In short, for crocadilo.com: the public pages of this website set no cookies. The customer panel sets one session cookie (croc_panel) while you're signed in, so it knows it's you. If we add website analytics (Google Analytics), it will only run after you click "Accept" on our cookie banner, and you can change your mind at any time using the "Cookie settings" link in the footer. Our apps at backend.crocadilo.com and rewards.crocadilo.com use the cookies described below to keep you signed in and make them work.
Data protection questions? Email hello@cvcinternational.com.
1. Introduction and legal scope
Our website, https://crocadilo.com, and its platform subdomains, including the card editor (https://backend.crocadilo.com), the loyalty portal (https://rewards.crocadilo.com), staff till scanning pages and merchant dashboards (together "the website" or "the platform"), use cookies and similar browser storage.
Crocadilo is a trading name of CVC International Ltd, a private limited company registered in England and Wales, with its registered address at 128 City Road, London, EC1V 2NX ("CVC", "we", "us" or "our").
This Cookie Policy explains in plain language how and why we use cookies, scripts, web beacons and local browser storage on our public website and software, in line with our duties under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (DPA 2018) and the Privacy and Electronic Communications Regulations 2003 (PECR).
2. What are cookies and scripts?
2.1 Cookies
A cookie is a small text file that a website asks your browser to store on your computer, phone or tablet. The information in a cookie can be sent back to our servers (or the servers of authorised service providers) on later visits. This lets us keep you logged in securely and remember your preferences.
2.2 Scripts
A script is a piece of code (mostly JavaScript) that runs on our server or in your browser to make pages interactive. On Crocadilo, scripts power features such as our loyalty calculator, QR code generator, the staff till scanner and site menus.
3. Web beacons and local storage
3.1 Web beacons (pixel tags)
A web beacon is a tiny invisible image or network request in a web page or email that shows whether the content has been viewed. Crocadilo deliberately does not add third-party tracking pixels to the digital card profiles and WhatsApp stores your customers see. This keeps them fast and protects your customers' privacy.
3.2 Local storage and session storage
We also use your browser's local storage. Unlike cookies, information in local storage is not sent over the network with every page request. We use it only for convenience, for example to remember a step in an interactive demo, whether you muted sound effects, or your progress through a checklist.
4. Types of cookies we use
4.1 Strictly necessary cookies (always on, no consent needed)
These cookies are essential for the platform to work. They keep merchant logins secure, protect forms against cross-site request forgery (CSRF), keep your session going while you edit a card, keep items in a customer's WhatsApp store basket, and let staff log in quickly on till scanning devices. Under Regulation 6(4) of PECR, strictly necessary cookies do not need prior consent.
4.2 Functional and preference cookies
These remember choices you make, such as your display currency (for example £ GBP), light or dark mode, or sound settings on the till scanner, so you don't have to set them again each visit.
4.3 Statistics (consent needed)
We collect combined, privacy-friendly usage data to monitor how the platform is working, find slow spots, and give merchants dashboard statistics (for example daily NFC card taps and the split between iPhone and Android visitors). We do not track visitors across other websites, and we do not build advertising profiles. Where we use non-essential statistics cookies, we ask for your consent first.
4.4 Marketing cookies (consent needed, off by default)
On some public marketing pages we may use marketing cookies or measurement tags to see whether our campaigns are working (for example, whether someone who saw a sponsored LinkedIn post later requested an NFC sample). These are optional, off by default, and never used without your consent.
5. List of cookies
The main cookies, tokens and storage keys used across Crocadilo:
| Name | Provider | Purpose | How long | Type |
|---|---|---|---|---|
| crocadilo_session | Crocadilo | Keeps merchants logged in across the card editor pages. | Session / 2 hours | Strictly necessary |
| XSRF-TOKEN | Crocadilo | Security token that protects forms against cross-site request forgery. | Session | Strictly necessary |
| croc_cart_* | WhatsApp Micro-Store | Remembers the products and quantities in a customer's basket. | 24 hours | Strictly necessary |
| staff_scanner_auth | Rewards platform | Identifies authorised staff devices when scanning customer QR codes. | 30 days | Strictly necessary |
| croc_panel | crocadilo.com | Keeps you signed in to the customer panel at crocadilo.com/panel. | Until you close the browser, or 8 hours | Strictly necessary |
| croc_consent (local storage) | crocadilo.com | Remembers whether you said yes or no to analytics on our cookie banner. | Until you clear it | Strictly necessary |
| __stripe_mid, __stripe_sid | Stripe | Fraud prevention for payments. | 1 year / 30 minutes | Strictly necessary (security) |
| cf_clearance | Cloudflare | Protection against attacks and automated bots. | 1 year | Strictly necessary (security) |
| _ga, _ga_* | Google Analytics 4 | Measures overall website traffic and which pages are visited. | 2 years / 1 year | Statistics (consent needed) |
On crocadilo.com the only thing kept in your browser's local storage is croc_consent, your answer to the cookie banner. It stays in your browser and contains no personal information. Our apps may keep their own settings in local storage, as described in section 3.2.
6. Third-party services
6.1 WhatsApp orders
When a customer taps "Send order to WhatsApp" in a Crocadilo store, we put the items, delivery choice and notes into a standard WhatsApp link (https://wa.me/...). Crocadilo does not place WhatsApp or Meta tracking cookies or pixels on the customer's device. The order then opens in the customer's own WhatsApp app, which is end-to-end encrypted.
6.2 Apple Wallet and Google Wallet passes
When a customer adds a digital stamp card or loyalty pass to their phone, the pass (a .pkpass file for iPhone, or a signed Google Wallet token) goes straight into the phone's built-in wallet. Wallet passes work outside the web browser and do not place browser cookies on the customer's device.
6.3 Stripe payments
For subscription fees, NFC hardware orders and optional online invoice payments, we use Stripe. Stripe may set functional cookies (for example __stripe_mid) to prevent card fraud and meet payment security standards.
7. Managing your consent
Where we use cookies that need consent, you will be asked when you first visit from the UK. You can choose to:
- Accept: allows statistics cookies (Google Analytics).
- No thanks: only strictly necessary cookies are used.
You can withdraw or change your consent at any time. Use the "Cookie settings" link in the footer of any page to see the banner again and change your answer straight away.
8. Deleting cookies in your browser
You can use your browser's settings to delete cookies, block cookies from particular websites, or be alerted when a site wants to set one:
- Google Chrome: Settings > Privacy and security > Delete browsing data (and Third-party cookies to block them).
- Apple Safari: on iPhone, Settings > Safari > Prevent Cross-Site Tracking, Block All Cookies, or Clear History and Website Data. On Mac, Safari > Settings > Privacy.
- Mozilla Firefox: Settings > Privacy & Security > Cookies and Site Data > Clear Data.
- Microsoft Edge: Settings > Cookies and site permissions > Manage and delete cookies and site data.
If you block or delete all strictly necessary cookies, some parts of the platform, including merchant logins, the card editor and staff till scanning, will stop working properly.
9. Your rights under UK GDPR and the DPA 2018
Under the UK GDPR and the Data Protection Act 2018, you have rights over any personal data processed through cookies or similar identifiers:
- Right to be informed: to know why your personal data is needed, how it is kept secure and how long it is kept.
- Right of access: to get confirmation and a copy of personal data we hold about you (a subject access request).
- Right to rectification: to have inaccurate or incomplete personal data corrected.
- Right to erasure: to have your personal data deleted where you have withdrawn consent or we no longer have a lawful reason to keep it.
- Right to data portability: to receive your personal data in a structured, machine-readable format and move it to another provider.
- Right to object: to object at any time to processing based on legitimate interests or for marketing.
Complaints: if you think we have not handled your personal data or cookie choices lawfully, please contact us first so we can put it right. You also have the right to complain to the UK regulator:
Information Commissioner's Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline: 0303 123 1113
Website: ico.org.uk
10. Contact details
For questions about this Cookie Policy, our data processing agreements, or to use your privacy rights, contact us:
Brand: Crocadilo, crocadilo.com
Operating company and registered office: CVC International Ltd, 128 City Road, London, EC1V 2NX, United Kingdom
Email: hello@cvcinternational.com
See also our privacy notice and terms and conditions.