Cookie Policy

1. About This Policy

This Cookie Policy explains how ObraHaus IT Solutions (“ObraHaus,” “we,” “us,” “our”) uses cookies and similar technologies on obrahaus.com and across our products (the ObraHaus Console, FileForge, and other ObraHaus applications). It expands on Section 11 of our Privacy Policy, which it supplements and should be read together with. Terms not defined here have the meaning given in the Privacy Policy.

Cookies are small text files a website stores on your device to make it work and to remember information about your visit. “Similar technologies” include browser storage such as localStorage and sessionStorage. We use these sparingly and only for the purposes described below.

2. Our Approach

We keep cookies to a minimum:

• We use only strictly-necessary (authentication) cookies and functional (preference) cookies.
• Our website and product analytics are cookieless (see Section 4).
• We do not use advertising, marketing, cross-site tracking, or third-party profiling cookies, and we do not sell or share cookie-derived data with third parties. Consistent with NPC Advisory Opinion No. 2017-063, any cookie data that can be combined with other information to identify an individual is treated as personal information under our Privacy Policy.

3. Cookies We Use

The following first-party cookies are set by our own services. <project>denotes our authentication provider’s project identifier, and the authentication cookie may be split into numbered chunks (e.g. .0, .1).

The authentication cookies are shared across *.obrahaus.com so that one sign-in works across every ObraHaus product, and are transmitted only over secure (HTTPS) connections in production. They persist across browser sessions until you sign out or the session/refresh token expires. The oh-theme and oh_locale preference cookies are written only when you choose a theme or language in the account menu — they are not set before you make a selection.

4. Analytics — Cookieless

For aggregate website and product analytics we use Umami, a privacy-friendly analytics tool hosted on our own infrastructure. Umami sets no cookies and stores nothing on your device; it does not track you across other websites and does not share data with third-party advertising networks. Analytics run on our marketing site (obrahaus.com), not inside the signed-in Console.

5. Third-Party Cookies During Specific Actions

We do not set third-party advertising or tracking cookies. When you take certain actions, a service provider we use may set its own strictly-necessary cookies on its own domain to complete that action — for example:

• Payments — when you check out for a paid plan, our payment processor (PayMongo) operates the checkout in its own secure (PCI-DSS) environment.
• Discord verification — if you choose to verify your Discord account, Discord operates its own sign-in on its domain.

These are governed by those providers’ own cookie and privacy policies. The service providers we rely on, their purposes, and their jurisdictions are listed in Section 7 of our Privacy Policy.

6. Legal Basis and Consent

We use only cookies that are strictly necessary to provide a service you have requested (authentication) and functional cookies that remember a preference you have chosen, and our analytics are cookieless. On that basis we provide this notice rather than a consent banner, and we do not use cookie walls:

• Philippines (Data Privacy Act of 2012 / NPC). We rely on transparency and your own action: the strictly-necessary cookies deliver a service you asked for, and the preference cookies are set only when you actively choose a theme or language. We do not infer consent from mere browsing, and we do not block access behind a cookie wall (NPC Advisory Opinion No. 2017-063).
• EU (GDPR / ePrivacy). The authentication cookies are exempt as strictly necessary to deliver the sign-in service you requested; the oh-theme / oh_locale cookies are exempt user-interface-customisation cookies set as a result of your explicit choice; and because our analytics store and read nothing on your device, the cookie-consent rule (ePrivacy Art. 5(3)) is not engaged at all.
• United Kingdom (PECR, as amended by the Data (Use and Access) Act 2025). The same cookies fall under the strictly-necessary and the appearance/functionality-preference exemptions, and the cookieless analytics under the statistical-purposes exemption — with clear information (this policy) and a simple way to decline (Section 7).
• California (CCPA/CPRA). US law here is a notice-and-opt-out framework, not a consent regime: we give notice and do notsell or share personal information, so no “Do Not Sell or Share” action is triggered.

We do notuse “legitimate interest” as a basis for storing cookies on your device. Where we process any personal data that results from these cookies — for example, the IP address seen by our self-hosted analytics — the lawful basis for that processing is described in our Privacy Policy.

Should we ever introduce cookies that are not strictly necessary or functional — for example third-party analytics or advertising cookies — we will first implement an appropriate consent mechanism, and, for the jurisdictions that require it, honor recognized opt-out preference signals such as Global Privacy Control (GPC), before any such cookie is set.

7. How to Control Cookies

• Appearance and language: change or reset your light/dark and language preferences using the toggles in the ObraHaus account menu; this rewrites the oh-theme and oh_locale cookies. To stop storing a preference altogether, clear these cookies — and the reduced-motion-notice-dismissed browser-storage item — through your browser.
• Browser controls: you can view, block, or delete cookies through your browser settings. Please note that blocking strictly-necessary cookies will prevent you from signing in and using account features.
• Do Not Sell or Share / GPC: we do not sell or share your personal information or cookie-derived data, so there is nothing to opt out of; if this ever changes, we will honor recognized opt-out preference signals.

Disabling functional cookies will not break the service — you will simply need to set your appearance and language preferences again on each visit.

8. Changes to This Policy

We may update this Cookie Policy from time to time to reflect changes in the cookies we use, our practices, or applicable law and NPC issuances. We will provide notice of material changes consistent with the right to be informed under the DPA. The most current version is always available at obrahaus.com. This policy should be read together with our Privacy Policy and Terms & Conditions.

9. Contact

For questions about this Cookie Policy, our use of cookies, or to exercise your data-privacy rights, contact us — as a sole proprietorship, the owner handles data-protection matters directly:

Contact: hello@obrahaus.com · obrahaus.com

You may also lodge a complaint with the Philippine National Privacy Commission (privacy.gov.ph).