Cookies and browser storage

1. Scope

This notice explains storage used by the OrsunPay public website and merchant cabinet. OrsunPay is operated by Orsun Tech OÜ. Our privacy notice identifies the operator and explains the wider use of personal data.

This notice describes storage used by the OrsunPay applications. Storage can vary with enabled security services and account settings. A third-party page reached through a payment flow or external link has its own storage practices.

2. The public website

The public website application does not set visitor cookies or store contact-form entries in local storage or session storage. Language is selected through the page address. Form values remain in the open page while you complete or retry a submission; submitting the form sends them to the enquiry service.

Normal browser caching of public assets is separate from storing a contact record. Infrastructure still receives the connection information needed to deliver a page and protect the service. An enabled edge protection service may apply its own security mechanisms; the deployed configuration must be included in the final inventory.

3. Website analytics

When enabled, Plausible measures page visits and a small set of interactions without analytics cookies or persistent browser identifiers. The OrsunPay integration sends page addresses without query strings or fragments and removes referrer information. It counts contact, documentation and sign-up clicks and successful enquiry submissions without adding the form’s contents.

Plausible explains network-data handling and its rotating daily identifiers in its data policy. Cookie-free measurement still involves processing a request. Applicable consent or notice requirements depend on the final configuration and jurisdiction; cookie-free operation does not in itself establish an exemption.

4. Merchant cabinet storage

The cabinet uses first-party cookies for signed-in functionality. The current application inventory is:

Cookie	Purpose	Application lifetime
__Host-orsun_cabinet	Protects the signed-in session and carries encrypted session state.	Until the account session expires; configuration permits 1–24 hours, with a 12-hour default. Signing out clears it.
__Host-orsun_cabinet_preauth	Maintains an in-progress multifactor authentication challenge.	Up to 5 minutes; cleared after successful authentication or an invalid challenge.
orsun_cabinet_stripe	Links a requested Stripe connection with its return step.	Up to 15 minutes; cleared when consumed by the return flow.
orsun_cabinet_lang	Remembers the cabinet language selected by the user.	Up to 1 year.
orsun_cabinet_mode	Remembers the user’s test or live environment selection.	Up to 1 year.

These cookies are marked HttpOnly so page scripts cannot read them. Production configuration uses Secure transmission and SameSite restrictions. Authentication cookies support the requested sign-in and connection functions; language and environment cookies remember user choices. Their final legal classification is part of the consent review. Development environments can use different session-cookie names and settings.

5. Your controls

You can remove or block cookies through your browser’s site-data settings. Removing authentication cookies signs you out or interrupts the associated authentication or connection flow. Removing preference cookies resets the remembered choices. Disabling JavaScript prevents the optional client analytics from running; a server-rendered contact form is available from the contact page.

There are no advertising-cookie controls in the current public website application because it does not integrate an advertising-cookie tool. If optional storage is introduced, this notice and the necessary controls must be updated before activation. Send questions through Contact or the postal route in the privacy notice.