Cookie Policy
Last Updated: October 18, 2026 (version 1.1.0)
In Simple Terms
- SSP Manager, the SSP apps and the SSP API use only cookies that are strictly necessary to run them.
- Our public website, ssppos.com, also uses Google Analytics to understand how visitors use it.
- In the European Union, the EEA, the United Kingdom, Switzerland and Quebec, analytics runs only after you click Accept.
- Everywhere else, analytics runs by default and you can opt out at any time.
- If your browser sends a Global Privacy Control signal, we treat you as if you were in a strict region.
- We do not use advertising or retargeting cookies, and we never sell cookie data.
Who We Are
SSP Systems Ltd. ("we," "us," or "our") operates the SSP Manager platform, the SSP apps, the SSP API and the public website ssppos.com (together, the "Service"). This Cookie Policy explains what cookies are, which ones we use, and how you control them.
- Legal Name: SSP Systems Ltd.
- Location: Ontario, Canada
- Contact: support@ssppos.com
What Are Cookies?
Cookies are small text files a website or application places on your device. They let the Service remember things such as whether you are signed in, or the choice you made about analytics. Similar technologies, such as local storage and session storage in your browser, serve the same purpose and are covered by this policy.
Where Each Kind of Cookie Is Used
| Property | Strictly necessary | Analytics |
|---|---|---|
| SSP Manager, the SSP apps and the SSP API | Yes | No |
| Public website (ssppos.com) | Yes | Yes, under the consent rules below |
Cookies We Use
1. Strictly Necessary
These are needed for the Service to work, for example to keep you signed in or to remember your cookie choice. They are not used for tracking or analytics, so they do not require consent.
| Name | Set by | Purpose | Duration |
|---|---|---|---|
ssp_pos_session | SSP API | Keeps a request session; HTTP-only | 2 hours |
jwt_token | SSP API | Keeps you signed in to SSP Manager and the apps; HTTP-only | 7 days |
ssp_authenticated | SSP API | Lets the app know you are signed in, without exposing your session | 7 days |
ssp_waiter_device | SSP API | Identifies a restaurant tablet registered for staff sign-in; HTTP-only | About 400 days, or until the tablet is removed |
cookie-consent | ssppos.com | Remembers your analytics choice ("accepted," "analytics" or "declined") | 1 year |
The website also keeps two short-lived values in your browser's session storage, cleared when you close the tab: ssp-consent-region, which records only whether analytics needs your opt-in where you are (never your location), and ssp-lead-plan, which remembers which pricing plan led you to the contact form. It stores ssp-pricing-market in local storage to remember which market's pricing you were shown.
2. Analytics (ssppos.com only)
We use Google Analytics 4, provided by Google LLC, to count visits and understand which pages and links are useful, such as scroll depth, clicks on calls to action, downloads and contact-form submissions. We use this only to improve the website.
| Name | Set by | Purpose | Duration |
|---|---|---|---|
_ga | Google Analytics | Distinguishes visitors | Up to 2 years |
_ga_<ID> | Google Analytics | Keeps the state of a visit | Up to 2 years |
Analytics runs only on the production website (ssppos.com). Test and preview sites do not send data to Google Analytics.
3. What We Do Not Use
- Advertising or retargeting cookies (for example Google Ads, Meta Pixel, LinkedIn Insight Tag)
- Social media tracking pixels
- Cross-site behavioural tracking for advertising
We set Google's advertising-related consent signals (ad_storage, ad_user_data, ad_personalization) to denied by default. They become granted only if you click Accept in a region where opt-in is required. Pressing OK on the notice shown elsewhere keeps them denied.
How Consent Works
Opt-in regions
If you are in the European Union, Iceland, Liechtenstein, Norway, the United Kingdom, Switzerland or Quebec, nothing beyond strictly necessary cookies runs until you choose. The banner offers Accept and Decline:
- Accept turns on analytics and grants Google's advertising-related signals described above.
- Decline keeps analytics off.
If we cannot tell where you are, we apply these opt-in rules. Your location is checked on our hosting provider's edge server, and only a yes-or-no answer ("is opt-in required here?") reaches your browser; your location is not stored.
Everywhere else
Analytics starts by default, with Google's advertising-related signals kept denied. A notice explains this and offers:
- OK, which keeps the default: analytics on, advertising signals off.
- Opt out, which turns analytics off.
Global Privacy Control
If your browser sends a Global Privacy Control (GPC) signal, we treat it as a request not to be tracked and apply the opt-in rules, wherever you are.
Changing your choice
Use Cookie Preferences in the website footer at any time. Reopening it pauses analytics until you choose again. When you decline or opt out, we turn Google Analytics off for your browser and delete the _ga cookies it set. Your choice is remembered for one year in the cookie-consent cookie.
You can also delete or block cookies in your browser settings:
- Chrome: Settings → Privacy and security → Third-party cookies / Site data
- Firefox: Settings → Privacy & Security → Cookies and Site Data
- Safari: Settings → Privacy → Manage Website Data
- Edge: Settings → Cookies and site permissions
Blocking strictly necessary cookies will prevent you from signing in to SSP Manager and the apps.
Do Not Track
We honour the Global Privacy Control signal as described above. Our behaviour does not change in response to the older "Do Not Track" setting, because most browsers have replaced it with GPC.
Who Receives Cookie Data
- Google LLC processes website analytics data on our behalf. This data may be processed outside Canada, including in the United States.
- Our hosting providers (Amazon Web Services for the SSP API, and our website host for ssppos.com) process data only to run the Service.
We do not sell or rent cookie data, and we do not share it for advertising.
Sites Covered by This Policy
This policy applies to every SSP property that shows it from the SSP API, including SSP Manager, the SSP apps and ssppos.com. Each retrieves the current version from:
GET https://api.ssppos.com/api/legal/cookie-policy
A French version is available by adding ?locale=fr.
Changes to This Policy
We may update this policy. When we do, we publish the new version here with a new date and version number. If a change affects what you agreed to, we will ask again where consent is required.
Contact Us
SSP Systems Ltd. Ontario, Canada Email: support@ssppos.com
For cookie-related questions, please include "Cookie Policy" in the subject line.