PrepStack Cookie Policy
Last updated: 13 October 2026
1. About this Policy
PrepStack is the company-wide brand for services operated by PrepStak Technologies Limited, the legal operator name confirmed by PrepStack and matching the PrepIQ materials. Verify the incorporation jurisdiction, registration details and official address before publication. This Policy explains how our websites use cookies and similar technologies. It applies to the PrepStack corporate website and administration site, PrepOrder websites and web applications, PrepIQ websites and web dashboard, and any additional website that we identify as operated by PrepStack.
Different products use different technologies. The table below reflects items identified in the source review and limited checks of live public pages; it is not a guarantee that every production host, provider or browser will set only these items. Product-specific privacy notices explain other device and account data in more detail. Mobile-app storage and SDK identifiers are addressed in those notices and are not browser cookies.
2. What cookies and similar technologies are
Cookies are small files that a website stores in your browser. Similar technologies include local storage, session storage, pixels, tags, scripts and identifiers that store information on or read information from your browser or device. Some are set by the website you visit; others may be set by a service embedded in it.
We describe browser storage alongside cookies because some laws regulate similar device storage or access in comparable ways. Whether consent is required depends on the technology, its purpose and the law that applies to you.
3. How we use them
We group these technologies by purpose:
- Strictly necessary: sign-in, account security, routing, and features you ask the website to provide. These cannot generally be switched off through the website without affecting that feature.
- Preferences: remembering choices such as language or interface settings.
- Analytics: measuring how a site or feature is used so we can understand and improve it.
- Marketing: measuring campaigns or personalising advertising, if we use those technologies.
Where applicable law requires consent for optional technologies, we will ask before storing or accessing them. We will explain the purposes and provide a way to refuse optional categories. Simply browsing a site does not mean that you have consented.
4. Current inventory identified from source and limited live checks
The names and durations below are implementation details found in the reviewed application code or limited live response checks. A cookie marked “verify” must be checked on the live site before this Policy is published. The live checks did not cover every domain, page, sign-in, checkout or consent state.
| Website or product | Name or storage item | Purpose and category | Duration identified |
|---|---|---|---|
| PrepStack public website | NEXT_LOCALE | Remembers the selected website language; preference. | A live response to the English website set this as a session cookie (Path=/, SameSite=Lax); verify both language routes and its behavior in a browser. |
| PrepStack administration site | __Host-prepstack_admin | Admin authentication and session security; strictly necessary. It is host-only, HttpOnly, Secure in production, and uses SameSite=Lax. | Browser cookie: up to 7 days. The server ends a session after 12 hours without activity and also enforces a 7-day maximum. |
| PrepOrder public website | NEXT_LOCALE | Remembers the selected website language; preference. | A live response set a one-year expiry; verify both language routes and its behavior in a browser. |
| PrepOrder consumer web app | locale | Remembers the selected language; preference. | 1 year. |
| PrepOrder restaurant dashboard | po_session | Sign-in routing marker; strictly necessary for the dashboard's session flow. | 14 days. |
| PrepOrder consumer web app | auth.access, auth.refresh, auth.expiresAt, auth.refreshedAt in local storage (not cookies) | Sign-in tokens and session state; strictly necessary. | Until sign-out, browser storage is cleared, or the token/session expires; the client enforces a 30-day maximum session age. |
| PrepOrder consumer web app | telemetry.consent, telemetry.queue, telemetry.session, telemetry.session_started in local storage (not cookies) | Stores the optional first-party analytics choice and, only when enabled, an unsent event queue and session timing data. | Choice remains until changed or cleared; queued events remain until sent or cleared. A new analytics session is started after 30 minutes of inactivity. |
| PrepOrder restaurant dashboard | po_dash_access, po_dash_refresh in local storage (not cookies) | Dashboard sign-in tokens; strictly necessary. | Until sign-out, browser storage is cleared, or the token expires; verify the deployed token lifetime. |
| PrepOrder restaurant dashboard | NEXT_LOCALE | Language preference read by the dashboard; preference. | Verify how it is set and its lifetime. |
| PrepIQ web dashboard | prepiq_access_token | Authenticates the dashboard session; strictly necessary. | 15 minutes for a standard login; an impersonation session follows its shorter session expiry. |
| PrepIQ web dashboard | prepiq_refresh_token | Maintains an authenticated dashboard session; strictly necessary. | Up to 30 days for a standard login; an impersonation session follows its shorter session expiry. |
| PrepIQ web dashboard | prepiq_impersonation | Shows support-session context while an authorised, read-only support session is active; strictly necessary. It contains banner metadata, not an authentication credential. | Until the related support session expires. |
| PrepIQ public website | prepiq_cookie_notice_v1 in local storage (not a cookie) | Stores when the visitor dismissed the explanatory notice; it is not an analytics or marketing consent record. | The site treats it as current for up to 1 year, then clears it when the visitor returns. |
| PrepIQ kitchen calculator | piq.kitchenCalculator.visitorId in local storage (not a cookie) | A browser-generated identifier sent with calculator submissions; the source code comments associate it with rate limiting. | Remains in browser storage until cleared; no expiry is set in the reviewed code. |
The current source review found no optional analytics or advertising vendor tag on the PrepIQ website. Its updated notice identifies those categories as inactive and provides a persistent information panel; that change must be deployed with this Policy. Verify the live site and externally injected scripts before publication. The corporate PrepStack public-site source reviewed for this draft did not identify a visitor analytics or advertising cookie. Deployment, hosting or security services may set additional strictly necessary items; add them to the live inventory if present.
5. Browser storage that is not a cookie
Our web apps also use local or session storage for service functions. Depending on the product and your use, this can include sign-in tokens, language and interface choices, connection handoffs, temporary checkout or group-order state, saved feature settings, and—when enabled—PrepOrder's consent setting and unsent first-party usage-event queue. PrepIQ's dashboard uses browser storage for language, interface state and cached application data.
These items are not all cookies, and they do not all serve analytics or advertising. The relevant product Privacy Policy describes what information is stored, sent to our services and retained there. You can clear browser storage using your browser controls, but doing so may sign you out or remove preferences and temporary feature state. Clearing local storage does not delete information already sent to a service.
6. Third-party technologies
Our current source review did not confirm a complete inventory of third-party technologies or infrastructure-level cookies on production websites. Before publication, we will identify each provider that stores or accesses information on your browser or device, explain its purpose and duration, and describe any consent choice that applies. A provider may also process information under its own privacy notice and the agreement that governs its service.
7. Your choices
Where we use optional technologies that require consent, you can accept or reject their categories and change or withdraw your choice later. On the current PrepIQ public website, no optional analytics or marketing tags were found; its notice labels those categories inactive and the persistent Privacy & cookies control reopens the information panel. If optional tags are introduced, working controls must be connected and consent collected before they run.
You can also use browser settings to block or remove cookies and clear local or session storage. If you block strictly necessary storage, sign-in, language selection, checkout or other requested features may not work as intended. Browser “Do Not Track” settings may not be recognised by every service.
Where the laws that apply to you require prior consent for non-essential cookies or similar technologies, we will not rely on your continued use of a site as consent. The rules differ by location; this Policy does not make a single consent rule apply to every visitor.
8. Updates and contact
We may update this Policy when our products, technology or legal requirements change. The “Last updated” date shows when the text was most recently revised. We will provide any notice required by law for a material change.
For questions about cookies or browser storage, contact customer@prepiq.net (confirm that this mailbox is monitored for company-wide privacy requests) or call +256 709 802 259. Current product notices list PrepStak Technologies Limited and Dubai, Makindye II, Makindye Division, Kampala, Uganda; verify the registered address before publication.
Internal publication checks — remove this section before publishing
- Test each live production domain and subdomain in a clean browser session before and after sign-in, checkout, language changes and any consent choice. Record actual cookie/local-storage names, providers, purposes, categories, lifetimes and domains.
- Verify the configured hosting, CDN/security, payment, identity, analytics, embedded and monitoring services. Update the inventory for any technology they set or access.
- Confirm the updated PrepIQ notice and persistent information panel are deployed together with this Policy. Keep analytics and marketing marked inactive until optional tags are added; connect and test consent and withdrawal controls before enabling any such tags.
- Confirm the legal entity, contact mailbox, applicable countries and consent requirements with company records and qualified counsel. Set the effective date after that review.