1. Introduction

This Cookie Policy (hereinafter referred to as the “Policy”) describes how STOQ FZ-LLC (FDRK5298, Compass Building, Al Shohada Road, AL Hamra Industrial Zone-FZ, Ras Al Khaimah, United Arab Emirates), the provider of the STOQ platform (hereinafter referred to as “STOQ,” “we,” or “us”), uses cookies and similar technologies when users interact with the Service, including the website, web application, mobile applications, and other technical components of the platform.

This Policy constitutes an integral part of the STOQ Privacy Policy and is applied in conjunction with the Terms and Conditions of Use and the Refund Policy. This Policy applies to all individual users of the Service. By using the Service, you acknowledge that you have read this Policy.

If you have any questions regarding this Policy, please contact: privacy@stoq.global.

2. What Are Cookies and Similar Technologies

A cookie is a small text file that a website or application saves on the user’s device when accessing the Service. Cookies enable the Service to recognise the user’s device upon subsequent visits, retain user preferences, and ensure the proper functioning of the platform’s features.

In addition to cookies, STOQ may use similar technologies, including:

• web beacons (“pixels”) — small graphic files embedded in pages or emails that enable the recording of the fact of download or opening;

• device identifiers — unique identifiers of mobile devices used for analytics and security purposes;

• local storage (localStorage, sessionStorage) — browser-based data storage technologies that are not automatically transmitted to the server;

• third-party SDKs and libraries — embedded software components from analytics providers and payment systems;

• session logs and technical logs — records of user actions in the interface used for diagnostics and security purposes.

In this Policy, all of the aforementioned technologies are referred to collectively as “cookies,” unless otherwise specified.

3. Types of Cookies Used by STOQ

STOQ uses the following categories of cookies:

3.1. Strictly Necessary cookies (Essential / Strictly Necessary)

These ensure the basic operation of the Service. Without them, the use of the platform is not possible. This category includes:

• authentication and session management cookies (maintaining logged-in status of the account);

• security cookies (protection against CSRF attacks, request verification tokens);

• subscription management cookies (identification of the active Subscription status and subscription plan);

• cookies necessary for payment processing through the payment provider (transmission of technical parameters to the payment page);

• load balancing cookies (distribution of requests across servers).

Legal basis: legitimate interest and performance of the contract. User consent is not required for this category — these cookies cannot be disabled without disrupting the functioning of the Service.

3.2. Functional Cookies (Functional / Preference)

These retain user preferences and enable interface personalisation:

• interface language and regional settings;

• display theme (light / dark, if applicable);

• user-defined data display and interface settings;

• notification preferences.

Legal basis: legitimate interest. In jurisdictions requiring consent, this category is included in the consent banner.

3.3. Analytics and Performance Cookies

These are used to collect aggregated data on Service usage for the purpose of its improvement:

• page visit and feature usage statistics;

• performance data (load times, interface errors);

• crash reports and technical incident reports;

• A/B testing of new features.

STOQ uses third-party analytics and crash-reporting tools (see Section 6). On the website, analytics cookies are used only with consent. In the mobile app, only crash and error reports are collected, linked to an anonymous installation identifier; they are not used to identify users or for marketing purposes.

Legal basis: on the website — user consent where required by law; in the mobile app — legitimate interest in keeping the Service stable (see Section 7.3).

3.4. Security and Fraud Prevention Cookies

These are used to detect suspicious activity and protect the Service and its users:

• detection of anomalous behavioural patterns and unauthorised access attempts;

• anti-fraud checks during payment processing;

• device identification upon account or region change;

• protection against automated requests (bot detection).

Legal basis: legitimate interest (ensuring the security of the Service and the protection of users).

3.5. Advertising and Marketing Cookies

STOQ does not use advertising cookies or advertising identifiers for targeted advertising, and no advertising is shown during the Beta. Advertising that may be shown on the free plan is selected only by market and declared field of activity and does not rely on advertising cookies (see Section 5 of the STOQ Privacy Policy). If advertising cookies are introduced in the future, users will be notified in advance and such cookies will be set only with prior consent through the consent banner.

Legal basis (upon introduction): explicit user consent (opt-in).

4. Purposes for Which STOQ Uses Cookies

• Authorisation and Session Management — Description: Maintaining logged-in status, managing session tokens, restoring access; Category: Strictly Necessary

• Security — Description: CSRF protection, anomaly detection, payment anti-fraud, bot detection; Category: Strictly Necessary / Security

• Subscription Management — Description: Identification of subscription plan, Subscription status, payment period; Category: Strictly Necessary

• Payment Processes — Description: Transmission of technical parameters to the payment provider, transaction confirmation; Category: Strictly Necessary

• User Settings — Description: Language, interface theme, data display preferences; Category: Functional

• Analytics and Product Improvement — Description: Aggregated usage statistics, A/B testing, error diagnostics; Category: Analytics / Performance

• Technical Diagnostics — Description: Crash reports, performance logs, infrastructure monitoring; Category: Analytics / Performance

• AI Functions — Description: Session context for AI functions used by the User (without profiling for advertising purposes); Category: Strictly Necessary

5. Cookies Related to Account, Subscription, Billing, and Refunds

STOQ is a subscription-based platform. A number of cookies and technical identifiers are inseparable from the processes of Subscription management, payment processing, and refund handling.

5.1. Subscription and Access Status Management

During each session with the platform, STOQ uses technical identifiers to determine:

• Subscription status (free plan, active, grace period, on hold, trial period);

• subscription plan and available functionality;

• next charge date and payment period;

• access rights to specific sections and features depending on the subscription plan.

These data are necessary for the proper provision of paid functionality and fall within the strictly necessary category.

5.2. Payment Processes

During the Subscription payment process, STOQ interacts with third-party payment providers certified under the PCI DSS standard. The payment provider may set its own technical identifiers on payment pages for the purposes of:

• transaction processing and payment instrument identification;

• anti-fraud verification (verification of payment data accuracy and behavioural pattern consistency);

• prevention of duplicate charges;

• compliance with PCI DSS requirements and anti-money laundering legislation.

STOQ does not store complete payment details (card data) and receives only technical transaction confirmation from the provider. The use of cookies by the payment provider is governed by its own privacy policy.

5.3. Auto-Renewal

To support automatic Subscription renewal, STOQ uses technical identifiers that enable:

• identification of the account and its renewal date;

• processing a request to cancel the Subscription prior to the charge date.

These technical processes are carried out on the basis of STOQ’s contractual obligations and do not require separate consent.

5.4. Failed Payments and Refund Support

In the event of a failed payment, initiation of a refund, or transaction dispute (chargeback), STOQ may use technical identifiers for:

• identification of the relevant account and transaction;

• transmission of data to the payment provider for dispute review;

• recording the history of support enquiries related to refunds or cancellations.

Data collected in connection with a chargeback or refund may be retained longer than standard cookie retention periods — for the period necessary to complete the relevant procedures (see Section 9).

6. Third-Party Cookies and Service Providers

STOQ uses the third-party tools listed below, which may set their own cookies or similar technologies when working with the Service.

• Analytics — Providers: Google Analytics 4 (website); Purpose: Website usage statistics (with consent); Type of cookies: Analytics / Performance

• Payment Providers — Providers: Stripe; PayPal (including Braintree); Apple (App Store); Google (Google Play Billing); RevenueCat; Purpose: Transaction processing, subscription status, anti-fraud; Type of cookies: Strictly Necessary

• Error Monitoring — Providers: PostHog (EU region, mobile app); Purpose: Crash and error reports; Type of cookies: Analytics / Performance

• Cloud Infrastructure — Providers: Amazon Web Services (EU); Purpose: Hosting, load balancing, technical sessions; Type of cookies: Strictly Necessary

• Advertising and Retargeting — Providers: Not used; Purpose: Advertising cookies are not used. Upon introduction — only with explicit prior consent; Type of cookies: Marketing (opt-in)

Third-party cookies are governed by the privacy policies of the respective providers. STOQ does not control third-party service cookies and recommends reviewing their privacy policies.

7. Cookie Management and User Choice

7.1. Consent Banner

Upon the first visit to the web version of the Service, all users are presented with a cookie management banner before any non-essential cookies are set. The banner enables:

• acceptance of all cookie categories;

• rejection of non-essential categories (analytics, marketing);

• customisation of preferences by category.

Strictly necessary cookies are set regardless of user choice, as disabling them would render the use of the Service impossible.

The selection made is saved and may be changed at any time through the cookie settings link available in the footer of the website.

7.2. Browser Settings

Most browsers allow cookie management through settings: blocking cookie installation, deleting previously installed cookies, or receiving notifications upon attempted installation. Please note: disabling strictly necessary cookies may disrupt the operation of the Service, including the ability to log in and manage the Subscription.

Instructions for managing cookies are available in the help sections of the browser being used.

7.3. Mobile Applications

In STOQ mobile applications, similar technologies (device identifiers, SDKs) are used instead of browser cookies. The mobile app sends crash and error reports to PostHog (data stored in the European Union) on the basis of legitimate interest; session recording is not enabled and no advertising identifier is used. You may object by writing to privacy@stoq.global. Device-level controls are available in the system settings:

• iOS: Settings → Privacy & Security → Tracking;

• Android: Settings → Privacy → Permissions and Advertising Identifiers.

7.4. Opting Out of Third-Party Analytics

On the website, the user may withdraw consent to analytics cookies at any time through the cookie settings, or opt out through the relevant provider’s mechanisms (e.g., Google Analytics Opt-out Browser Add-on).

8. Legal Bases and Consent Logic

• Strictly Necessary — Legal Basis: Performance of contract / Legitimate interest; Consent Required?: No; Opt-Out Possibility: No (disrupts the operation of the Service)

• Security and Anti-Fraud — Legal Basis: Legitimate interest; Consent Required?: No; Opt-Out Possibility: No (disrupts protection)

• Functional — Legal Basis: Legitimate interest; Consent Required?: In certain jurisdictions — yes; Opt-Out Possibility: Yes (via banner)

• Analytics / Performance — Legal Basis: Website: consent. Mobile app (crash reports): legitimate interest; Consent Required?: Website: yes. Mobile app: no (objection available); Opt-Out Possibility: Website: via banner. Mobile app: objection by email

• Marketing / Advertising — Legal Basis: Explicit consent (opt-in); Consent Required?: Yes (always); Opt-Out Possibility: Yes (via banner)

In jurisdictions where no specific cookie consent requirements have been established (e.g., UAE), the same consent banner is shown and STOQ applies this Policy.

Where a browser sends a Global Privacy Control (GPC) signal, STOQ treats it as a request to opt out of any sale or sharing of personal data where applicable law requires.

9. Cookie Retention Periods

Cookies may be session-based (deleted when the browser is closed) or persistent (stored for a defined period). Approximate retention periods:

• Session cookies (authorisation) — Retention Period: Until browser closure / logout; Notes: Automatically deleted upon session termination

• Security cookies — Retention Period: Up to 30 days; Notes: May be refreshed upon each login

• Subscription management cookies — Retention Period: For the Subscription period; Notes: Deleted after the Subscription ends or the account is deleted

• Functional cookies — Retention Period: Up to 12 months; Notes: Refreshed with each use of the Service

• Analytics cookies — Retention Period: Up to 24 months (cookie lifetime); Notes: Website only; consent may be withdrawn via the banner

• Payment process cookies — Retention Period: Session-based / up to 30 days; Notes: Provider’s technical cookies necessary for transaction processing

• Cookies related to refund / chargeback — Retention Period: Until completion of the procedure; Notes: Retained until dispute resolution; financial data may be stored longer in accordance with tax legislation

• Marketing cookies — Retention Period: Up to 12 months (upon introduction); Notes: Set only with explicit consent; may be deleted via the banner

Retention periods for account data and personal data processed in connection with the Subscription and refunds are governed by the STOQ Privacy Policy (Section 9).

10. International Data Transfers

STOQ is registered in the UAE, and the Service is hosted in the European Union. Due to the use of third-party analytics and infrastructure tools, data collected through cookies may be transferred and processed outside the user’s country of residence, including in the United States and other countries.

For the transfer of data of users from the EU/EEA to third countries, STOQ applies the EU Standard Contractual Clauses (EU Standard Contractual Clauses 2021) and other legally prescribed safeguards. Data transfer through cookie technologies is carried out exclusively by providers that have assumed the relevant data protection obligations.

For more information on international data transfers, see Section 8 of the STOQ Privacy Policy.

11. Consistency with the Privacy Policy, Terms and Conditions of Use, and Refund Policy

This Policy forms part of the unified set of STOQ documents for individual users and shall be applied in conjunction with:

• the STOQ Terms and Conditions of Use — with respect to security obligations, acceptable use, and limitation of liability for third-party tools;

• the STOQ Privacy Policy — with respect to categories of personal data, processing purposes, legal bases, user rights, retention periods, and international data transfers.

• the STOQ Refund Policy — with respect to technical processes accompanying Subscription cancellation, refund processing, and payment dispute resolution.

In the event of a conflict between this Policy and the STOQ Privacy Policy with respect to the processing of personal data, the provisions of the Privacy Policy shall prevail.

12. Updates to the Cookie Policy

STOQ reserves the right to periodically update this Policy in connection with changes in the technologies used, legislation, or internal processes.

We shall notify users of material changes affecting user rights no less than 14 (fourteen) days prior to the effective date of such changes — through the Service interface and/or by email. The date of the last update is indicated at the top of the document.

Continued use of the Service after the effective date of the changes shall constitute consent to the updated version of the Policy.

13. Contact Information

For enquiries relating to the use of cookies, the exercise of your data rights, or this Policy, please contact:

Privacy and cookie enquiries: privacy@stoq.global

Legal Enquiries: legal@stoq.global

Technical Support: support@stoq.global