Cookie Policy | Soapbox Cloud EHS Software

COOKIE POLICY

Effective Date: April 16, 2025

Published by SoapBox Software Solutions LLP | Hyderabad, India | privacy@soapbox.cloud

1. Introduction and Scope

SoapBox Software Solutions LLP ("SoapBox", "we", "us", or "our") is committed to being transparent about the technologies we use. This Cookie Policy explains what cookies and similar tracking technologies are, how we use them on:

our website at www.soapbox.cloud (and all related subdomains such as blog.soapbox.cloud); and
our cloud-based EHS and GRC Platform accessible at platform.soapbox.cloud (collectively, the "Platform").

This Cookie Policy should be read together with our Privacy Policy (available at www.soapbox.cloud/privacy) and our Terms of Service. It is addressed to:

Website visitors: individuals browsing our public-facing website, marketing pages, and blog.
Subscribers: business entities that have signed up for Soapbox.Cloud.
End Users: employees, contractors, and personnel of Subscribers who access the Platform.

By continuing to use our website or Platform after this Cookie Policy is made available to you, and by clicking "Accept" on our cookie consent banner, you consent to the use of cookies as described in this Policy. You may withdraw or adjust your consent at any time (see Section 7).

2. What Are Cookies and Tracking Technologies?

2.1 Cookies

Cookies are small text files that a website or web application places on your device (computer, tablet, or smartphone) when you visit it. They are sent back to the originating website on each subsequent visit, or to another website that recognises that cookie. Cookies are widely used to make websites and applications work more efficiently, as well as to provide information to the site owners.

Cookies can be:

Classification	Types	Description
By origin	First-party cookies	Set by Soapbox.Cloud directly on our domain.
By origin	Third-party cookies	Set by third-party services we integrate with (e.g., analytics providers). Note: we currently minimise third-party cookies.
By duration	Session cookies	Deleted automatically when you close your browser. Used for login sessions and temporary state.
By duration	Persistent cookies	Remain on your device for a set period or until you delete them. Used for preference memory and analytics.

2.2 Similar Tracking Technologies

In addition to cookies, we or our service providers may also use the following technologies on our website and Platform:

Web beacons (pixel tags): Tiny invisible images embedded in web pages or emails that help us understand whether a page was loaded or an email was opened.
Local storage: Browser-based storage (localStorage / sessionStorage) used to retain user interface preferences and session data within a single browser session.
Session tokens: Cryptographically signed identifiers stored server-side and referenced by a short-lived cookie, used to authenticate logged-in sessions securely.
Log files: Server-side records of requests made to our servers, including IP addresses, browser types, and pages accessed. These are not cookies but serve related analytical functions.

All of the above are referred to collectively as "cookies" throughout this Policy for simplicity.

3. Categories of Cookies We Use

We classify our cookies into four categories based on their purpose. Below, we describe each category and the specific cookies within it. The first category (Strictly Necessary) is always active. For all others, you may choose whether to accept or decline via our cookie preference centre.

🔐

Category 1 — Strictly Necessary Cookies (Always Active)

These cookies are essential for the website and Platform to function. They cannot be switched off in our systems. Without them, services such as login, security, and navigation would not work. They do not collect any information that could be used for marketing. No consent is required for these cookies.

Cookie / Technology	Purpose	Duration	Essential?	Opt-Out?
soapbox_session	Maintains your authenticated login session on the Platform	Session (closes with browser)	Yes	No
soapbox_csrf_token	Prevents Cross-Site Request Forgery (CSRF) attacks	Session	Yes	No
soapbox_tenant_id	Identifies the Subscriber tenant for correct data routing in the multi-tenant architecture	Session	Yes	No
soapbox_lang	Stores your language/locale preference for the Platform UI	12 months	Yes	No
cookie_consent	Stores your cookie consent preferences so we don't ask every visit	12 months	Yes	No
load_balancer_id	Ensures your session is routed to the same server instance (sticky sessions)	Session	Yes	No

⚙️

Category 2 — Functional / Preference Cookies (Optional)

These cookies enable enhanced functionality and personalisation. They may be set by us or by third-party providers whose services we have added to our pages. If you do not allow these cookies, some or all of these features may not function correctly.

Cookie / Technology	Purpose	Duration	Essential?	Opt-Out?
soapbox_ui_prefs	Remembers your Platform UI customisations (e.g., column visibility, dashboard layout, sidebar state)	6 months	No	Yes
soapbox_theme	Stores your light/dark mode preference	12 months	No	Yes
soapbox_timezone	Stores your timezone setting to display dates and times correctly	12 months	No	Yes
soapbox_tour_done	Records whether you have completed the onboarding product tour, so it is not repeated	Persistent (1 year)	No	Yes
intercom_[id]	Used by our in-app customer support chat widget to recognise returning users and maintain conversation history (if chat is enabled)	9 months	No	Yes

⚙️ You can disable functional cookies without losing core EHS Platform functionality. However, you may need to re-enter your preferences each session, and features like the support chat widget may not be available.

📊

Category 3 — Analytics / Performance Cookies (Optional)

These cookies allow us to count visits and traffic sources so we can measure and improve the performance of the Platform and website. They help us understand which pages and features are most and least popular, and see how visitors navigate. All information collected is aggregated and anonymised where possible.

Cookie / Technology	Purpose	Duration	Essential?	Opt-Out?
_soapbox_analytics	Our own first-party analytics cookie — records pages visited, features used, and time on page to help us improve the Platform	13 months	No	Yes
_soapbox_perf	Records page load times and API response times to help us identify and fix performance bottlenecks	30 days	No	Yes
_soapbox_error_log	Anonymous error tracking — captures UI errors and stack traces to help our engineering team diagnose bugs	Session	No	Yes
_ga / _ga_[ID]	Google Analytics — used on our public website only (not inside the Platform) to understand visitor behaviour. IP addresses are anonymised.	13 months	No	Yes — via consent banner
_hjid / _hjSession	Hotjar (website only) — heatmaps and session recordings to understand how visitors interact with our public website. No Platform data is recorded.	12 months	No	Yes — via consent banner

📊 Analytics cookies on the public website (Google Analytics, Hotjar) are only activated if you click 'Accept Analytics Cookies' on our cookie banner. Inside the Platform, only our own first-party analytics are used, with no data shared with third-party advertising networks.

📣

Category 4 — Marketing / Targeting Cookies (Optional — Opt-In Only)

These cookies may be set on our public website through our advertising partners. They may be used to build a profile of your interests and show you relevant advertisements on other sites. If you do not allow these cookies, you will experience less targeted advertising. Marketing cookies are never placed inside the authenticated Platform.

Cookie / Technology	Purpose	Duration	Essential?	Opt-Out?
_soapbox_mkt_src	First-party attribution cookie — records the source (e.g., referral link, campaign) through which you arrived at our website, to measure campaign effectiveness	90 days	No	Yes
LinkedIn Insight	LinkedIn Insight Tag (website only) — used to track conversions from LinkedIn ads and to understand the professional demographics of website visitors. Subject to LinkedIn's own privacy policy.	90 days	No	Yes — explicit opt-in
Google Ads / Floodlight	Records ad click-through conversions on our website when you arrive via a Google Ads campaign. Subject to Google's privacy policy.	90 days	No	Yes — explicit opt-in

📣 Marketing cookies are NEVER placed inside the authenticated Soapbox.Cloud Platform. They are limited strictly to our public-facing website (www.soapbox.cloud) and are only activated with your explicit opt-in consent.

4. How We Obtain Your Consent

4.1 Cookie Consent Banner

When you first visit www.soapbox.cloud or log into the Platform for the first time, you will be presented with a cookie consent banner ("Cookie Banner") that:

clearly explains that we use cookies and links to this Cookie Policy;
presents the cookie categories (Strictly Necessary, Functional, Analytics, Marketing) with a brief description of each;
provides separate toggles for each optional category so you can give granular consent;
includes an "Accept All" button, a "Reject Non-Essential" button, and a "Manage Preferences" option;
does not use pre-ticked boxes — optional categories are off by default until you actively enable them.

4.2 Legal Basis for Cookies

The legal basis we rely on under the Digital Personal Data Protection Act, 2023 (India) and applicable laws for each cookie category is as follows:

Cookie Category	Legal Basis	Notes
Strictly Necessary	Legitimate interest / contract performance	No consent required; essential to deliver the service.
Functional	Consent (opt-in)	Activated only if you enable them via the Cookie Banner or Preference Centre.
Analytics	Consent (opt-in)	Activated only after explicit acceptance. Aggregated and anonymised where possible.
Marketing	Explicit consent (opt-in only)	Activated only after explicit opt-in. Never placed inside the authenticated Platform.

4.3 Consent Record

We maintain a record of your cookie consent choices (via the cookie_consent cookie described in Section 3, Category 1). This record captures: the date and version of the Cookie Policy at the time of consent, and which categories were accepted or declined. We may ask you to refresh your consent if this Cookie Policy is materially updated.

5. Personal Data Processed Through Cookies

Some cookies process personal data. Here is a summary of what data is collected, why, and how long it is kept:

Data Collected	Purpose	Retention	Shared With
IP address (truncated)	Analytics — understanding geographic regions of visitors	13 months (anonymised)	None
Browser type & version	Compatibility and performance analytics	13 months	None
Device type & OS	Responsive design optimisation and error tracking	13 months	None
Pages visited & timestamps	Understanding usage patterns, improving UX	13 months	None
Session duration	Platform performance analytics	13 months	None
User ID (hashed/pseudonymised)	Linking platform analytics to a session (not a real name)	13 months	None
Referral source / UTM tags	Marketing attribution — understanding which campaigns drive sign-ups	90 days	None

🔒 SoapBox does not use cookies to collect or process Sensitive Personal Data (EHS health/incident records, medical data). All such data is processed only within the secure, authenticated Platform under the terms of your organisation's Data Processing Agreement — never via cookies.

6. Third-Party Cookies and Services

While SoapBox primarily uses first-party cookies, certain features on our public website integrate with third-party services that may set their own cookies. SoapBox does not control the cookies placed by third parties. Please refer to the respective privacy policies of each third-party service for full details:

Service	Provider	Purpose	Privacy Policy	Category
Google Analytics	Google LLC	Website traffic analytics	policies.google.com/privacy	3
Hotjar	Hotjar Ltd	Website heatmaps & UX recording	hotjar.com/legal/privacy	3
LinkedIn Insight	LinkedIn Corp	Ad conversion tracking	linkedin.com/legal/privacy	4
Google Ads	Google LLC	Ad conversion & remarketing	policies.google.com/privacy	4
Intercom	Intercom Inc	In-app support chat widget	intercom.com/legal/privacy	2

This list will be updated as we add or remove third-party integrations. We will notify you of material changes via the cookie consent banner.

7. Your Cookie Choices and How to Manage Them

You have multiple ways to control cookies. Please note that restricting certain cookies may affect the functionality of the Platform or website.

7.1 Cookie Preference Centre

The easiest way to manage your cookie preferences is through our Cookie Preference Centre, accessible at any time via the "Cookie Settings" link in the footer of our website and the Platform's settings menu. From there, you can enable or disable each optional cookie category individually.

1	Access the Preference Centre Click the "Cookie Settings" link in the footer of www.soapbox.cloud or inside the Platform under Settings → Privacy → Cookie Preferences.

2	Review Each Category Toggle individual cookie categories on or off using the sliders provided. Strictly Necessary cookies cannot be disabled.

3	Save Your Preferences Click "Save Preferences". Your choices are stored immediately and applied to all current and future sessions on this browser.

4	Change Anytime You can return to the Cookie Preference Centre at any time to update your choices. Changing your preferences takes effect immediately.

7.2 Browser-Level Controls

Most web browsers allow you to manage cookies through their settings. Below are instructions for the most common browsers. Note that disabling all cookies via your browser will also disable Strictly Necessary cookies and will prevent you from logging into the Platform:

Browser	How to Manage Cookies	Do Not Track / Private Mode
Google Chrome	Settings → Privacy and security → Cookies and other site data	Incognito mode automatically blocks third-party cookies
Mozilla Firefox	Options → Privacy & Security → Cookies and Site Data	Strict mode blocks tracking cookies by default
Microsoft Edge	Settings → Cookies and site permissions → Cookies and site data	InPrivate mode limits cookie persistence
Apple Safari	Preferences → Privacy → Manage Website Data	Private Browsing prevents cross-site tracking
Opera	Settings → Advanced → Privacy & Security → Site Settings	Private window limits cookie storage

7.3 Opt-Out of Specific Third-Party Services

For third-party cookies, you can opt out directly through the respective tools below:

Google Analytics: Install the Google Analytics Opt-out Browser Add-on: tools.google.com/dlpage/gaoptout
Google Ads: Manage Google ad personalisation at: adssettings.google.com
LinkedIn Ads: Opt out of LinkedIn interest-based advertising: linkedin.com/psettings/guest-controls
Hotjar: Opt out of Hotjar tracking: hotjar.com/legal/compliance/opt-out
Intercom Chat: Close or opt out of the chat widget using the controls within the widget itself.

7.4 Do Not Track (DNT)

Some browsers include a "Do Not Track" (DNT) feature that signals to websites that you do not want your online activity tracked. Because there is currently no universally accepted standard for responding to DNT signals in India or globally, Soapbox.Cloud does not currently alter its behaviour in response to DNT signals. However, you can use the Cookie Preference Centre (Section 7.1) or browser settings (Section 7.2) to exercise your preferences directly.

7.5 Mobile Applications

If SoapBox releases a native mobile application in the future, similar technologies (device identifiers, local storage) may be used. This Cookie Policy will be updated accordingly. You will be able to manage such preferences through your device's operating system settings.

8. Cookies Within the Authenticated Platform

The authenticated Soapbox.Cloud Platform (accessed after login) uses a more limited and controlled set of cookies compared to our public website, in line with the sensitive nature of EHS data processed within it. Inside the Platform:

Only Strictly Necessary and Functional cookies are set by default.
No Marketing or Advertising cookies are placed inside the Platform.
Analytics cookies inside the Platform are first-party only (operated by SoapBox). No EHS incident or health data is passed to any analytics or third-party system via cookies.
Subscriber administrators may configure certain Platform-wide settings (e.g., enabling or disabling the Intercom support widget for their tenant) through the Admin Console.
End Users can manage their individual UI preferences (which are stored via functional cookies) under their Profile Settings within the Platform.

🏢 Subscriber Administrators: Your organisation controls which optional Platform features (and their associated cookies) are enabled for your tenant. Review your Admin Console under Settings → Integrations to manage third-party tool connections such as support chat widgets.

9. Cross-Border Data Transfers via Cookies

Some of the third-party services listed in Section 6 (such as Google Analytics and LinkedIn) may transfer data collected via cookies to servers located outside India. Where this occurs:

SoapBox relies on the third-party provider's own data transfer safeguards (such as Standard Contractual Clauses or equivalent mechanisms) for such transfers.
SoapBox will only activate such third-party services where you have provided explicit opt-in consent via our cookie banner.
As the DPDP Act, 2023 and its Rules develop and specify permissible cross-border data transfer countries, we will update our third-party integrations and this Policy accordingly.
All SoapBox's own (first-party) cookies and the data they collect are stored and processed in India or in countries we are permitted to transfer data to under applicable law.

10. Cookie Retention and Deletion

Individual cookie retention periods are listed in the cookie inventory tables in Section 3. As a general principle:

Session cookies: are automatically deleted when you close your browser.
Persistent cookies: expire after the period shown in the tables, after which the browser automatically deletes them.
You: can delete all cookies at any time through your browser settings (see Section 7.2).
We: will prompt you to re-consent if your consent has expired (currently set to 12 months from the date of your last consent action).

Deleting cookies does not delete any of your account data or EHS records stored within the Platform. Platform data is managed under your Subscriber account and governed by the Data Processing Agreement and Privacy Policy.

11. Your Rights in Relation to Cookie Data

To the extent that data collected via cookies constitutes personal data under the Digital Personal Data Protection Act, 2023, you have the following rights, which you may exercise by contacting us at privacy@soapbox.cloud:

Right	How It Applies to Cookie Data
Right to Information	You can access this Cookie Policy and the detailed cookie inventory tables at any time to understand what cookies are set and why.
Right to Withdraw Consent	You can withdraw consent for optional cookies at any time via the Cookie Preference Centre (Section 7.1) or by contacting us. Withdrawal applies prospectively.
Right to Erasure	You can delete cookies stored on your device at any time via your browser settings. You can also request deletion of analytics data linked to your pseudonymous user ID by contacting privacy@soapbox.cloud.
Right to Correction	If we hold inaccurate information derived from cookies (e.g., incorrect device locale), you can correct it via your Platform Profile Settings or by contacting us.
Right to Grievance Redressal	If you believe your cookie preferences or rights have not been respected, contact our Grievance Officer at privacy@soapbox.cloud. We will respond within 30 days.

12. Changes to This Cookie Policy

We may update this Cookie Policy from time to time to reflect:

changes in the cookies or tracking technologies we use;
new third-party integrations on our website or Platform;
updates to applicable law, including developments under the DPDP Act, 2023 and its Rules;
feedback from users or regulatory guidance.

When we make material changes, we will update the "Effective Date" at the top of this Policy and, where your consent is affected, display a refreshed cookie consent banner to obtain updated preferences. Minor updates (such as adding a cookie to an existing category) will be reflected in the cookie inventory tables without a new consent request.

The current version of this Cookie Policy is always available at www.soapbox.cloud/cookies.

13. Contact Us

If you have any questions, concerns, or requests in relation to this Cookie Policy or our use of cookies, please contact our Privacy Team:

SoapBox Software Solutions LLP

Attn: Grievance Officer / Privacy Team

Hyderabad, Telangana, India

Email: privacy@soapbox.cloud

Website: www.soapbox.cloud/cookies

Response Time: Within 30 days of receipt of any grievance or query.

This Cookie Policy was last reviewed and approved by SoapBox Software Solutions LLP in April 2025.