Cookie Policy

1. Introduction

This Cookie Policy explains how React Motion Technologies SAS, operating as Caramel ("we," "our," or "us"), uses cookies and similar tracking technologies on our platform. This policy is part of our broader Privacy Policy and provides detailed information about the types of cookies we use, why we use them, and how you can control them.

Your Rights: Under the EU ePrivacy Directive and GDPR, you have the right to:

• Be informed about our use of cookies
• Consent to non-essential cookies before they are placed
• Withdraw consent at any time
• Access cookie-free essential services

2. What Are Cookies?

Cookies are small text files stored on your device when you visit our platform. They serve various purposes:

3. Legal Basis for Cookies

4. Cookies We Use

4.1 Essential Cookies (Always Active)

These cookies are necessary for the platform to function and cannot be disabled without losing core functionality.

4.2 Functional Cookies (Consent Required)

These cookies enable enhanced functionality and personalization.

4.3 Analytics Cookies (Consent Required)

These cookies help us understand platform usage and improve services.

4.4 Marketing Cookies (Consent Required)

These cookies enable personalized marketing and campaign tracking.

5. Third-Party Services and Their Cookies

6. Cookie Consent Management

6.1 Consent Requirements by Region

• European Union/EEA/UK: Prior consent required for non-essential cookies, granular consent per category, freely given and informed
• California (CCPA): Right to opt-out of sale (we don't sell data); Do Not Sell signal honored
• Other Regions: Best practice consent model applied globally

6.2 How We Obtain Consent

1. First Visit: Cookie banner with clear information, granular toggle controls, "Accept All" / "Reject All" / "Customize" options, and a link to this Cookie Policy
2. Consent Recording: Timestamp, categories consented to, policy version presented, and a unique consent ID
3. Consent Renewal: Annual renewal request, and after material policy changes

6.3 Managing Your Consent

Use the Privacy Settings page for real-time preference updates, category-level controls, and consent history. We also honor Global Privacy Control (GPC) signals.

7. How to Control Cookies

7.1 Our Cookie Controls

You can manage your cookie preferences at any time by clicking the "Cookie Settings" button on our website or visiting our Privacy Settings page.

7.2 Browser Controls

Most web browsers allow you to control cookies through their settings preferences. However, limiting cookies may impact your experience of our site and the services we are able to offer.

• Google Chrome
• Mozilla Firefox
• Safari (Mac)
• Microsoft Edge

Mobile: iOS — Settings → Safari → Privacy & Security. Android — Chrome → Settings → Site Settings → Cookies.

7.3 Third-Party Opt-Out Tools

• Your Online Choices (EU)
• NAI Opt-Out (US)
• DAA Opt-Out

8. Cookie Security

All our cookies implement:

• Secure flag: HTTPS-only transmission
• HttpOnly flag: No JavaScript access (where appropriate)
• SameSite attribute: CSRF protection (Strict, Lax, or None with Secure)

Sensitive cookie values are encrypted using AES-256-GCM, with quarterly key rotation and secure key storage.

9. Cross-Border Cookie Data

Primary cookie data processing occurs in the EU: first-party cookies in France (our servers), analytics in EU Cloud (Frankfurt), and infrastructure in Germany (Hetzner).

Limited cookie data may be transferred to the USA, only for specific services (Stripe payments), with safeguards including SCCs, encryption, and minimization.

10. Impact of Blocking Cookies

11. Special Categories

11.1 Session Recording

When enabled with your explicit consent, PostHog session replay masks all text inputs, excludes sensitive data, samples at a maximum 10% rate, and stores data in the EU only.

11.2 Do Not Track (DNT)

We respect DNT browser signals: no analytics cookies set, no marketing cookies set, essential cookies only.

11.3 Children's Privacy

No cookies are collected from users under 16. Age verification occurs before cookie consent, and parental consent is required where applicable.

12. Cookie Auditing and Compliance

Quarterly reviews cover our cookie inventory, purpose validation, expiry assessment, and third-party review. We also run automated cookie scanning and track consent rates, opt-out rates, and regulatory updates.

We maintain a cookie register (this policy), consent records (2 years), audit logs (5 years), and vendor assessments.

13. Updates to This Policy

We may update this Cookie Policy from time to time to reflect changes in our practices or for other operational, legal, or regulatory reasons. Material changes are communicated by email to registered users, a platform banner, and a cookie consent renewal prompt, and the "Last Updated" date on this page will change.

14. Frequently Asked Questions

15. Contact Information

16. Technical Implementation Notes

For developers — cookie consent gating for analytics initialization:

if (window.cookieConsent && window.cookieConsent.hasConsent('analytics')) {
  posthog.init('YOUR_API_KEY', {
    api_host: 'https://eu.posthog.com',
    opt_out_capturing_by_default: true,
  });
}

17. Jurisdiction and Disputes

Related Policies

For more information about how we handle your personal data, please see:

• Privacy Policy - Our comprehensive privacy policy
• Privacy Settings - Manage your privacy preferences
• Terms of Service - Our terms and conditions