Cookie Policy

1. What Are Cookies

1.1 Cookies are small text files that are placed on your device (computer, tablet, or mobile phone) when you visit a website. Cookies are widely used to make websites work more efficiently, to provide a better user experience, and to supply information to the operators of a website.

1.2 Cookies may be set by the website you are visiting ("first-party cookies") or by third parties whose content or services are embedded in the website ("third-party cookies"). Cookies may last for the duration of your browser session ("session cookies") or may persist on your device for a defined period after you close your browser ("persistent cookies").

1.3 In addition to cookies, we use other tracking technologies, including local storage and tracking pixels, which are described in Section 3 of this Policy.

1.4 This Cookie Policy ("Policy") explains what cookies and similar technologies Aktok Inc, a corporation incorporated under the laws of Prince Edward Island, Canada ("Aktok," "we," "us," or "our"), uses on the Aktok platform and the aktok.com website (the "Service"), why we use them, and your choices regarding their use.

1.5 This Policy should be read together with our:

• Privacy Policy
• Terms of Service

2. How We Use Cookies

We use cookies for a variety of purposes, grouped into the following categories. Each category is explained below, together with a table listing the specific cookies used.

2.1 Essential Cookies

2.1.1 Essential cookies are strictly necessary for the operation of the Service. They enable core functionality such as user authentication, session management, and security protections. Without these cookies, the Service cannot function properly.

2.1.2 Because these cookies are strictly necessary, they do not require your consent under applicable law, including the EU ePrivacy Directive and the UK Privacy and Electronic Communications Regulations ("PECR").

Note: Token durations reflect the current implementation at the time of publication. These durations may be shortened in future updates to align with evolving security best practices. If material changes occur, we will update this Policy accordingly.

2.2 Functional Cookies

2.2.1 Functional cookies enable the Service to remember choices you have made (such as your preferred language, timezone, or visual theme) and to provide enhanced, personalized features.

2.2.2 In the European Economic Area ("EEA") and the United Kingdom ("UK"), functional cookies require your consent. If you do not consent to functional cookies, the Service will still operate, but certain preferences may not be remembered between sessions.

2.3 Analytics Cookies

2.3.1 Analytics cookies help us understand how visitors interact with the Service by collecting and reporting information about usage patterns. We use this information to improve the Service, identify issues, and measure the effectiveness of our features.

2.3.2 Analytics cookies require your consent in the EEA, the UK, and other jurisdictions that mandate opt-in consent for non-essential cookies.

2.3.3 We use multiple analytics tools to understand how visitors interact with different parts of the Service:

• Matomo — self-hosted on our own infrastructure at analytics.aktok.com. Because Matomo is self-hosted, your analytics data is not transferred to any external third-party analytics provider.
• PostHog — product analytics and feature flag evaluation on the aktok.com website. PostHog data is processed on PostHog's US infrastructure.
• Google Analytics 4 — web traffic analysis and audience insights on the aktok.com website. Data is processed by Google.
• Microsoft Clarity — heatmap analysis on the aktok.com website. Data is processed by Microsoft.

2.3.4 Session Recording. In addition to pageview analytics, PostHog and Microsoft Clarity record browsing sessions on the aktok.com website. Session recordings capture mouse movements, clicks, scrolls, and page interactions to help us understand how visitors use the site and identify usability issues. Session recordings are not activated unless you have consented to the Analytics cookie category. Recordings do not capture text entered into password fields or other sensitive input fields that are excluded from recording.

2.4 Marketing Cookies

2.4.1 Marketing cookies are used to track visitors across websites to build advertising audiences, measure ad campaign effectiveness, and display ads that are relevant and engaging for the individual user. The legal basis for setting marketing cookies is your consent (Article 6(1)(a) of the GDPR; Article 5(3) of the ePrivacy Directive). Marketing cookies are not set unless you have actively consented through our cookie consent mechanism (see Section 5.1).

2.4.2 We use the following marketing and advertising technologies on the aktok.com website:

• Meta (Facebook) Pixel — tracks website visits and conversions to build advertising audiences and measure ad effectiveness on Meta platforms (Facebook, Instagram).
• Google Ads / AdSense — serves advertisements and tracks conversions to measure ad campaign performance across Google's advertising network.

2.4.3 Marketing cookies are not set unless you have consented to the Marketing cookie category. If you do not consent, no advertising tracking will occur.

3. Other Tracking Technologies

In addition to cookies, the Service uses the following technologies:

3.1 Local Storage

3.1.1 Local storage (also known as "web storage") allows the Service to store data in your browser that persists after you close the browser window. Unlike cookies, local storage data is not sent to the server with each request.

3.1.2 We use local storage to maintain application state (such as UI layout preferences and cached data) to improve performance and your user experience. Local storage used by the Service does not contain personally identifiable information ("PII").

3.2 Web Push Notifications

3.2.1 If you opt in to receive push notifications, we use Firebase Cloud Messaging (a Google service) to deliver notifications to your device. This requires storing a device token on your device and transmitting it to Firebase for notification delivery.

3.2.2 You can disable push notifications at any time through your browser settings or within the Service's notification preferences. For details on how Firebase handles data, please refer to Firebase's privacy documentation.

3.3 Email Tracking Pixels

3.3.1 When you use Aktok's email features to send messages through the Service, those emails may contain a small, transparent image known as a "tracking pixel" (also called a "web beacon"). This pixel allows the Service to detect when an email has been opened and to record that event.

3.3.2 Email tracking pixels are enabled by default for emails sent through the Service. Workspace administrators and individual users can disable tracking pixels for their outbound emails at any time within the Service's email settings.

3.3.3 Email tracking pixels are used to measure email engagement and campaign effectiveness. The legal basis for this processing is the legitimate interest of the sending workspace (the data controller) in measuring email effectiveness. Recipients of tracked emails who wish to prevent tracking may configure their email client to block remote images by default, or contact the sending organization directly to request removal from tracked communications. Because Aktok acts as a data processor for emails sent by workspace users, the workspace user (as data controller) is responsible for ensuring compliance with applicable consent or opt-out requirements for their email recipients.

4. Third-Party Cookies

4.1 A third-party cookie is set by a domain other than aktok.com. The following third parties may set cookies when you use the Service:

4.2 Matomo is self-hosted on Aktok-controlled infrastructure. Although Matomo cookies are technically first-party (set on the aktok.com domain), we list Matomo here for transparency because it is a distinct analytics system.

4.3 Our payment processor, Stripe, may set its own cookies when you interact with payment forms. Stripe's cookies are strictly necessary for payment processing and fraud prevention. For details, see Stripe's privacy policy.

5. Managing Your Cookie Preferences

You have several options for managing cookies and tracking technologies:

5.1 Cookie Consent Mechanism

5.1.1 We are implementing a cookie consent management platform ("CMP") that will allow you to control which non-essential cookie categories are active when you use the Service. When fully deployed, the CMP will provide:

• (a) No pre-checked boxes -- non-essential cookie categories off by default;
• (b) Equal prominence for Accept and Reject options;
• (c) Granular category controls -- enable or disable each cookie category individually (essential cookies are always on, as they are required for the Service to function);
• (d) No cookie wall -- access to the Service without consenting to non-essential cookies; and
• (e) Easy withdrawal -- change your cookie preferences at any time through a cookie settings link in the Service footer.

5.1.2 Until the CMP is fully deployed, you can manage non-essential cookies through your browser settings (Section 5.2) and through the service-specific opt-out links below (Section 5.3). We do not condition access to the Service on acceptance of non-essential cookies.

5.1.3 For visitors outside the EEA and UK, we will display an informational notice about our cookie practices with a link to this Policy.

5.1.4 Once deployed, we will maintain a log of consent decisions for audit and compliance purposes.

5.2 Browser Settings

5.2.1 Most web browsers allow you to manage cookies through their settings. You can typically:

• (a) View and delete existing cookies;
• (b) Block all cookies or only third-party cookies;
• (c) Set preferences for specific websites; and
• (d) Configure your browser to notify you when a cookie is set.

5.2.2 Please note that blocking or deleting cookies may affect the functionality of the Service. In particular, blocking essential cookies will prevent you from logging in.

5.2.3 For instructions on managing cookies in common browsers:

• Chrome:support.google.com/chrome/answer/95647
• Firefox:support.mozilla.org/en-US/kb/cookies-information-websites-store-on-your-computer
• Safari:support.apple.com/guide/safari/manage-cookies-sfri11471
• Edge:support.microsoft.com/en-us/microsoft-edge/manage-cookies-in-microsoft-edge

5.3 Opt-Out Links for Specific Services

5.3.1 Matomo Analytics. You can opt out of Matomo analytics tracking by visiting our opt-out page at analytics.aktok.com. Matomo also respects Do Not Track browser signals (see Section 6).

5.3.2 PostHog. You can opt out of PostHog tracking by adjusting your cookie preferences via the consent mechanism described in Section 5.1. PostHog also provides an opt-out mechanism at posthog.com/privacy.

5.3.3 Google Analytics. You can opt out of Google Analytics tracking by installing the Google Analytics Opt-out Browser Add-on.

5.3.4 Microsoft Clarity. You can opt out of Microsoft Clarity by adjusting your cookie preferences or by visiting privacy.microsoft.com.

5.3.5 Meta (Facebook). You can manage your ad preferences and opt out of interest-based advertising from Meta at facebook.com/adpreferences.

5.3.6 Google Ads. You can opt out of personalized advertising from Google at adssettings.google.com.

6. Do Not Track

6.1 Some web browsers transmit "Do Not Track" ("DNT") signals. There is currently no universally accepted standard for how online services should respond to DNT signals.

6.2 We respect your privacy preferences. Our self-hosted analytics platform (Matomo) is configured to honor DNT signals by default. When your browser sends a DNT signal, Matomo will not track your visit.

6.3 Other analytics and marketing services (PostHog, Google Analytics, Microsoft Clarity, Meta Pixel, Google Ads) do not universally honor DNT signals. For these services, we rely on our cookie consent mechanism (Section 5.1) to respect your choices. Non-essential cookies from these services are not set unless you have consented.

6.4 For more granular control over tracking, you may manage your cookie preferences as described in Section 5.

7. Changes to This Policy

7.1 We may update this Policy from time to time to reflect changes in our practices, the cookies and technologies we use, or applicable law. When we make changes, we will update the "Last Updated" date at the top of this Policy.

7.2 For material changes (such as the introduction of new cookie categories or activation of previously inactive tracking technologies), we will provide notice through one or more of the following methods:

• (a) Email notification to the address associated with your account;
• (b) In-app notification within the Service; or
• (c) A prominent notice on our website.

7.3 We encourage you to review this Policy periodically to stay informed about our use of cookies and tracking technologies.

8. Contact Us

If you have any questions about this Cookie Policy or our use of cookies and tracking technologies, please contact us:

Aktok Inc 163 Great George St. (The Foundry) Charlottetown, PE, Canada

Email:legal@aktok.com

For privacy-related inquiries, including the exercise of your rights regarding cookies and tracking, please see our Privacy Policy.