1. What are cookies?
Cookies are small text files placed on your device when you visit a website. We also use similar technologies — localStorage and sessionStorage (browser storage that persists data on your device) and tracking pixels — and this policy covers those too. Where we say "cookies" below, we mean all of these unless stated otherwise.
2. The types we use
- Strictly necessary — required for the Sites to work (security, login, fraud prevention, remembering your consent choice). These do not require consent and cannot be switched off.
- Functional — remember your preferences (like your country/currency) and power features like live chat. The Sites work without them but less conveniently.
- Analytics — help us understand how the Sites are used so we can improve them. Used only with your consent.
- Marketing — measure our advertising and show you relevant ads on other platforms. Used only with your consent. If an ad or invite link brings you here before you have chosen, its tags are held in a session cookie (trt_attrib_pending) until you choose: they are kept only if you accept, deleted if you decline, and gone when you close your browser if you do neither.
3. Cookies we set (first party)
| Cookie | Purpose | Category | Expires |
|---|---|---|---|
| toprate_cookie_consent | Records your cookie consent choice | Strictly necessary | 12 months (180 days if you decline) |
| csrf-token / __Host-csrf-sig | Protect forms and requests against cross-site request forgery | Strictly necessary | 24 hours |
| oidc_* | Keeps you signed in — used only if your browser blocks normal browser storage | Strictly necessary | Up to 30 days |
| cap_1 | Secures a payment session you start from a secure payment link we send you (encrypted; our servers only) | Strictly necessary | 15 minutes |
| tr_send_market / tr_send_country | Detects whether to show you Australian (AUD) or New Zealand (NZD) pricing | Functional | 1–24 hours |
| tr_geo_override | Remembers a country/market you chose manually | Functional | 24 hours |
| trt_attrib | Remembers which ad or link brought you to us, so we can measure our advertising | Marketing | 90 days |
| trt_ref | Remembers the referral code from the invite link you used, so the friend who invited you is credited when you sign up | Marketing | 90 days |
| trt_attrib_pending | Holds the ad or invite tags from the link you arrived on until you answer the cookie banner. Becomes trt_attrib and trt_ref if you accept; deleted if you decline. Not used for anything else | Marketing | Session |
We also store limited data in your browser's localStorage/sessionStorage: your sign-in session, your consent choice, in-progress form details while you register or use the calculator, and interface preferences (e.g. dark mode, dismissed banners). Session storage is cleared when you close the tab.
4. Third-party services
With your consent (see section 5), the following third parties set cookies or receive data when you use the Sites:
| Service | Provider | What it does | Category | Typical cookies |
|---|---|---|---|---|
| Google Tag Manager | Google LLC (US) | Manages the tags below | Analytics/Marketing container | — |
| Google Analytics 4 | Google LLC (US) | Usage statistics (pages visited, features used) | Analytics | _ga, _ga_* — up to 13 months |
| Google Ads | Google LLC (US) | Measures ad conversions; remarketing | Marketing | _gcl_au — 90 days |
| Meta Pixel | Meta Platforms, Inc. (US) | Measures ad conversions from Facebook/Instagram; remarketing | Marketing | _fbp (90 days), _fbc |
| Chatwoot live chat | Self-hosted by us (Australia) | Powers the support chat widget; remembers your conversation | Functional | Browser storage token |
Conversion measurement may include details of a transaction you complete (such as amount, currency and a transaction reference). Google and Meta process data in the United States — see our Privacy Policy for how overseas disclosures are handled.
We self-host our web fonts; visiting the Sites does not send font requests to Google.
5. Your choices
- Consent banner. On your first visit you can accept or decline non-essential cookies. If you decline, analytics and marketing cookies are not used. You can change your mind at any time via "Cookie Settings" in the site footer.
- Browser controls. You can block or delete cookies in your browser settings. Blocking strictly necessary cookies may break sign-in, payments and security features.
- Ad platform controls. You can manage ad personalisation directly with Google and Meta, and opt out of Google Analytics via its browser add-on.
- Global Privacy Control / Do Not Track: our Sites do not currently respond to Global Privacy Control (GPC) or Do Not Track (DNT) browser signals. You can manage your choices using the controls above.
6. Changes to this policy
We will update this page when our use of cookies changes and revise the "Last updated" date. Material changes will be flagged on the Sites.
7. Contact
Questions or complaints: admin@topratetransfer.com.au, or via the contact details in our Privacy Policy. If you are unsatisfied with our response you may complain to the Office of the Australian Information Commissioner (oaic.gov.au).