Malli Cookie Policy

Draft for legal review — not yet published.

Effective date: [DATE]
Last updated: [DATE]

This Cookie Policy explains how Next Wave LLC uses cookies and similar technologies on the consumer-facing Malli website and web application.

1. What cookies are

A cookie is a small text file placed on a browser or device by a website. Similar technologies include software development kits, pixels, local storage, and other identifiers that allow a service to remember information or communicate with a device.

2. Current Malli cookie inventory

The inventory below reflects the current application code and must be rechecked against the deployed production site and each provider's documentation before publication.

Name or technology	Provider	Purpose	Category	Duration
_malli_key	Malli / Next Wave	Maintains the signed and encrypted web session, including authentication, selected-mall state, security state, and short-lived sign-in or onboarding state	Strictly necessary	Configured for up to one year; individual values may be removed sooner

Optional shopper-only PostHog analytics is being implemented and remains disabled by default pending notice/legal review and release approval. It will load only after explicit acceptance on eligible Malli shopper pages. Google Analytics, Meta Pixel, advertising tags and session replay are not enabled. Declined visitors receive no optional analytics identifier.

3. Strictly necessary cookies

The _malli_key cookie is required for functions requested by users, including signing in, maintaining account security, using authenticated pages, remembering a selected mall, and completing certain sign-in or onboarding flows. If it is disabled, those functions may not work.

Where applicable law recognizes an exception for strictly necessary cookies, we rely on that exception rather than asking for consent every time the session cookie is used. We still disclose it here and provide the controls required by applicable law.

4. Optional shopper analytics

When approved and enabled, PostHog will measure intentional shopper pageviews and confirmed feature usage, with an opaque shopper UUID after sign-in and bounded campaign attribution. It will not collect names/emails, raw search terms, unrestricted URLs/query strings, form values, payment details or receipt/provider content. Business, admin, retailer-management and native/API traffic is excluded. Automatic click capture, replay, heatmaps, advertising identifiers, surveys, flags and exception capture are disabled.

Analytics preferences are available on eligible shopper pages with equally prominent Accept analytics and Decline analytics choices and persistent preference access. The choice expires after 180 days or a policy-version change; the default is no analytics. Global Privacy Control and Do Not Track are treated as denial. No earlier actions are captured retroactively.

The essential signed/encrypted session cookie stores the bounded choice separately from login state. An optional server-side consent scope is created only after acceptance; withdrawal revokes that scope so delayed requests and queued events cannot rely on an old grant. Consent-scope records contain no shopper identity or campaign data. Optional browser identity/session and campaign storage will be bounded by consent expiry and removed on withdrawal; campaign first/latest-touch retention is 90/30 days respectively. These storage details and provider retention settings must be verified before production publication.

5. Managing cookies

You can usually block or delete cookies through your browser settings. Blocking the essential session cookie may prevent sign-in, mall selection, event participation, or other account functions from working.

Use Analytics preferences to decline or withdraw optional analytics without loading PostHog. Withdrawal clears optional browser data and server snapshots and invalidates unsent analytics for that browser scope; it does not affect shopping or processing that was lawful before withdrawal. Preferences are independent of authentication and persist through shopper sign-in/sign-out without preserving OAuth or security state.

6. Third-party websites

Links to Google, payment providers, retailers, merchants, or other third parties may take you to services that use their own cookies and privacy practices. This Policy does not control those third-party technologies.

7. Updates

We may update this Policy when our technology, providers, or legal obligations change. We will post the updated version and revise the date above.

8. Contact

Questions about cookies or privacy may be sent to:

Next Wave LLC
Privacy email: [PRIVACY EMAIL]
Registered address: [REGISTERED ADDRESS]