What Are Cookies?
A cookie is a small text file that a website places on your device (computer, tablet, or phone) when you visit. Cookies are widely used to make websites work, to work more efficiently, and to provide reporting information to website owners.
Cookies are set by the website you are visiting (first-party cookies) or by third-party services that the website uses (third-party cookies). Cookies can be:
- Session cookies — temporary files deleted when you close your browser. Used to keep you logged in during a single visit.
- Persistent cookies — remain on your device after your browser is closed, until they expire or you delete them. Used to remember your preferences across visits.
- First-party cookies — set by Grandco directly on our domains (grandco.ca and platform subdomains).
- Third-party cookies — set by services we use, such as analytics providers, on their own domains. We list all third-party providers in Section 6.
In addition to cookies, we may use similar technologies such as local storage (browser-based data storage), session storage, web beacons (small transparent images that confirm email opens or page visits), and pixel tags. This policy covers all of these technologies, referred to collectively as "cookies."
How We Use Cookies
Grandco operates two distinct environments, each with different cookie usage:
The legal bases under which we process data via cookies are:
- Consent (PIPEDA Section 7) — for analytics and marketing cookies on the public website. You provide consent through the cookie banner on your first visit, or through the Preference Centre at any time.
- Legitimate interest — for functional cookies that improve your experience but are not strictly necessary for operation.
- Contract performance / vital interest — for strictly necessary cookies without which the platform cannot deliver the service you have subscribed to.
Cookie Categories
We group cookies into four categories based on their purpose and whether your consent is required. The categories are consistent with the IAB Europe Transparency and Consent Framework and the guidelines of the Office of the Privacy Commissioner of Canada (OPC).
Cookie Catalogue
The following table lists the specific cookies set by Grandco and our key third-party providers. This list is reviewed quarterly and updated when we add or remove cookies. Last reviewed: March 1, 2026.
Strictly Necessary Cookies
| Cookie Name | Provider | Purpose | Duration |
|---|---|---|---|
| gc_session | Grandco | Maintains your authenticated session in the merchant platform. Deleted on browser close. | Session |
| gc_csrf | Grandco | Cross-site request forgery protection token. Validates that form submissions originate from legitimate Grandco pages. | Session |
| gc_consent | Grandco | Stores your cookie consent preferences so we do not display the cookie banner on subsequent visits. | 12 months |
| gc_auth_token | Grandco | Secure authentication token used to verify your identity in the merchant or reseller platform. | 7 days (or session) |
| gc_lb | Grandco / Cloudflare | Load balancer routing cookie. Ensures your requests are routed to the same server during a session for consistency. | Session |
| __cf_bm | Cloudflare | Bot management and DDoS protection. Distinguishes between human visitors and automated bots. | 30 minutes |
| cf_clearance | Cloudflare | Cloudflare challenge clearance token. Set when a security challenge is passed successfully. | 30 minutes |
Functional Cookies
| Cookie Name | Provider | Purpose | Duration |
|---|---|---|---|
| gc_prefs | Grandco | Stores dashboard layout preferences, column visibility settings, and notification dismissal states. | 12 months |
| gc_locale | Grandco | Stores your preferred language (en/fr) and date format preferences. | 12 months |
| gc_tour_seen | Grandco | Records whether you have completed the platform onboarding tour so it is not shown again. | Persistent |
| hl_session | Grandco | Grandco CRM session management for authenticated users of the integrated CRM environment. | Session |
| intercom-* | Intercom | Live chat and support widget state — records chat history and visitor ID for support continuity. | 9 months |
Analytics Cookies (Consent Required)
| Cookie Name | Provider | Purpose | Duration |
|---|---|---|---|
| _ga | Google Analytics | Distinguishes unique visitors. Used to generate anonymised usage statistics for the public marketing website. | 24 months |
| _ga_[ID] | Google Analytics (GA4) | Maintains session state and records event data for GA4 reporting. IP anonymisation is enabled. | 24 months |
| _gid | Google Analytics | Distinguishes visitors over a short period. Used to throttle request rate and provide daily unique visitor counts. | 24 hours |
| _gat | Google Analytics | Throttles request rate to Google's servers. Prevents analytics data from impacting page load speed. | 1 minute |
Marketing Cookies (Consent Required)
| Cookie Name | Provider | Purpose | Duration |
|---|---|---|---|
| _gcl_au | Google Ads | Google Ads conversion tracking. Measures whether visiting our website resulted in a demo booking after clicking a Google ad. | 90 days |
| _fbp | Meta (Facebook) | Meta Pixel — identifies browsers for conversion tracking and retargeting of Grandco's own advertising on Facebook and Instagram. | 90 days |
| fr | Meta (Facebook) | Used by Meta to deliver, measure, and improve the relevance of Grandco's advertising on the Meta platform. | 90 days |
| IDE | Google (DoubleClick) | Used by Google to show Grandco display ads to users who have previously visited grandco.ca. First-party retargeting only. | 13 months |
| li_fat_id | LinkedIn Insight Tag — conversion tracking and retargeting for Grandco's LinkedIn advertising campaigns targeting Canadian SMBs. | 30 days |
Cookie Preference Centre
You can update your cookie preferences at any time using the controls below. Changes take effect immediately on this device and browser. Strictly necessary cookies cannot be disabled as they are required for the platform to operate.
Preferences saved through this centre are stored in the gc_consent cookie on your device for 12 months. After 12 months, we will ask for your preferences again. Withdrawing consent does not affect the lawfulness of any processing that occurred before you withdrew it.
localStorage.
Third-Party Cookie Providers
The following third-party services may set cookies on your device when you visit our public marketing website. Each provider has its own privacy policy governing how they process data collected through their cookies. We list them here in the interest of full transparency.
__cf_bm, cf_clearance) that are essential for security and cannot be disabled. Cloudflare does not use these cookies for advertising.Managing Your Cookie Preferences
You have multiple ways to control cookies. The most convenient method is the Preference Centre above. You can also manage cookies at the browser level or through provider-specific opt-out tools.
7.1 Browser-Level Controls
Every major browser lets you view, block, and delete cookies. Browser controls apply universally across all websites, not just Grandco. Instructions for common browsers:
- Google Chrome — Settings › Privacy and security › Cookies and other site data
- Safari (macOS/iOS) — Settings › Safari › Privacy & Security → Prevent Cross-Site Tracking
- Mozilla Firefox — Settings › Privacy & Security › Enhanced Tracking Protection
- Microsoft Edge — Settings › Privacy, search, and services › Tracking prevention
7.2 Analytics Opt-Out
To opt out of Google Analytics specifically across all websites, you can install the Google Analytics Opt-Out Browser Add-On, available for Chrome, Firefox, Safari, Opera, and Edge. This prevents your data from being sent to Google Analytics on any website that uses it.
7.3 Advertising Industry Opt-Outs
Industry-wide opt-out tools allow you to opt out of behavioural advertising from many participating companies at once:
- Digital Advertising Alliance of Canada (DAAC) — youradchoices.ca — opt out of interest-based ads from participating companies
- Network Advertising Initiative (NAI) — optout.networkadvertising.org
- Google Ad Settings — adssettings.google.com
- Meta Ad Preferences — accessible from your Facebook account Settings
- LinkedIn Ad Settings — accessible from your LinkedIn account Privacy settings
7.4 Mobile App Controls
If you access Grandco through a mobile browser or app, your device's operating system provides additional tracking controls:
- iOS (iPhone/iPad) — Settings › Privacy & Security › Tracking → limit ad tracking across apps
- Android — Settings › Privacy › Ads → opt out of Ads Personalisation
Do Not Track Signals
Some browsers allow you to enable a "Do Not Track" (DNT) signal that requests that websites not track your browsing activity. There is currently no universally accepted standard for how websites should respond to DNT signals, and the major advertising and analytics platforms do not alter their data collection in response to DNT signals.
Grandco's website does not currently alter its behaviour in response to DNT browser signals for this reason. However, you can achieve equivalent or stronger protection by using the controls described in Section 7 — the Preference Centre, browser cookie controls, and provider-specific opt-out tools.
We will monitor regulatory developments around DNT — including guidance from the Office of the Privacy Commissioner of Canada — and update this policy and our technical implementation if a standard emerges that requires a response.
Cookie Retention Periods
Cookies are stored on your device for the duration set at the time they are placed. The following summarises retention by category:
| Category | Typical Duration | Notes |
|---|---|---|
| Strictly Necessary (session) | Session only | Deleted automatically when you close your browser |
| Strictly Necessary (persistent) | Up to 30 days | Auth tokens, security clearance cookies |
| Consent preference cookie (gc_consent) | 12 months | We re-ask for preferences annually |
| Functional | Up to 12 months | Dashboard preferences, locale settings |
| Analytics | Up to 24 months | GA4 standard retention — can be reduced in GA settings |
| Marketing | 30–90 days | Google Ads (90 days), Meta (90 days), LinkedIn (30 days) |
You can delete cookies stored on your device at any time through your browser's cookie management interface. Deleting cookies does not delete data already sent to third-party providers — contact those providers directly to exercise data deletion rights with them.
For the personal data we process through analytics and advertising cookies, our retention policy is described in Section 11 of the Privacy Policy. Analytics data is retained in Google Analytics for 14 months from collection (configurable). Raw event data is not retained by Grandco after aggregation.
Changes to This Cookie Policy
We may update this Cookie Policy from time to time as our technology, legal obligations, or cookie usage changes. We will notify you of material changes by:
- Displaying a notice on the grandco.ca homepage for 30 days following the update
- Updating the "Last updated" date at the top of this page
- Re-presenting the cookie consent banner to all visitors if we add new cookie categories that require consent
- Sending an email notification to registered merchants and resellers for changes that materially affect their rights
We will not retroactively change how we use cookies you have already consented to without providing fresh notice and obtaining fresh consent. Minor changes — such as updating the cookie catalogue to add or remove individual cookies within an existing category — may be made without advance notice, though the catalogue will be updated to reflect the change.
Previous versions of this Cookie Policy are available on request by contacting info@grandco.ca.
Contact Us
If you have questions about this Cookie Policy, want to exercise your rights regarding data collected through cookies, or want to report a discrepancy between the cookie catalogue and cookies you have observed, please contact our Privacy Officer:
📬 Privacy Officer, Grandco Inc., [Address], Toronto, Ontario, Canada
We aim to acknowledge all privacy inquiries within 5 business days and respond fully within 30 days, as required under PIPEDA.
If you are dissatisfied with our response, you have the right to file a complaint with the Office of the Privacy Commissioner of Canada (OPC):
- Website: www.priv.gc.ca
- Toll-free: 1-800-282-1376
- Mail: 30 Victoria Street, Gatineau, Quebec K1A 1H3