IMAGINE
session--:--:--
Imagine Cookies

Cookie Policy

This policy explains the cookie and browser-storage baseline for the corporate site. It is aligned to an explicit-consent model for non-essential technologies on consent-regulated surfaces and is written to stay consistent with the site's updated privacy program.

This Cookie Policy explains how the corporate site and related web surfaces use cookies, local storage, and similar technologies. Product-specific services may publish additional cookie or tracking details where their functionality differs materially.
Live legal baseline9 sectionsRights routing activeDocs-ready presentation
Last updated May 31, 2026
01
Document section

1. What we mean by cookies and similar technologies

Cookies are small files or tokens stored in the browser or device. Similar technologies can include local storage, session storage, server-side session tokens, and related browser mechanisms used to remember settings, preserve security, or measure performance.

02
Document section

2. Categories we use

  • Strictly necessary: required for core page delivery, security, consent handling, authentication, cart or account continuity, and similar essential operations.
  • Preference and accessibility: used to remember language, accessibility, or interface choices where available.
  • Analytics or performance: used only where activated and, where required, only after consent for non-essential measurement.
  • Campaign or marketing technologies: not activated on a consent-required basis unless the relevant notice and controls are in place.
03
Document section

3. Our current baseline

The current baseline of this site is designed to rely on essential functionality by default, together with an explicit consent choice for optional non-essential cookies where those technologies are introduced on a covered surface.

We do not rely on "continued browsing equals consent" for non-essential cookies on consent-regulated surfaces.

A live browser-technology inventory is published in this Cookie Policy experience and through /api/trust/browser-technologies so the declared storage baseline can be reviewed against the code-backed implementation.

05
Document section

5. Retention and storage periods

Storage periods depend on the purpose of the technology. Session cookies are removed when the session ends. Persistent cookies or preference signals last for the period reasonably necessary for the disclosed purpose or until you clear them, subject to the technical limits of the browser and applicable law.

Where a consent preference is stored, we aim to retain that preference for a reasonable period so you are not repeatedly prompted, while still allowing periodic refresh where law or practice requires it.

06
Document section

6. Third-party technologies

If we use third-party technologies for analytics, embedded media, or campaign operations, those providers may receive technical data such as device, browser, IP, or event data depending on the integration. Before enabling consent-gated integrations, we should disclose the provider and relevant purpose in the applicable notice or live preference layer.

07
Document section

7. Browser and signal controls

You can delete cookies, block storage, or use browser-based privacy tools. Some jurisdictions also recognize opt-out preference signals for particular types of processing, including sale, sharing, or targeted advertising workflows.

On the covered browser surfaces in this repository, we recognize a supported Global Privacy Control signal as a restrictive baseline and keep optional categories off unless you later make an explicit preference choice through the site controls.

08
Document section

8. Product-specific surfaces

Separate products, beta programs, or wallet surfaces such as Lucid may use different technical stacks. Where those stacks rely on additional cookies, browser storage, or routing providers, a supplemental cookie or privacy disclosure may apply.

09
Document section

9. Contact

For cookie and privacy questions, use the Privacy Request Center or contact privacy-requests@imagine-tech.org. For general support, contact support@imagine-tech.org.

Regional deltas

Regional cookie and consent supplements

These notes explain how the site cookie baseline should behave under different consent and advertising-control regimes. They sit on top of the main Cookie Policy.

Regions
5
Active cards
1
Official sources
10
EEA, UK, and similar cookie-consent regimes

Europe

Non-essential cookies and similar trackers should remain disabled until the user gives a valid affirmative choice on the covered surface.

Interpretation note

Each card below is written as an operational supplement to the baseline document family, not as a standalone contract. It highlights where timing, appeal rights, complaint routes, or consent posture need to diverge by jurisdiction.

01
Regional supplement

Consent model

  • Refusing optional cookies should be as available as accepting them.
  • Essential-only browsing remains available without requiring non-essential tracking consent.
  • Consent withdrawal should be possible through the same site controls or an equivalent revisit path.

Live preference controls

You can review and change your optional cookie categories here at any time. The control below is the same consent-management layer used across the covered corporate surfaces, and it now also recognizes a Global Privacy Control signal as a restrictive baseline on the covered browser layer until you make an explicit site choice.

Cookie Preference Center

Control optional cookies and browser storage

Use this control center to allow only essential technologies, enable all optional categories, or choose a custom mix. We keep necessary security and session functions on, while optional categories stay behind your explicit choice.

Current mode
Essential only
No saved choice yet
Loading your current cookie preferences...

Live browser technology inventory

To keep the cookie baseline auditable, the covered repository now exposes a live inventory of declared cookies, local storage keys, and browser-managed vendor integrations. This is meant to be the code-backed source of truth for the browser layer, not just a narrative policy paragraph.

Stored technologies
12
Essential baseline
10
Preference memory
2
Browser-managed vendors
0

This inventory is the browser-side source of truth for the covered repository. It lists the cookies and local-storage keys currently declared in code, together with the consent category they belong to and the purpose they serve.

The same governance layer also tracks browser-exposed vendor scripts or widgets. At the moment, this repository does not declare any optional third-party browser scripts on the covered surfaces. Future additions should be declared in the integration registry and gated through the consent layer before activation.

CookieEssential

cookie_consent

Stores the current consent level so the banner and preference center can honor the user choice.

Retention
Up to 180 days unless refreshed, cleared, or replaced by a newer preference.
Data footprint
Consent state only.
Security notes
Client-readable preference cookie; no raw IP is stored inside the value.
CookieEssential

cookie_consent_preferences

Stores the category-level preference bits for essential, preferences, analytics, and marketing handling.

Retention
Up to 180 days unless refreshed, cleared, or replaced by a newer preference.
Data footprint
Consent category choices only.
Security notes
Client-readable compact preference string used by the consent layer.
CookieEssential

cookie_consent_id

Provides a stable identifier for the consent record so server-side evidence can be updated without using raw network identifiers.

Retention
Up to 180 days unless refreshed, cleared, or replaced by a newer preference.
Data footprint
Random UUID-style identifier.
Security notes
Client-readable identifier used to link browser choice with server-side consent evidence.
CookieEssential

cookie_consent_ts

Records when the current consent choice was last updated.

Retention
Up to 180 days unless refreshed, cleared, or replaced by a newer preference.
Data footprint
Timestamp only.
Security notes
Client-readable evidence timestamp for preference refresh and audit support.
CookieEssential

cookie_consent_version

Tracks the notice version associated with the stored cookie preference so refresh logic can be evaluated later.

Retention
Up to 180 days unless refreshed, cleared, or replaced by a newer preference.
Data footprint
Version string only.
Security notes
Supports change control when the notice or consent schema changes.
CookieEssential

cookie_consent_signal

Records that a browser-level opt-out signal, such as Global Privacy Control, was honored as a restrictive baseline until an explicit site choice is made.

Retention
Up to 180 days unless replaced by an explicit preference choice or cleared by the user.
Data footprint
Signal state only, such as gpc.
Security notes
Used to avoid repeatedly re-recording the same browser opt-out signal while keeping optional categories off by default.
CookieEssential

cookie_consent_signal_ts

Records when a browser-level opt-out signal was last honored by the consent layer.

Retention
Up to 180 days unless replaced by a newer signal record or explicit preference choice.
Data footprint
Timestamp only.
Security notes
Provides narrow evidence timing for browser-signal handling without storing raw network identifiers.
CookieEssential

customer_session

Maintains authenticated customer access after a successful OTP login.

Retention
Server-defined token lifetime only; current implementation uses up to 30 days, or a shorter preference-aware path where configured.
Data footprint
Signed session token containing customer account identifiers.
Security notes
HttpOnly, same-site, path-scoped, and secure in production.
CookieEssential

admin_session

Maintains privileged admin access after successful primary authentication and MFA where required.

Retention
Server-defined admin session lifetime only.
Data footprint
Signed admin session token with role and permission context.
Security notes
HttpOnly, same-site, path-scoped, and secure in production.
Local storagePreferences

imagine-lang

Remembers the selected interface language across sessions.

Retention
Persistent until the user changes the setting or clears local browser storage.
Data footprint
Language code only.
Security notes
First-party local storage used for user-requested interface preference memory.
Local storageEssential

imagine-cart

Preserves cart contents and line-item notes for quote and order continuity.

Retention
Persistent until checkout completion, cart clearing, or user-driven browser cleanup.
Data footprint
Product identifiers, quantities, and any customer note entered in-cart.
Security notes
First-party local storage used to preserve requested cart continuity; should not hold unnecessary sensitive data.
Local storagePreferences

imagine-brand-liked

Remembers which public brand cards were liked in the portfolio browsing experience.

Retention
Persistent until the user removes the like state or clears local browser storage.
Data footprint
Brand like-state map only.
Security notes
First-party local storage for optional UX memory only.
Browser-managed vendor layer
Current position
No optional third-party browser scripts or widgets are currently declared for the covered repository surfaces.
Consent rule
Any future analytics, advertising, or similar browser integration should remain off until it is declared, reviewed, and mapped to the right consent category.
Governance path
New browser vendors should enter the integration registry and use the `ConsentManagedScript` wrapper or an equivalent reviewed gating control.