Legal
Cookie Policy
Last updated: 1 October 2026
Cookies Policy
Last updated: 1 October 2026
1 October 2026 — what changed
We clarified that blocking essential cookies may stop some features from working and described the chat identifier and shop information kept in browser storage.
28 September 2026 — what changed
We added a line about Google reCAPTCHA, which runs on some sign-in and checkout forms and may set its own cookie, and narrowed the “What We Don't Use” list so it no longer implies we use no third-party cookies at all. Nothing about our actual practice changed — reCAPTCHA has always run on these forms; this page previously did not mention it.
17 August 2026 — what changed
We corrected this page so it names exactly the cookies our services set, with their real purpose and lifetime. The previous version listed cookie names that were not in use. Nothing about our actual practice changed: we still set only cookies that are strictly necessary to keep you signed in, and we still use no advertising, tracking, analytics or social-media cookies.
At Scan & Pay, we believe in transparency and respecting your privacy. This policy explains the limited cookies we use to provide our payment services. We only use essential cookies that are strictly necessary for the app to function properly.
Our websites also keep a small amount of information in your browser's storage: a chat identifier and, on the shop, your basket, wishlist, language choice and sign-in state.
Essential Cookies (Required)
These cookies are strictly necessary for the app to function and blocking them may stop some features from working. They exist to keep you securely signed in.
__sap_session_pay · __sap_session_shop · __sap_session_operator
Keeps you signed in. One cookie per service, so a sign-in on one part of Scan & Pay cannot be reused on another. The payment and shop cookies last up to 14 days; the operator cookie lasts 8 hours. A cookie named __sap_session may also be present on older sessions and works the same way.
These cookies hold a signed session reference only — never your password, bank details, or payment information. They are marked HttpOnly (scripts on the page cannot read them), Secure (sent over HTTPS only), and SameSite=Lax (not sent from other websites, which protects against cross-site request forgery). They carry no Domain attribute, so each one stays on the single subdomain that issued it. Signing out clears the cookie immediately.
Google reCAPTCHA runs on some sign-in and checkout forms to block automated abuse, and may set its own cookie. Our Privacy Policy explains how it is used.
What We Don't Use
- ✕ Third-party tracking or advertising cookies
- ✕ Social media cookies
- ✕ Analytics cookies that identify you personally
Managing Cookies
Since we only use essential cookies that are required for the app to function, they cannot be disabled without affecting your ability to use our services. If you choose to block these cookies in your browser settings, some features of Scan & Pay may not work correctly.
Questions?
If you have any questions about our cookies policy, please contact us:
Email: hi@scanandpay.com.au