Cookie policy

Effective date: 5 November 2026

This policy explains the cookies and similar technologies used on www.kikin.io (the "Website") and app.kikin.io (the "App"), why we use them, and how you can control them. It supplements our Privacy Policy.

Kikin Financial Limited (company no. 14569152), 4th Floor, 14 Museum Place, Cardiff, CF10 3BH, is responsible for the cookies described here.

1. What Cookies Are

A cookie is a small text file that a website stores in your browser. Similar technologies, such as local storage and session storage, store information in the same way. In this policy, "cookies" covers all of them.

Some cookies are set by us. Others are set by the services we use, listed in section 6.

2. Your Choices

When you first visit the Website, a banner asks for your choice. You can:

- Accept All Cookies, which allows every category below.
- Open Cookie Settings and choose which categories to allow. Strictly necessary cookies are always on.

We set analytics and advertising measurement cookies only if you allow them. You can change your choice at any time with the Cookie Settings link at the bottom of every page of the Website. When you withdraw consent for a category, we delete its cookies the next time you load a page.

Your choice is stored on kikin.io, so it applies to both the Website and the App.

You can also block or delete cookies in your browser settings. If you block strictly necessary cookies, parts of the Website and the App will not work, and you will not be able to sign in.

3. Strictly Necessary Cookies

These cookies are needed for the Website and the App to work and to keep them secure. They do not need your consent.

Name	Set by	Site	Purpose	Lifetime
`fs-cc`	Kikin (Finsweet cookie banner)	Website and App	Remembers your cookie choices	180 days
`_cfuvid`	Cloudflare (our Website host's network)	Website	Distinguishes visitors to protect the Website from abuse	End of session
`__Secure-next-auth.session-token`	Kikin	App	Keeps you signed in	30 days
`__Host-next-auth.csrf-token`	Kikin	App	Protects sign-in forms against cross-site request forgery	End of session
`__Secure-next-auth.callback-url`	Kikin	App	Returns you to the right page after you sign in	End of session
`nextauth.message` (local storage)	Kikin	App	Keeps you signed in or out across browser tabs	Until you clear it
`chakra-ui-color-mode` (local storage)	Kikin	App	Remembers the App's display mode	Until you clear it
`kikin_ad_consent_recorded_for` (session storage)	Kikin	App	Remembers that the App has read your cookie choices in this tab	End of session
`add-invoice-form-draft`, `add-invoice-form-draft:<document ID>` (session storage)	Kikin	App	Keeps the invoice and payment details you have typed if the page reloads while you add an invoice	End of session; ignored after 15 minutes and removed when you submit
`add-invoice-batch` (session storage)	Kikin	App	Keeps the invoices you are adding together if the page reloads	End of session; ignored after 15 minutes and removed when the batch is finished
`kikin_cc_decided_at`	Kikin	Website and App	Records when you last saved your cookie choices, so the App applies your newest choice when you use more than one device	180 days
`kikin_cc_decided` (local storage)	Kikin	Website	A copy of `kikin_cc_decided_at`, kept when the cookie banner tidies up cookies	Until you clear it

‍

4. Analytics Cookies

These cookies help us understand how visitors use the Website, so we can improve it. They are set only if you allow Analytics.

Name	Set by	Site	Purpose	Lifetime
`_ga`	Google Analytics	Website	Distinguishes visitors	400 days
`_ga_VCMK2T8260`	Google Analytics	Website	Keeps track of your visit	400 days
`_gcl_ls` (local storage)	Google tag	Website	Stores information about how you arrived at the Website	Until you clear it
`_hjSessionUser_3617067`	Hotjar	Website	Distinguishes visitors across visits	365 days
`_hjSession_3617067`	Hotjar	Website	Keeps track of your current visit	30 minutes

‍

Product analytics and error monitoring in the App

Name	Set by	Site	Purpose	Lifetime
`ph_phc_qmS3nBAD89wXS3Wq2W77juA5Mdw18QBdBnlPOlXm111_posthog` (cookie, local and session storage)	PostHog	App	Measures how the App is used and which features work	365 days
`sentryReplaySession` (session storage)	Sentry	App	Links error reports to the steps that led to them	End of session

5. Advertising Measurement Cookies

These cookies measure whether our advertising works. They are set only if you allow Advertising measurement. We never use them to send you marketing.

We advertise in ChatGPT. When you click one of our ads, ChatGPT adds a click reference to the link. If you allow Advertising measurement, the OpenAI Measurement Pixel on the Website stores that reference and a browser ID. OpenAI uses them to tell us how many people who clicked our ads went on to visit pages or sign up. We see aggregate campaign results, not your individual browsing.

The App reads __oppref and __obref when you sign in and each time you open it. When you sign up, complete onboarding or make your first funding request, Kikin sends OpenAI that event with these two values and a hashed copy of your email address. We keep the two values with your account until it is deleted, and use them for 30 days after the App first reads them. If you withdraw consent, the App stops sending events from your next visit.

Name	Set by	Site	Purpose	Lifetime
`__oppref`	OpenAI	Website and App	Stores the reference of the ChatGPT ad you clicked	30 days
`__obref`	OpenAI	Website and App	A random browser ID used to measure ad results	365 days
`__oaiq_consent`	OpenAI	Website and App	Records that you allowed Advertising measurement, so the pixel can run	30 days
`oaiq_consent` (local storage)	OpenAI	Website	Same as `__oaiq_consent`	Until you withdraw consent or clear it
`oaiq_cs:9KJA3EWurw7p8nYRWuTVjB` (session storage)	OpenAI	Website	Pixel settings for your current visit	End of session
`kikin_oaiq_ids` (local storage)	Kikin	Website	A copy of `__oppref` and `__obref`, kept so your ad click is not lost when the cookie banner tidies up cookies	Until you withdraw consent or clear it
`__cf_bm`, `_cfuvid`	Cloudflare, for OpenAI	`bzrcdn.openai.com`	Protect OpenAI's pixel server from abuse	30 minutes; end of session

OpenAI processes this data as an independent controller under its own privacy policy. See section 9 of our Privacy Policy.

6. Third Parties

Company	What it does for us	Privacy notice
Google (Google Analytics)	Website analytics	https://policies.google.com/privacy
Hotjar Ltd	Website analytics	https://www.hotjar.com/legal/policies/privacy/
PostHog Inc.	App analytics	https://posthog.com/privacy
Functional Software Inc. (Sentry)	Error monitoring	https://sentry.io/privacy/
OpenAI OpCo LLC	Measuring ChatGPT ads	https://openai.com/policies/privacy-policy
Cloudflare Inc.	Network security for our Website host and for OpenAI	https://www.cloudflare.com/privacypolicy/

7. Changes to This Policy

We update this policy when we add, remove or change cookies. The effective date at the top shows when it last changed.

8. Contact Us

Kikin Financial Limited
4th Floor, 14 Museum Place
Cardiff
CF10 3BH

Email: hello@kikin.io
Data Protection Lead: Antony Woods — antony@kikin.io

To make a complaint to the supervisory authority:
Information Commissioner's Office (ICO) — ico.org.uk | 0303 123 1113

‍