What this policy covers
This policy explains the cookies and similar technologies used by Settlo Pay, a product of Settlo Technologies Ltd, on settlopay.co.tz, on the merchant dashboard at app.settlopay.co.tz, and in our internal back office at admin.settlopay.co.tz.
It names every item we set, says what each one is for, and says how long it lasts. If you want the wider picture of what we do with personal information, read it alongside our privacy notice.
It is short because there is not much to describe. We set a handful of cookies, we use one analytics provider, and we do not advertise.
What cookies and similar technologies are
A cookie is a small file a website asks your browser to keep and send back on your next request. Cookies are how a site can tell that two requests came from the same browser, which is what makes staying signed in possible.
Browsers also offer two storage areas that are not cookies. Local storage keeps a value until you clear it, and session storage keeps it only until you close the tab. Neither is sent to a server with your requests. We use both, and we list what we keep in them below rather than calling everything a cookie.
We do not use tracking pixels, web beacons or fingerprinting scripts anywhere on our sites.
Who sets them
Almost everything here is set by us, and is readable only on the host that set it. A cookie set on app.settlopay.co.tz cannot be read on settlopay.co.tz or on our back office, which is deliberate: it is what keeps a merchant session from being readable anywhere it has no business being.
The one third party is Google, which sets the analytics cookies described below, and only after you accept analytics.
Essential cookies
These keep you signed in and let a sign-up survive a closed tab. They are set by us, they cannot be switched off from the cookie banner, and the product does not work without them. Each one is httpOnly, which means scripts running in the page cannot read it.
None of them carries your name, your email address or anything about your business. The session cookies carry an encrypted token, and the sign-up cookie carries nothing but an opaque identifier.
| Name | What it does | How long it lasts |
|---|---|---|
| settlo.merchant.session | Keeps you signed in to the merchant dashboard at app.settlopay.co.tz. | 7 days, or until you sign out |
| settlo.admin.session | Keeps a Settlo Pay employee signed in to our internal back office. It is never set on a merchant or public page. | 12 hours, or until sign-out |
| settlo.registration | Holds only the opaque identifier of a sign-up in progress, so that closing the tab does not lose the steps you already completed. | 24 hours |
Analytics cookies
We use Google Analytics 4 to count visits and understand which pages people use. It runs on the public site, on the sign-in and sign-up screens, and inside the merchant dashboard. It does not run on the checkout page a payer sees, and it does not run in our internal back office.
Nothing in this section is stored until you accept analytics in the cookie banner. We use Google Consent Mode v2, so the tag loads in a state where it stores nothing and sends only cookieless measurement pings; accepting is what lets it write the cookies below.
| Name | What it does | How long it lasts |
|---|---|---|
| _ga | Set by Google. Tells one browser apart from another so that visits can be counted. | About 2 years |
| _ga_<measurement id> | Set by Google. Keeps the state of the current analytics session for our property. | About 2 years |
| settlo.evt | A short-lived marker we set when you complete an action such as signing in, so that it can be counted once rather than on every page that follows. The page deletes it as soon as it reads it, and it reaches Google only if you accepted analytics. | Until the next page loads |
Preferences stored in your browser
These are kept by your browser in local or session storage rather than in cookies, so they are never sent to us with a request. They exist so the interface behaves the way you left it.
| Name | What it does | How long it lasts |
|---|---|---|
| settlo.consent.v1 | The choice you made in the cookie banner. The name carries a version, so if we ever ask about something new we ask again instead of reusing an old answer. | Until you clear it or change your choice |
| settlo.sidebar.collapsed | Whether the dashboard sidebar is folded to icons. | Until you clear it |
| settlo.signed-in | The last answer the public site received about whether you are signed in, so the header does not flip between Log in and Dashboard as you move between pages. | Until you close the tab |
What we do not use
We think the absences matter as much as the list above, so they are stated rather than left to be inferred.
- No advertising cookies. Google's advertising signals are set to denied by default and nothing in our code ever grants them, including when you accept analytics. The banner asks about analytics and grants analytics only.
- No social media pixels, share widgets or embedded trackers from other companies.
- No cross-site tracking. We do not follow you onto other websites and we do not buy or receive tracking data about you from anyone who does.
- No cookies on the checkout page beyond what the payment itself needs. A payer in the middle of paying is not shown a consent banner and is not measured.
- No cookie banner at all when analytics is switched off for an environment, because then there is nothing stored to ask about.
How to control cookies
Use the Manage cookies control beside this policy, or the link in the site footer, to see your current choice and change it at any time. Choosing to reject analytics takes effect immediately and is remembered, so we do not ask you again.
You can also block or delete cookies in your browser settings, and most browsers let you do this per site. Blocking analytics changes nothing about how the product works. Blocking essential cookies means you cannot stay signed in, and a sign-up in progress will not resume.
We do not currently respond to browser Do Not Track signals, because there is no agreed standard for what a site should do when it receives one. The choice you make here is the setting we honour.
Third parties
Google is the only third party that sets anything on your device through our sites, and only for analytics, and only after you accept. Google acts as our processor for that measurement, and its own terms and privacy policy govern how it handles the data.
Payment providers, banks and card networks are involved when you actually make or take a payment. That is a different matter from this policy, and it is covered by our privacy notice rather than here, because it is about payment data rather than about anything stored on your device by our sites.
Changes to this policy
If we add or remove a cookie, this page changes with it, and the version and date at the top change too. Where a change affects what we ask your permission for, we ask again rather than carrying an old answer forward.
Questions about anything here can go through our contact page.