Cookie Notice

buy.attestlayer.com uses essential cookies and browser storage needed for security, authentication, checkout recovery, preferences, request-fit state, and protection against abuse.

During Fit Check, tab-only session storage remembers non-sensitive scope selections through a refresh. It does not store the company name, email address, notes, or uploaded files. The state is cleared after a passed check and when the browser tab closes.

Order and Fit Check cookies

The commerce session cookie and the Fit Check authority cookie are HttpOnly, Secure, and SameSite=Strict. They are scoped to this site and are not used for advertising.

Human-support receipt cookies

The __Host-attestlayer_support cookie binds support abuse protection and a signed support receipt to the submitting browser. It is HttpOnly, Secure, SameSite=Strict, scoped to Path=/, and expires no later than 24 hours after it is set.

The __Host-attestlayer_support_receipt cookie carries the short-lived, signed accepted-and-queued receipt. It is HttpOnly, Secure, SameSite=Strict, scoped to Path=/, and expires no later than five minutes after it is set. Neither support cookie is used for analytics or advertising, and the receipt does not claim human review or email delivery.

Optional public analytics

Optional analytics uses a consented same-origin first-party relay only. The relay sends approved events to PostHog only on these non-sensitive public routes: /, /buyer-review-pack, /choose-the-right-workflow, /faq, /how-it-works, and /what-you-receive. The browser loads no PostHog browser SDK or other third-party analytics or marketing code. The optional events help us understand which public explanations and support entry points are useful; they are not used for advertising or client profiling.

The browser sends no client-request, source-record, evidence, evidence-binder index, generated statement, manifest, receipt, or package content through the analytics path to the relay or analytics provider.

Necessary and analytics are separate choices. Necessary storage remains active. Analytics is off by default and starts only after you select analytics or allow analytics. Choosing essential cookies only makes no optional analytics request. The browser honors Global Privacy Control and Do Not Track set to 1 as a necessary-only choice and does not silently override an explicit denial.

The saved browser preference is bound to the applicable Cookie Notice and policy manifest and expires after 180 days. A stale, expired, or differently bound grant causes the site to request a new choice before optional analytics resumes. The short-lived, signed server consent cookie expires after no more than 12 hours and is renewed only while a current browser grant remains.

Consent storage and the signed __Host-al_analytics_consent cookie are scoped only to the Buy site origin and host. The cookie has no Domain attribute, and the preference is not shared across AttestLayer subdomains. Withdrawing consent stops future optional tracking, clears optional analytics cookies and browser-storage entries that this site can access, and expires the signed server authority before a later grant creates a new pseudonymous session. Withdrawal does not retroactively delete or alter events lawfully collected before withdrawal.

Transactional email open and click tracking is disabled. Transactional delivery, access, billing, and support messages are not converted into optional public-website analytics events.

Measurement retention

Fit measurement rows for fit_started, fit_passed, and fit_failed_reason are retained for no more than 30 days. These measurement rows are distinct from separately governed paid Fit, order, invoice, and entitlement authority metadata. Other privacy-bounded first-party server measurement rows are kept for no more than 13 months.

Optional analytics consists only of low-cardinality events tied to an anonymous consent session. Under the current provider plan, those events may be retained for up to 12 months.

You can reopen cookie choices from the Cookie preferences button in the site footer. You can also control cookies through your browser settings. Blocking necessary cookies may prevent sign-in, Fit Check recovery, checkout, Console access, or support receipts from working.

For questions about cookies or analytics, email privacy@attestlayer.com.