Cookie policy.
What cookies and similar technologies Facet uses across facet.llc, app.facet.llc, and audit.facet.llc, how consent is managed, and how to change your preferences.
Scope.
1.1 Coverage
This Cookie Policy describes cookies and similar technologies (pixel tags, web beacons, local storage, session storage, IndexedDB) used by Facet, LLC across the Facet marketing site at facet.llc, the admin dashboard at app.facet.llc, the audit property at audit.facet.llc, and any subdomain under facet.llc operated by Facet.
1.2 Relationship to other policies
This Cookie Policy is referenced by title and version from the Privacy Policy v2.1 § 2.8 and § 3 and is incorporated into the Terms of Service v2.1 at § 1.5. Cookies that process Personal Data are also subject to the Privacy Policy v2.1.
1.3 Not covered
This Cookie Policy does not cover cookies set by Customers on Customer's own properties, even where Customer has mounted a Facet Terminal. Those cookies are governed by Customer's own cookie policy.
What cookies are and the categories we use.
2.1 What they are
Cookies are small text files that websites place on your device. Similar technologies (pixel tags, web beacons, local storage, session storage, IndexedDB, service-worker storage) serve comparable purposes but store data in different places. This Policy covers all of them under the umbrella term “cookies.”
2.2 First-party vs. third-party
First-party cookies are set by Facet on a Facet-operated domain. Third-party cookies are set by a domain other than the one you are visiting (for example, a subprocessor).
2.3 Session vs. persistent
Session cookies expire when you close the browser. Persistent cookies remain for a defined period (listed in the inventories below) or until you delete them.
2.4 Categories
- Strictly necessary, required for the site to function (for example, authentication, CSRF protection, load balancing). These do not require consent under the ePrivacy Directive 2002/58/EC Art. 5(3) and cannot be rejected in the consent banner.
- Functional, remember your preferences (for example, language, theme). These require consent in the EEA, UK, and Switzerland.
- Analytics, measure usage and improve the Services. Where we use analytics, consent is requested in the EEA, UK, Switzerland, and in French-user sessions per CNIL guidance.
- Marketing, not used by Facet on its own properties. Facet does not deploy advertising cookies and does not integrate with advertising identity graphs.
First-party cookie inventory.
The following cookies are set by Facet on the domains listed in Section 1.1. Specific names may vary with framework updates; Facet keeps this table reasonably current and publishes material changes under Section 8.
| Cookie name | Domain | Purpose | Type | Max age |
|---|---|---|---|---|
| facet_session | app.facet.llc | Admin authentication session token | Strictly necessary (session) | 24 hours (sliding) |
| facet_csrf | app.facet.llc, facet.llc | CSRF protection token for state-changing requests | Strictly necessary (session) | Browser session |
| facet_preferences | app.facet.llc | Admin dashboard UI preferences (theme, table density) | Functional (persistent) | 12 months |
| facet_consent | All Facet domains | Records cookie-consent choices made in the banner | Strictly necessary (persistent) | 12 months |
| facet_page_views | facet.llc | Anonymous first-party page-view counter (no cross-session identifier) | Analytics (persistent) | 13 months |
| Local storage key facet.dashboard.state | app.facet.llc | Persists dashboard pane layout across sessions | Functional (persistent) | Until cleared by user |
Third-party cookie inventory.
The following third-party cookies may be set by Facet's subprocessors (listed in Privacy Policy v2.1 § 6.1) when you interact with a Facet property. Specific names and values may change with subprocessor updates; the authoritative subprocessor list is in Privacy Policy v2.1 § 6.1 and DPA v2.1 Annex III.
| Provider | Cookie / storage | Purpose | Type | Max age |
|---|---|---|---|---|
| Cloudflare, Inc. | __cf_bm | A third-party bot-management token set by our CDN; required for WAF and DDoS protection on responses from terminal.facet.llc (and its deprecated alias api.facet.llc). It is a strictly necessary security cookie and is not used for tracking or analytics. | Strictly necessary (session) | 30 minutes (sliding) |
| Cloudflare, Inc. | cf_clearance | Stores the result of a security challenge for the current browser | Strictly necessary (persistent) | 30 minutes |
| Netlify, Inc. | nf_ab, nf_jwt | Edge routing; site-split testing (where used) | Strictly necessary (session) | Browser session |
| Stripe, Inc. (billing pages only; not the marketing site) | __stripe_sid, __stripe_mid | Payment-fraud prevention and session continuity on billing pages | Strictly necessary (persistent) | 30 minutes / 12 months |
| Microsoft Corporation (Entra ID) | Entra-set cookies | OIDC identity-provider sign-in (only during the sign-in flow) | Strictly necessary (session) | Browser session |
| Google LLC (Workspace OIDC) | Google-set cookies | OIDC identity-provider sign-in (only during the sign-in flow) | Strictly necessary (session) | Browser session |
Facet does not deploy advertising trackers, cross-site behavioral-advertising cookies, or data-broker pixels. No third-party marketing cookies are set on Facet domains.
Consent management.
5.1 The consent banner
When you first visit a Facet property from a jurisdiction where consent is required (EEA, UK, Switzerland, and where the ePrivacy rules apply), Facet presents a Consent Management Platform ("CMP") banner. The banner allows you to: (a) accept all categories; (b) reject all non-strictly-necessary categories; or (c) customize per category (functional, analytics) with an affirmative choice per category. No pre-ticked boxes. Strictly necessary cookies are set without consent under ePrivacy Directive 2002/58/EC Art. 5(3).
5.2 Withdrawing or changing consent
You can change your cookie preferences at any time by clicking the persistent “Cookie settings” control in the footer of each Facet property, or by visiting the Your Choices section below. Withdrawing consent does not affect the lawfulness of cookie use before withdrawal.
5.3 Record of consent
Facet records an auditable proof of your consent (selected categories, timestamp in UTC, banner version, and a pseudonymous identifier for the choice) for the duration specified in Privacy Policy v2.1 § 8 (retention). The consent record does not include your IP address beyond what is necessary to regionalize the banner.
5.4 Non-European visitors
Visitors from jurisdictions that do not require consent for analytics or functional cookies may see a shorter notice or no banner, consistent with local law. Facet still honors Global Privacy Control ("GPC") signals as described in Privacy Policy v2.0 § 6.3 by treating a GPC signal as a signal not to set analytics or functional cookies.
Your choices.
6.1 Facet cookie-settings control
The “Cookie settings” control in the footer of each Facet property reopens the CMP and allows you to change your consent at any time. Your choices take effect immediately.
6.2 Browser controls
Most browsers allow you to refuse or delete cookies. Instructions are available at: Chrome, Firefox, Safari, and Edge. Disabling strictly necessary cookies may cause the Services not to function.
6.3 Platform-level signals
Facet honors Global Privacy Control (GPC) (globalprivacycontrol.org) as an opt-out signal for analytics and functional cookies, consistent with Privacy Policy v2.0 § 6.3. Facet does not deploy advertising cookies, so the GPC signal for “do not sell or share” is effectively the default posture.
Jurisdictional disclosures.
7.1 European Economic Area: ePrivacy Directive
Facet complies with Directive 2002/58/EC (as amended by Directive 2009/136/EC) (the "ePrivacy Directive") Art. 5(3), which requires informed consent for storing or accessing information on a user's device, other than for cookies strictly necessary for the service the user explicitly requested. Member-State implementations vary; Facet recognizes Member-State-specific guidance where it imposes stricter requirements.
7.2 France: CNIL
For visitors from France, Facet honors the guidance of the Commission nationale de l'informatique et des libertés ("CNIL"), including the requirement that rejecting cookies be as easy as accepting (CNIL Deliberation 2020-091) and the specific consent expectations for analytics cookies even where they are first-party.
7.3 United Kingdom: PECR
Facet complies with the Privacy and Electronic Communications (EC Directive) Regulations 2003 (“PECR”) and the UK ICO's guidance on cookies and similar technologies. PECR Regulation 6 requires informed consent for non-strictly-necessary cookies.
7.4 Switzerland: Swiss FADP
Facet complies with the Swiss FADP (Art. 19, duty to inform) for cookie-based Processing of Personal Data for Swiss-resident visitors.
7.5 California: CCPA / CPRA
Facet does not sell Personal Information or share it for cross-context behavioral advertising (Privacy Policy v2.1 § 6.3). Cookies on Facet properties do not trigger a “Do Not Sell or Share My Personal Information” link requirement. Facet nonetheless honors GPC signals (Section 6.3) and offers the Facet cookie-settings control for user convenience.
7.6 Other jurisdictions
Facet honors jurisdictional cookie requirements applicable to residents of other jurisdictions where reasonably identifiable, including Brazil LGPD Art. 18 (data-subject rights), Canada PIPEDA consent-based framework, and Australia Privacy Act APP 3 (collection of Personal Information).
Changes to this policy and how to contact us.
8.1 Changes
Facet may update this Cookie Policy from time to time. Material changes follow the notice procedure in Privacy Policy v2.1 § 15.1. Changes to the cookie inventories in Sections 3 and 4 are treated as operational updates and may be made without material-change notice, provided the overall consent framework and categorization do not materially decrease user protection.
8.2 Contact
Privacy questions:
[email protected]
Postal: Facet, LLC, Attn: Privacy, 1
Market St, Suite 100, San Francisco, CA 94105