Credit Impact, Inc., a Delaware corporation ("Credit Impact", "we", "us") — privacy@creditimpact.co
The effective date of this version is shown with it.
This policy explains what we store on your device, why, and how you accept, reject or withdraw. It supplements the Privacy Policy.
1. Cookies and the things that behave like cookies
A cookie is a small file a site stores on your device. Some of what we describe here is browser local storage or session storage rather than a cookie. From a privacy standpoint they behave the same way — data saved on your device and read back by this site — so all of it is listed.
2. The choice you control
When you first visit, a banner offers two categories:
- Strictly Necessary — required for the site to work: staying signed in, and remembering the cookie choice itself. These are always on. They are shown as a locked indicator, not as a switch, because switching them off would break the site.
- Analytics — Google Analytics 4 and Microsoft Clarity, used together to understand how the public marketing website is used. Off by default. Nothing in this category loads — no script is requested and no cookie is set — until you choose "Accept all" or turn Analytics on in preferences. Even then, Analytics loads only on the public marketing website (see §3), and advertising-related signals are set to denied.
Accepting our Terms of Use or any other legal document is not consent to Analytics. Analytics runs only on the choice you make here.
"Accept all" and "Reject non-essential" are presented with the same prominence and the same styling. Rejecting is remembered, so you are not asked again on every visit.
You can change your choice at any time through the Cookie preferences control in the site footer and on this page. Withdrawing Analytics consent stops further analytics activity and deletes the first-party Analytics cookies listed below from this browser.
What withdrawal cannot do. Microsoft sets additional cookies on its own domains (clarity.ms and Bing domains) once Clarity has loaded. A website cannot delete another domain's cookies from your browser, so ours does not claim to. When you withdraw, we signal consent-denied to both providers and delete every cookie we are technically able to delete; the rest are managed by your browser settings or by the provider.
Your choice is stored for 12 months (365 days), after which we ask again. We may also ask again sooner if we make a material change to what we use, who provides it, or what it does.
3. Where analytics never run, whatever you choose
Google Analytics and Microsoft Clarity load only on the public marketing website. They do not load, and their cookies are not set, on:
- the sign-in page, the account-creation page, the forgot-password page and the change-password page;
- the account-activation and password-reset links, which carry a single-use token in the address;
- any authenticated area — the agency portal, the admin console and the sales-representative portal — which includes the legal-acceptance screen.
Microsoft Clarity additionally never runs on the launch-list page, because that page captures an email address and Clarity records how a page is used. Google Analytics does run on that page once you have accepted Analytics, so that we can count sign-ups.
4. What we store
Strictly necessary
| Name | Type | Set by | Purpose | Duration |
|---|---|---|---|---|
connect.sid | Cookie, httpOnly, secure, SameSite=strict | Credit Impact (first party) | Keeps you signed in. It cannot be read by any script on the page, including our own consent code, and is unaffected by your Analytics choice in either direction. | With "Keep me signed in": up to 30 days. Without it: a browser-session cookie, removed when you close the browser, and the server additionally expires an idle session after 24 hours. Signing in with Google produces a cookie lasting up to 30 days. The server may end a session earlier, for example when you sign out. |
creditimpact.cookieConsent.v1 | Local storage | Credit Impact (first party) | Records the cookie choice itself — which category you accepted or rejected, and when — so we do not ask again on every visit. Contains no personal information. | 12 months (365 days), then you are asked again |
Analytics — off until you accept
| Name | Type | Set by | Purpose | Duration |
|---|---|---|---|---|
_ga | Cookie (first-party, set by a third-party script) | Google Analytics 4 | Distinguishes one visitor from another | Google's stated default is up to 2 years; some browsers, including Chrome, cap this at 400 days regardless |
_ga_<container-id> | Cookie (first-party) | Google Analytics 4 | Keeps Google Analytics session state. There may be more than one, each ending in a property-specific suffix | As _ga |
_clck | Cookie (first-party) | Microsoft Clarity | Persists a Clarity user identifier and preferences so repeat visits are attributed to the same anonymous user | Microsoft's published cookie reference does not state an exact period |
_clsk | Cookie (first-party) | Microsoft Clarity | Connects multiple page views into a single Clarity session | Microsoft's published cookie reference does not state an exact period |
_cltk | Session storage | Microsoft Clarity | Holds a Clarity session token for the life of the browser tab | Until the tab is closed |
MUID, CLID, ANONCHK, SM, SRM_B | Third-party cookies on clarity.ms and Bing domains | Microsoft | Microsoft's own cross-site identifiers, set by the Clarity script once it has loaded | Set and managed by Microsoft. We cannot delete these; see §2 |
Functional
| Name | Type | Set by | Purpose | Duration |
|---|---|---|---|---|
g_state | Cookie (first-party) | Google Identity Services | Records sign-out state so the Google sign-in experience is not broken after you sign out. Set only if you actively use "Continue with Google" — see §5 | Google's own documentation does not state an exact period |
creditimpact.auth.theme | Local storage | Credit Impact | Light or dark appearance inside the portal, admin and sales areas | Until you clear site data |
creditimpact.sidebar.collapsed | Local storage | Credit Impact | Whether the navigation sidebar is collapsed | Until you clear site data |
creditimpact.auth.sessionEnded, creditimpact.auth.wasAuthenticated, creditimpact.auth.returnTo | Session storage | Credit Impact | Shows the "your session ended" message and returns you to the page you were on after signing in again | Until the tab is closed; cleared on sign-in and sign-out |
creditimpact.authBoundary.lazyReloadAttempted, creditimpact.staleChunkReloadAttempted | Session storage | Credit Impact | Prevents an endless reload loop when a page fails to load after a release | Until the tab is closed |
Other third-party requests that are not cookies
Google Fonts. The website loads typefaces from fonts.googleapis.com and fonts.gstatic.com. Your browser contacts Google to fetch them, so Google receives your IP address and the fact that a page was loaded. This happens without waiting for any cookie choice, because the fonts are part of the page itself. We set the referrer policy so that Google receives only our site's origin, not the full address of the page.
Stripe. Payment is taken on a page hosted by Stripe. We do not load Stripe's scripts on our own site, so Stripe sets no cookie through creditimpact.co. Any cookie Stripe sets is set on Stripe's own checkout domain and is governed by Stripe's policies.
Not used
We use no advertising or re-marketing pixels, no social-media tracking pixels, no session-recording tool other than Microsoft Clarity, no chat widget, no service worker, and no IndexedDB storage.
5. Google sign-in is separate
"Continue with Google" is a sign-in feature, not an analytics feature. It is never turned on by accepting Analytics or turned off by rejecting it. Google's sign-in code is requested only after you click the Credit Impact "Continue with Google" control; nothing from Google's sign-in system is requested merely by loading the sign-in or account-creation page.
6. Browser controls, Do Not Track and Global Privacy Control
Most browsers let you block or delete cookies and clear local storage. Doing so is independent of the choice above and may affect how the site works — clearing connect.sid, for example, signs you out.
There is no single agreed standard for "Do Not Track", and our site does not respond to every such signal.
A Global Privacy Control signal is an opt-out of the sale of personal information and of sharing for targeted advertising. We do neither, so there is nothing for it to switch off. It does not by itself disable analytics, which run only on your affirmative consent and are turned off through the Cookie preferences control.
7. Changes and contact
We post updates here and revise the version and effective date. After a material change to what we use, who provides it, or what it does, we may ask you to choose again.
Questions: privacy@creditimpact.co
Credit Impact, Inc., 601 N Federal Hwy, Ste 301 #129, Hallandale Beach, FL 33009, United States