporting;
• Intercom / Crisp — live chat and support ticketing;
• Meta Pixel, Google Ads, TikTok Pixel — marketing attribution (loaded only with explicit consent);
• reCAPTCHA / Turnstile — anti-bot protection on forms.

Each of these providers operates under its own privacy policy, which we encourage you to review. Crederoom is not responsible for the data practices of third-party vendors, but we select partners who meet or exceed the privacy and security standards described in our own Privacy Policy.

7. Your Consent & How to Manage It

The first time you visit crederoom.com from a new device, you will see our Cookie Consent Banner. From that banner you can:

• Accept all cookies with a single click;
• Reject all non-essential cookies with a single click;
• Open the Cookie Preference Center and select exactly which categories to enable or disable;
• Review the detailed cookie inventory before making your choice.

Your consent choices are stored in the kd_consent cookie and respected across sessions and devices tied to your account. You can revisit and change your choices at any moment by clicking the "Cookie Preferences" link in the footer of every page on crederoom.com, without having to clear your browser or create a new account.

8. Managing Cookies at the Browser Level

In addition to our in-app controls, every modern web browser offers settings to block, delete or restrict cookies. Below are links to detailed instructions for the most popular browsers:

• Google Chrome
• Mozilla Firefox
• Apple Safari
• Microsoft Edge
• Brave Browser

You can also use industry-wide opt-out tools such as the EDAA's "Your Online Choices" portal (youronlinechoices.eu) or the Network Advertising Initiative opt-out page (optout.networkadvertising.org).

Please note: completely blocking cookies at the browser level will prevent you from logging into crederoom.com, activating 2FA, submitting withdrawals and using many other core features. We strongly recommend using our granular Cookie Preference Center instead.

9. Do Not Track (DNT) & Global Privacy Control (GPC)

Crederoom respects the Global Privacy Control (GPC) signal where it is legally recognised (such as in California under CCPA/CPRA). When your browser transmits a valid GPC signal, we automatically treat it as an opt-out from marketing and non-essential analytics cookies, even if you have not interacted with our Cookie Consent Banner.

The older "Do Not Track" (DNT) HTTP header has not been standardised consistently across browsers and is largely unenforced across the industry. We currently do not act on DNT alone, but we honour it when combined with GPC or when regulators mandate it in your jurisdiction.

10. Children & Cookies

crederoom.com is strictly intended for adults aged 18 and above. We do not knowingly set non-essential cookies on devices identified as belonging to minors. If you believe a minor has accessed our Platform, please contact [email protected] so that we can take immediate action to remove any associated data.

11. International Cookie Rules & Compliance

Crederoom strives to meet or exceed cookie-compliance requirements across every jurisdiction where we operate, including but not limited to:

• EU / EEA: ePrivacy Directive (2002/58/EC) and GDPR;
• United Kingdom: PECR and UK GDPR;
• Canada: PIPEDA and CASL;
• California, USA: CCPA / CPRA;
• Brazil: LGPD;
• Australia: Privacy Act 1988.

Where local law requires stricter standards than those described in this policy, the local standard will prevail for users in that jurisdiction.

12. Security of Cookie Data

All authentication cookies set by Crederoom use the Secure, HttpOnly and SameSite=Strict flags, meaning they are:

• Transmitted only over encrypted HTTPS connections;
• Inaccessible to client-side JavaScript, preventing XSS theft;
• Blocked from being sent on cross-site requests, preventing CSRF.

Sensitive data (such as passwords, private keys or seed phrases) is never stored in cookies, local storage or any other client-side mechanism — such data is handled exclusively server-side using AES-256 encryption and secure vaults.

13. Updates to This Cookie Policy

Crederoom may update this Cookie Policy from time to time to reflect changes in applicable law, Platform functionality or the specific cookies we deploy. When we make material changes we will:

• Update the "Last modified" date at the bottom of this document;
• Display a prominent in-app notification;
• Re-trigger the Cookie Consent Banner so you can review and reconfirm your preferences.

Continued use of crederoom.com after a material update constitutes your acceptance of the revised Cookie Policy. We encourage you to review this page periodically to stay informed about how we use cookies.

14. Contact Us About Cookies

If you have any questions, concerns or requests related to this Cookie Policy or how Crederoom uses cookies, our Privacy & Compliance team is ready to help:

• Privacy Office: [email protected]
• General Support: [email protected]
• Compliance: [email protected]
• Phone: +1 (780) 542-1618 (24/7)
• Postal address: Crederoom Inc., Data Protection Office, First Canadian Place, 100 King St W, Toronto, ON M5H 1H1, Canada
• Change cookie preferences: click "Cookie Preferences" in the footer of any crederoom.com page

Effective date: October 23, 2026
Last updated: October 23, 2026
Document version: 2.0
Document reference: KD-COOKIE-2026-V2