Cookie Policy EOR

Last updated:

This Cookie Policy explains how Cornerstone Global Partners Pte Ltd and its related corporations within the CGP Group, including Cornerstone Global Partners Columbus Inc in the United States (collectively, "we," "us," or "our"), use cookies and similar tracking technologies on the Keystone EOR product platform at https://eor.gokeystone.ai.

This Cookie Policy complies with applicable cookie and electronic communications laws across the jurisdictions in which we operate or receive personal data, including but not limited to: Singapore's Personal Data Protection Act (PDPA), Malaysia's Personal Data Protection Act, Vietnam's Personal Data Protection Law (PDPL), Thailand's Personal Data Protection Act, China's Personal Information Protection Law (PIPL), Colombia's Ley 1581 de 2012 (Habeas Data), the European Union's General Data Protection Regulation (GDPR) and ePrivacy Directive, the United Kingdom's Data Protection Act 2018, UK GDPR, and Privacy and Electronic Communications Regulations (PECR), and applicable United States federal and state privacy laws (including the California Consumer Privacy Act / California Privacy Rights Act, Virginia Consumer Data Protection Act, Colorado Privacy Act, Connecticut Data Privacy Act, and Utah Consumer Privacy Act).

This Cookie Policy supplements our Privacy Policy and applies specifically to the Keystone EOR product. For cookies on the CGP Group corporate website, see https://www.cgpgroup.com/cookie-policy. For cookies on the broader Keystone AI product, see https://gokeystone.ai/cookie-policy.

By signing into Keystone EOR and using the Service, you agree to the use of cookies in accordance with this Policy and the choices you make through our consent of banner or in-product preferences.

1. What Are Cookies?

Cookies are small text files placed on your device (computer, tablet, or mobile) when you access web applications. In a logged-in EOR product context, cookies are essential for authenticating your session, protecting your account, processing payroll and payment actions securely, and remembering your in-product preferences.

We also use similar technologies including pixels, tags, local storage, and session storage. For convenience, all are referred to as "cookies" in this Policy.

2. Categories of Cookies We Use

Our cookies are grouped into six categories, matching the categories shown in our cookie consent banner. Categories aside from "Necessary" can be toggled on or off in the banner. Under the hood, our consent infrastructure uses Google Consent Mode v2 (advanced) — see Section 3.

a) Necessary

Required to enable basic EOR platform features, such as secure access, authentication, session management, CSRF protection, load balancing, and remembering your consent preferences. These cookies do not store personally identifiable data and cannot be disabled — without them, you cannot log in or use the product securely.

Two additional sets of cookies are treated as Necessary in the EOR context because they are required to complete actions you have explicitly initiated:

b) Functional

Help the product provide enhanced functionality such as remembering your in-product preferences (language, timezone, currency, theme, onboarding state), supporting content sharing, collecting feedback, and supporting selected third-party features.

These cookies are loaded only after you grant consent through our cookie banner.

c) Analytics

Help us understand how users interact with the EOR platform, including visitor counts, feature usage, navigation patterns, and similar aggregated metrics.

Under Google Consent Mode v2, this category corresponds to the parameter analytics_storage. These cookies are loaded only after you grant consent.

d) Performance

Help us understand and improve key performance indicators so we can deliver a better experience — including page load times, error tracking, and real user monitoring.

These cookies are loaded only after you grant consent through our cookie banner.

e) Advertisement

Help provide more relevant advertising based on pages visited previously and measure campaign effectiveness. If we run marketing campaigns inside the EOR product (such as upsell prompts for additional countries or new features), these cookies may be used to deliver and measure them.

Under Google Consent Mode v2, this category corresponds to ad_storage, ad_user_data, and ad_personalization. These cookies are loaded only after you grant consent. As noted in Section 4, we do not currently use any advertisement cookies — this category exists in the consent banner so future infrastructure can be activated transparently.

f) Uncategorized

Cover cookies that are still being reviewed and have not yet been assigned to another category. These cookies are loaded only after you grant consent through our cookie banner.

Keystone EOR implements Google Consent Mode v2 in advanced mode, deployed via Google Tag Manager (GTM). By default, all four consent parameters are set to denied until you grant consent via the cookie banner or in-product preferences:

  • analytics_storage (Default: Denied | Analytics): Enables storage and processing related to analytics (e.g., visit duration, pages viewed)
  • ad_storage (Default: Denied | Marketing): Enables storage related to advertising (e.g., conversion tracking)
  • ad_user_data (Default: Denied | Marketing): Sets consent for sending user data related to advertising to Google
  • ad_personalization (Default: Denied | Marketing): Sets consent for personalized advertising

Strictly necessary, payment, and integration cookies are not gated by consent because they are required for core EOR functionality (or are only set in response to your explicit action — e.g., adding a payment method, connecting an HRIS).

4. Specific Cookies We Use

Necessary

Authentication is provided by Clerk. Keystone EOR does not set a custom session cookie — Clerk's cookies are used instead. There is no separate CSRF cookie; protection is via Clerk session security and stateless JWT verification (Authorization: Bearer header on the API, with the __session cookie as an optional fallback).

Hosting is on AWS ECS Fargate behind CloudFront and an Application Load Balancer (ALB). ALB stickiness is not configured and CloudFront does not set visitor cookies on eor.gokeystone.ai, so no AWSALB / AWSALBCORS cookies are present.

Cookie name: __session

Set by: Clerk

Purpose: Authenticated session JWT

Duration: Session; extended when you select "Remember me"

Cookie name: __client

Set by: Clerk

Purpose: Browser / client identification for session security

Duration: Persistent (managed by Clerk)

Cookie name: __client_uat

Set by: Clerk

Purpose: Last activity timestamp

Duration: Short-lived

Cookie name: keystone_cookie_consent

Set by: Keystone EOR

Purpose: Stores your cookie consent preferences (also persisted in browser localStorage)

Duration: 12 months

Analytics — Google Analytics 4 (GA4) via Google Tag Manager

GA4 is loaded through our Google Tag Manager container (ID: GTM-WSKZCRH4). The GA4 measurement ID is configured inside GTM and is not embedded in the application code.

Cookie name: _ga

Set by: Google Analytics

Purpose: Distinguishes unique users by assigning a randomly generated number as a client identifier

Duration: 2 years

Cookie name: _ga_*

Set by: Google Analytics 4

Purpose: Persists session state for the GA4 property (the * is replaced with our specific container ID)

Duration: 2 years

Performance — Datadog Browser RUM

We use Datadog Browser Real User Monitoring (RUM) to measure page load times, errors, and overall performance of the platform. Datadog RUM cookies are loaded only after you grant consent for the Performance category through our cookie banner or account settings.

Cookie name: _dd_s_v2

Set by: Datadog Browser RUM

Purpose: Stores the RUM session identifier, sampling decision, session expiration timestamp, and an anonymous user ID used to correlate sessions from the same browser across visits

Duration: 1 year (session itself expires after 4 hours of activity / 15 minutes of inactivity; the cookie persists longer to retain the anonymous identifier)

Cookie name: dd_cookie_test_{uuid} / dd_site_test_{uuid}

Set by: Datadog Browser RUM

Purpose: Ephemeral probe cookies used by the SDK on initialization to detect whether the browser accepts cookies and determine the correct domain scope. They are set, read, and immediately deleted within the same page load

Duration: Instant (never persist beyond the detection check)

All Datadog RUM cookies are first-party. No cross-site or third-party cookies are set by the Datadog RUM SDK.

Functional / Preferences

Name (storage type): keystone_cookie_consent (Cookie + localStorage)

Set by: Keystone EOR

Purpose: Consent preferences (mirrored from Necessary)

Duration: 12 months

Name (storage type): sidebar_state (Cookie)

Set by: Keystone EOR

Purpose: Sidebar expanded / collapsed state

Duration: 7 days

Name (storage type): theme (localStorage)

Set by: Keystone EOR

Purpose: Light / dark / system theme preference

Duration: Until cleared

There is no language cookie (the product is English-only). There is no onboarding_complete cookie — onboarding state is stored in the database and routed within the product.

Advertisement

We do not currently use advertisement cookies inside the product. As of the "Last updated" date of this Cookie Policy, the only analytics we deploy is Google Analytics 4. If we add in-product advertisement cookies in the future (such as LinkedIn Insight Tag for B2B remarketing or Google Ads conversion tracking), we will update this Cookie Policy and adjust our consent banner accordingly.

Uncategorized

Cookies in this category have not yet been classified. We review newly discovered cookies regularly and reassign them to the appropriate category.

5. Third-Party Cookies and Services

Some cookies are set by third-party services integrated into Keystone EOR:

Service: Clerk

Role: Authentication

Cookies on eor.gokeystone.ai: Yes (__session, __client, __client_uat)

Privacy Policy: clerk.com/privacy

Service: Google Analytics 4 (via GTM, container GTM-WSKZCRH4)

Role: Analytics

Cookies on eor.gokeystone.ai: Yes, after Analytics consent

Privacy Policy: policies.google.com/privacy

Service: Datadog Browser RUM

Role: Performance monitoring

Cookies on eor.gokeystone.ai: Yes, after Performance consent

Privacy Policy: datadoghq.com/legal/privacy

Service: Spott

Role: CRM + demo scheduling — stores form submissions (contact, demo, newsletter, pricing enquiries) and powers "Book a Demo"

Cookies on eor.gokeystone.ai: No on product pages; yes on spott.io if user follows "Book a Demo"

Privacy Policy: spott.io/cookie-policy

We do not control cookies set by third-party services. Please refer to their respective privacy policies.

a) Cookie banner

Use the "Cookie settings" link in the public footer to revisit your consent choices. Strictly necessary cookies cannot be disabled because they are required for authentication and core platform functionality.

b) Account settings

Logged-in users can also manage cookie preferences via the "Cookie settings" entry in the account menu.

c) Browser settings

Most browsers let you view, delete, and block cookies. Note: blocking strictly necessary cookies will prevent you from logging in.

7. Global Opt-In Default and US State Rights

Our cookie consent banner applies the same opt-in default for all visitors regardless of location: all cookies aside from "Necessary" are blocked until you grant consent through the banner. Under the hood, this is implemented using Google Consent Mode v2 in advanced mode, with all consent parameters defaulting to denied until you interact with the banner. This approach meets the strictest legal requirements (such as the GDPR for EEA visitors and the UK Privacy and Electronic Communications Regulations) and exceeds the minimum requirements for visitors in jurisdictions with more permissive defaults.

Visitors who are residents of California, Virginia, Colorado, Connecticut, or Utah have additional rights under their respective state privacy laws (CCPA/CPRA, VCDPA, CPA, CTDPA, UCPA), including the right to opt out of the sale or sharing of personal information for cross-context behavioural advertising. To exercise these rights, please refer to our Privacy Policy or contact our Data Protection Officer.

8. Special Considerations for Logged-in Users

Because Keystone EOR is a logged-in product platform, certain cookie practices differ from anonymous website visitors:

  • Your consent choices are stored on your browser and device (in the keystone_cookie_consent cookie and browser localStorage) and apply across sessions on that device until you change them or clear site data.
  • Strictly necessary cookies (Clerk authentication, consent storage) cannot be disabled — disabling them would prevent you from logging in or using the product securely.
  • Optional cookies (Analytics, Functional, Performance) load only after you grant the relevant category through our cookie banner or account menu.
  • If you delete your Keystone EOR account, personal data tied to your account is handled as described in our Privacy Policy. Browser-stored consent and preference data may remain until you clear site data in your browser.
  • Worker data (individuals employed via the EOR service) is processed strictly for service delivery and is governed by separate Data Processing Agreements (DPAs) between the customer and CGP Group.

9. Your Rights

You have certain rights regarding your personal data, including the right to access, correct, delete, and (where applicable) port your data. To learn more, see our Privacy Policy or contact our Data Protection Officer at the details below.

10. Updates to This Policy

We may update this Cookie Policy from time to time. Material changes will be communicated through an in-product notice or via email to logged-in users.

11. Contact Us

Questions about this Cookie Policy can be directed to our Data Protection Officer:

Email: dpo@cgpgroup.com