Cookie Policy EOR
Last updated:
This Cookie Policy explains how Cornerstone Global Partners Pte Ltd and its related corporations within the CGP Group, including Cornerstone Global Partners Columbus Inc in the United States (collectively, "we," "us," or "our"), use cookies and similar tracking technologies on the Keystone EOR product platform at https://eor.gokeystone.ai.
This Cookie Policy complies with applicable cookie and electronic communications laws across the jurisdictions in which we operate or receive personal data, including but not limited to: Singapore's Personal Data Protection Act (PDPA), Malaysia's Personal Data Protection Act, Vietnam's Personal Data Protection Law (PDPL), Thailand's Personal Data Protection Act, China's Personal Information Protection Law (PIPL), Colombia's Ley 1581 de 2012 (Habeas Data), the European Union's General Data Protection Regulation (GDPR) and ePrivacy Directive, the United Kingdom's Data Protection Act 2018, UK GDPR, and Privacy and Electronic Communications Regulations (PECR), and applicable United States federal and state privacy laws (including the California Consumer Privacy Act / California Privacy Rights Act, Virginia Consumer Data Protection Act, Colorado Privacy Act, Connecticut Data Privacy Act, and Utah Consumer Privacy Act).
This Cookie Policy supplements our Privacy Policy and applies specifically to the Keystone EOR product. For cookies on the CGP Group corporate website, see https://www.cgpgroup.com/cookie-policy. For cookies on the broader Keystone AI product, see https://gokeystone.ai/cookie-policy.
By signing into Keystone EOR and using the Service, you agree to the use of cookies in accordance with this Policy and the choices you make through our consent of banner or in-product preferences.
1. What Are Cookies?
Cookies are small text files placed on your device (computer, tablet, or mobile) when you access web applications. In a logged-in EOR product context, cookies are essential for authenticating your session, protecting your account, processing payroll and payment actions securely, and remembering your in-product preferences.
We also use similar technologies including pixels, tags, local storage, and session storage. For convenience, all are referred to as "cookies" in this Policy.
2. Categories of Cookies We Use
Our cookies are grouped into six categories, matching the categories shown in our cookie consent banner. Categories aside from "Necessary" can be toggled on or off in the banner. Under the hood, our consent infrastructure uses Google Consent Mode v2 (advanced) — see Section 3.
a) Necessary
Required to enable basic EOR platform features, such as secure access, authentication, session management, CSRF protection, load balancing, and remembering your consent preferences. These cookies do not store personally identifiable data and cannot be disabled — without them, you cannot log in or use the product securely.
Two additional sets of cookies are treated as Necessary in the EOR context because they are required to complete actions you have explicitly initiated:
b) Functional
Help the product provide enhanced functionality such as remembering your in-product preferences (language, timezone, currency, theme, onboarding state), supporting content sharing, collecting feedback, and supporting selected third-party features.
These cookies are loaded only after you grant consent through our cookie banner.
c) Analytics
Help us understand how users interact with the EOR platform, including visitor counts, feature usage, navigation patterns, and similar aggregated metrics.
Under Google Consent Mode v2, this category corresponds to the parameter analytics_storage. These cookies are loaded only after you grant consent.
d) Performance
Help us understand and improve key performance indicators so we can deliver a better experience — including page load times, error tracking, and real user monitoring.
These cookies are loaded only after you grant consent through our cookie banner.
e) Advertisement
Help provide more relevant advertising based on pages visited previously and measure campaign effectiveness. If we run marketing campaigns inside the EOR product (such as upsell prompts for additional countries or new features), these cookies may be used to deliver and measure them.
Under Google Consent Mode v2, this category corresponds to ad_storage, ad_user_data, and ad_personalization. These cookies are loaded only after you grant consent. As noted in Section 4, we do not currently use any advertisement cookies — this category exists in the consent banner so future infrastructure can be activated transparently.
f) Uncategorized
Cover cookies that are still being reviewed and have not yet been assigned to another category. These cookies are loaded only after you grant consent through our cookie banner.
3. Google Consent Mode v2 (Advanced)
Keystone EOR implements Google Consent Mode v2 in advanced mode, deployed via Google Tag Manager (GTM). By default, all four consent parameters are set to denied until you grant consent via the cookie banner or in-product preferences:
- analytics_storage (Default: Denied | Analytics): Enables storage and processing related to analytics (e.g., visit duration, pages viewed)
- ad_storage (Default: Denied | Marketing): Enables storage related to advertising (e.g., conversion tracking)
- ad_user_data (Default: Denied | Marketing): Sets consent for sending user data related to advertising to Google
- ad_personalization (Default: Denied | Marketing): Sets consent for personalized advertising
Strictly necessary, payment, and integration cookies are not gated by consent because they are required for core EOR functionality (or are only set in response to your explicit action — e.g., adding a payment method, connecting an HRIS).
4. Specific Cookies We Use
Necessary
Authentication is provided by Clerk. Keystone EOR does not set a custom session cookie — Clerk's cookies are used instead. There is no separate CSRF cookie; protection is via Clerk session security and stateless JWT verification (Authorization: Bearer header on the API, with the __session cookie as an optional fallback).
Hosting is on AWS ECS Fargate behind CloudFront and an Application Load Balancer (ALB). ALB stickiness is not configured and CloudFront does not set visitor cookies on eor.gokeystone.ai, so no AWSALB / AWSALBCORS cookies are present.
Cookie name: __session
Set by: Clerk
Purpose: Authenticated session JWT
Duration: Session; extended when you select "Remember me"
Cookie name: __client
Set by: Clerk
Purpose: Browser / client identification for session security
Duration: Persistent (managed by Clerk)
Cookie name: __client_uat
Set by: Clerk
Purpose: Last activity timestamp
Duration: Short-lived
Cookie name: keystone_cookie_consent
Set by: Keystone EOR
Purpose: Stores your cookie consent preferences (also persisted in browser localStorage)
Duration: 12 months
Analytics — Google Analytics 4 (GA4) via Google Tag Manager
GA4 is loaded through our Google Tag Manager container (ID: GTM-WSKZCRH4). The GA4 measurement ID is configured inside GTM and is not embedded in the application code.
Cookie name: _ga
Set by: Google Analytics
Purpose: Distinguishes unique users by assigning a randomly generated number as a client identifier
Duration: 2 years
Cookie name: _ga_*
Set by: Google Analytics 4
Purpose: Persists session state for the GA4 property (the * is replaced with our specific container ID)
Duration: 2 years
Performance — Datadog Browser RUM
We use Datadog Browser Real User Monitoring (RUM) to measure page load times, errors, and overall performance of the platform. Datadog RUM cookies are loaded only after you grant consent for the Performance category through our cookie banner or account settings.
Cookie name: _dd_s_v2
Set by: Datadog Browser RUM
Purpose: Stores the RUM session identifier, sampling decision, session expiration timestamp, and an anonymous user ID used to correlate sessions from the same browser across visits
Duration: 1 year (session itself expires after 4 hours of activity / 15 minutes of inactivity; the cookie persists longer to retain the anonymous identifier)
Cookie name: dd_cookie_test_{uuid} / dd_site_test_{uuid}
Set by: Datadog Browser RUM
Purpose: Ephemeral probe cookies used by the SDK on initialization to detect whether the browser accepts cookies and determine the correct domain scope. They are set, read, and immediately deleted within the same page load
Duration: Instant (never persist beyond the detection check)
All Datadog RUM cookies are first-party. No cross-site or third-party cookies are set by the Datadog RUM SDK.
Functional / Preferences
Name (storage type): keystone_cookie_consent (Cookie + localStorage)
Set by: Keystone EOR
Purpose: Consent preferences (mirrored from Necessary)
Duration: 12 months
Name (storage type): sidebar_state (Cookie)
Set by: Keystone EOR
Purpose: Sidebar expanded / collapsed state
Duration: 7 days
Name (storage type): theme (localStorage)
Set by: Keystone EOR
Purpose: Light / dark / system theme preference
Duration: Until cleared
There is no language cookie (the product is English-only). There is no onboarding_complete cookie — onboarding state is stored in the database and routed within the product.
Advertisement
We do not currently use advertisement cookies inside the product. As of the "Last updated" date of this Cookie Policy, the only analytics we deploy is Google Analytics 4. If we add in-product advertisement cookies in the future (such as LinkedIn Insight Tag for B2B remarketing or Google Ads conversion tracking), we will update this Cookie Policy and adjust our consent banner accordingly.
Uncategorized
Cookies in this category have not yet been classified. We review newly discovered cookies regularly and reassign them to the appropriate category.
5. Third-Party Cookies and Services
Some cookies are set by third-party services integrated into Keystone EOR:
Service: Clerk
Role: Authentication
Cookies on eor.gokeystone.ai: Yes (__session, __client, __client_uat)
Privacy Policy: clerk.com/privacy
Service: Google Analytics 4 (via GTM, container GTM-WSKZCRH4)
Role: Analytics
Cookies on eor.gokeystone.ai: Yes, after Analytics consent
Privacy Policy: policies.google.com/privacy
Service: Datadog Browser RUM
Role: Performance monitoring
Cookies on eor.gokeystone.ai: Yes, after Performance consent
Privacy Policy: datadoghq.com/legal/privacy
Service: Spott
Role: CRM + demo scheduling — stores form submissions (contact, demo, newsletter, pricing enquiries) and powers "Book a Demo"
Cookies on eor.gokeystone.ai: No on product pages; yes on spott.io if user follows "Book a Demo"
Privacy Policy: spott.io/cookie-policy
We do not control cookies set by third-party services. Please refer to their respective privacy policies.
6. Managing Your Cookie Preferences
a) Cookie banner
Use the "Cookie settings" link in the public footer to revisit your consent choices. Strictly necessary cookies cannot be disabled because they are required for authentication and core platform functionality.
b) Account settings
Logged-in users can also manage cookie preferences via the "Cookie settings" entry in the account menu.
c) Browser settings
Most browsers let you view, delete, and block cookies. Note: blocking strictly necessary cookies will prevent you from logging in.
7. Global Opt-In Default and US State Rights
Our cookie consent banner applies the same opt-in default for all visitors regardless of location: all cookies aside from "Necessary" are blocked until you grant consent through the banner. Under the hood, this is implemented using Google Consent Mode v2 in advanced mode, with all consent parameters defaulting to denied until you interact with the banner. This approach meets the strictest legal requirements (such as the GDPR for EEA visitors and the UK Privacy and Electronic Communications Regulations) and exceeds the minimum requirements for visitors in jurisdictions with more permissive defaults.
Visitors who are residents of California, Virginia, Colorado, Connecticut, or Utah have additional rights under their respective state privacy laws (CCPA/CPRA, VCDPA, CPA, CTDPA, UCPA), including the right to opt out of the sale or sharing of personal information for cross-context behavioural advertising. To exercise these rights, please refer to our Privacy Policy or contact our Data Protection Officer.
8. Special Considerations for Logged-in Users
Because Keystone EOR is a logged-in product platform, certain cookie practices differ from anonymous website visitors:
- Your consent choices are stored on your browser and device (in the keystone_cookie_consent cookie and browser localStorage) and apply across sessions on that device until you change them or clear site data.
- Strictly necessary cookies (Clerk authentication, consent storage) cannot be disabled — disabling them would prevent you from logging in or using the product securely.
- Optional cookies (Analytics, Functional, Performance) load only after you grant the relevant category through our cookie banner or account menu.
- If you delete your Keystone EOR account, personal data tied to your account is handled as described in our Privacy Policy. Browser-stored consent and preference data may remain until you clear site data in your browser.
- Worker data (individuals employed via the EOR service) is processed strictly for service delivery and is governed by separate Data Processing Agreements (DPAs) between the customer and CGP Group.
9. Your Rights
You have certain rights regarding your personal data, including the right to access, correct, delete, and (where applicable) port your data. To learn more, see our Privacy Policy or contact our Data Protection Officer at the details below.
10. Updates to This Policy
We may update this Cookie Policy from time to time. Material changes will be communicated through an in-product notice or via email to logged-in users.
11. Contact Us
Questions about this Cookie Policy can be directed to our Data Protection Officer:
Email: dpo@cgpgroup.com