Cookie Policy | Investatech

This page explains the cookies and similar technologies used on investatech.com (our marketing site) and rcicapp.ca (our SaaS platform, formerly app.investatech.com). It applies in addition to our Privacy Policy.

What is a cookie?

A cookie is a small text file placed on your device by a website you visit. It lets the site remember things like whether you're signed in, what language you read in, or what preferences you've set. We also refer below to similar storage technologies (localStorage, sessionStorage) with the same word.

Categories we use

Strictly necessary

Required for the site to function. We can't turn these off and you can't reject them without breaking the site.

Session / authentication — on rcicapp.ca, Supabase sets cookies to keep you signed in. On successful sign-in with the “Remember this device” option, we also set an investatech_device_trust cookie for 30 days so you can skip the email one-time code on the same browser.
Idle session timeout — on rcicapp.ca, iv_session_activity is an HttpOnly, HMAC-signed cookie that records the last time you interacted with the dashboard. After 20 minutes of inactivity the platform forces a sign-out for your security; this cookie is how the server enforces that limit.
Preference — investatech_locale remembers the language you chose in the dashboard or on a public booking page. iv_lang remembers the language you chose on this marketing site. investatech_theme remembers your dashboard appearance choice (Light, Colourful, or Dark Lite — one of three known values, no personal data).
Form security (reCAPTCHA) — on signup, password reset, and public booking forms, Google reCAPTCHA is loaded to protect against bots. We use it only to score form submissions. See Google's privacy policy.
Referral attribution— if you arrived via another tenant's referral link (?ref=…), we set an iv_ref cookie for up to 60 days that carries the referral code only (no personal data), so we can credit the referrer if you go on to subscribe. Scoped to.investatech.com on the marketing site and host-only on rcicapp.ca.
Operator impersonation banner — on rcicapp.ca, impersonator_email (HttpOnly) is set only while an Investatech operator is actively impersonating a tenant account for support, and is cleared the moment impersonation ends. It exists so a visible banner makes clear who is signed in.
Consent record — cookie_consent_v1 stores your choices from the cookie banner, so we don't keep asking.

Analytics (optional)

We'd like to understand which pages people read and where they drop off, but only with your permission. This category is off by default and only turns on if you accept Analytics in the cookie banner.

Google Analytics (GA4) — loaded only on investatech.com when you consent. IP addresses are anonymized; advertising identifiers are disabled. No cross-site tracking. No data is shared for advertising purposes.

Marketing / advertising

We don't use any. No ad pixels, no retargeting, no affiliate networks.

How to change your mind

Click the link here or in the footer of any page to reopen the cookie banner. You can also block or delete cookies entirely using your browser settings — but if you block strictly necessary cookies, rcicapp.cawon't be able to keep you signed in.

Legal basis and your rights

For strictly necessary cookies our legal basis is contractual necessity (GDPR Art. 6(1)(b)) and legitimate interest (Art. 6(1)(f)) for fraud / spam prevention. For analytics cookies we rely on your consent (Art. 6(1)(a) and the ePrivacy Directive), which you can withdraw at any time via the link above.

We comply with the EU GDPR + ePrivacy Directive, Canada's PIPEDA and Quebec Law 25, and US state privacy laws including the California CCPA/CPRA. We do not sell personal information. To exercise any access, deletion, or correction right, email info@investatech.com.

Changes to this policy

If we materially change the set of cookies we use, we'll bump the version tag on our consent cookie so this banner reappears and you can re-consent.