Cookie Policy
Last updated: 17 September 2026.
This policy explains how Today Merch uses cookies, local browser storage, pixels and similar technologies (together, “trackers”) when you visit the Site, prepare a quote request or use our services.
It supplements our privacy policy, which provides further information about the processing of your personal data, Shopify Enhanced Services and how to exercise your rights.
Trackers that are strictly necessary for operation, security or a service you request are active without consent. Preference, audience-measurement and marketing trackers are activated only in accordance with your choice where consent is required.
1. What are cookies and other trackers?
A cookie is a small file stored on or read from your device when you use an online service. Local storage, pixels, tags and certain technical identifiers may serve a similar purpose.
These technologies may, for example, maintain a session, remember a basket or quote, store a preference, protect a form, measure use of the Site or measure the effectiveness of a campaign.
2. Who uses trackers?
The Site is operated by TCES, a French simplified joint-stock company (SAS) with share capital of €2,000, registered with the Paris Trade and Companies Register under number 924 865 272, whose registered office is at 18 rue des Panoyaux, 75020 Paris, and which trades as Today Merch.
Some trackers are placed on behalf of Today Merch. Others are provided by suppliers required to operate the Site or by the external services described below.
3. Categories we use
- Necessary
- These support navigation, security, the basket, accounts, payment, quote requests, abuse prevention and the recording of your privacy choices. They are also used when a feature is activated at your request, such as sending a file or opening the chat.
- Preferences
- These remember optional choices, such as a collection layout, recently viewed products, comparison choices or the state of certain interface elements.
- Audience measurement
- These help us understand how the Site is used, where traffic comes from and how user journeys perform.
- Marketing
- These measure campaigns, attribute visits or conversions and help tailor our communications.
4. Record of trackers used
The record below reflects the services and behaviours verified on the Site on the date of this update. Not every identifier in a family is placed on every visit: this depends on the page, the feature used, your location and your choices.
| Service and identifiers | Purpose | Indicative duration | Basis |
|---|---|---|---|
Shopify and Shop — including _shopify_essential, _shop_app_essential, localization, cart, cart_currency, cart_sig, cart_ts, checkout*, secure_customer_sig and associated technical identifiers |
Store operation, localisation, security, basket, customer account, payment, Shop Pay and fraud prevention. | From the session duration to 2 years depending on the identifier; basket identifiers generally last for up to 2 weeks. | Necessary. |
Shopify Customer Privacy and Today Merch fallback — Shopify consent identifiers and todaymerch_local_tracking_consent_v1 |
Recording and applying your choices. Today Merch local storage is used only as a fallback if the Shopify API is unavailable; it does not replace or directly modify Shopify cookies. | According to the identifier managed by Shopify; no more than 180 days for Today Merch fallback storage. | Necessary to remember the choice. |
Today Merch — todaymerch:quote:progressive-v10:* |
Local storage of progress and information entered while preparing a quote request, to avoid losing it during the journey. | Until submission, reset of the quote or deletion of browser storage. | Necessary for continuity of the requested quote service. |
Today Merch — hypertheme:recently-viewed, hypertheme:collection-layout, hypertheme:compare-products, hypertheme:compare-is-active, and, if the relevant components are enabled, hypertheme:popup and spotlight:teaser* |
Remembering recently viewed products, a display mode, a comparison and certain optional interface states. | From the session duration to the period set for the feature, or until deletion. This data is deleted from the browser when preferences are declined or withdrawn. | Preferences. |
Shopify analytics and marketing — including _shopify_s, _shopify_y, _shopify_analytics, _shopify_marketing and shopify_client_id |
Traffic and performance measurement, attribution and improvement of journeys. | From the session duration to the period set by Shopify for the relevant identifier. | Audience measurement and/or marketing according to your choice. |
Google Analytics, Google Ads and Google Merchant Center — _ga, _ga_*, observed tags G-QMNSH7Q92H, GT-TBVN69R8, MC-2R0RP155MS and associated events |
Audience measurement, campaign performance, advertising attribution and conversion measurement. Consent Mode v2 starts with optional signals denied and is then updated in line with your “Audience measurement” and “Marketing” choices. | Up to 2 years for certain Google Analytics cookies; variable for other data depending on the service and configuration. | Audience measurement and marketing. |
OpenAI Ads — measurement pixels, oppref click identifier, todaymerch_openai_ads_attribution_v1 local storage and todaymerch_openai_ads_conversions_v1 session storage |
Measurement of visits (page_viewed) and confirmed quote requests (lead_created), and attribution of OpenAI campaigns. The data explicitly sent is limited to the event type and technical measurement identifiers and, where available, the click identifier. The request also involves necessary network metadata. This integration does not send names, email addresses, phone numbers or form contents. |
No more than 30 days for the attribution identifier stored in the browser; the browser-tab session for conversion deduplication. OpenAI retains the data it receives according to its policy. | Marketing, only after your consent. Declining or withdrawing consent stops transmissions and deletes this local storage. |
| Klaviyo — web and server pixels, events and associated identifiers | Interaction measurement, attribution and personalisation of marketing communications. | Variable depending on the type of data and Klaviyo configuration. | Audience measurement and marketing. |
Intercom Messenger — intercom-id-*, intercom-session-*, intercom-device-id-* and intercom.intercom-state-* local storage |
Chat, support, continuity and security of conversations. Intercom loads after preference consent, or when you explicitly click “Open chat”. In the latter case, loading is part of the service you request for the browser-tab session and does not alter your other choices. | About 9 months for intercom-id-*, 1 week for intercom-session-*, up to 270 days for intercom-device-id-*, and a variable period for local state, according to Intercom. |
Preferences, or a service requested by an explicit click. Withdrawing preferences stops Messenger and deletes Intercom data accessible to the Site. |
| Uploadcare — upload component, files and technical telemetry | Selecting, securing and sending files attached to a quote request. Uploadcare code loads only when the upload module is opened; only “local file” and “camera” sources are offered. Uploadcare may process the file, IP address, browser, device and technical logs required for the service. | For the time needed to upload, then according to the applicable retention period for files and logs at Uploadcare. | Service activated at your request. Camera access remains subject to permission in your browser. |
hCaptcha, Cloudflare Turnstile and Shopify protections — anti-abuse signals and any technical identifiers, including __cf_bm where used |
Bot detection, spam prevention and protection of contact, quote and booking forms. hCaptcha may be injected by Shopify on its forms; Turnstile supplements certain server-side checks. | Session or short technical duration, followed by security-log retention according to the provider. | Necessary for security and the requested service. |
Shopify may change its technical identifiers. Shopify’s cookie policy provides its current record. Any future activation of a new pixel, provider or purpose must be accompanied by an update to the consent mechanism and this policy.
5. Managing your choices
Where consent is required, the banner lets you accept all optional categories, decline all of them or select them separately. Declining does not prevent access to the Site or use of its essential features.
Your choices are recorded through Shopify’s Customer Privacy API. Today Merch does not read or directly modify Shopify consent cookies and does not automatically replace a choice already recorded. You can change or withdraw your consent at any time using the “Manage my cookies” control available on the Site or the button below.
Withdrawal does not affect processing performed before it. You can also delete data through your browser settings. Blocking necessary trackers may prevent the basket, account, payment, quote retention, form security or a feature you expressly request from working correctly.
6. Shopify and Enhanced Services
The Site uses Shopify to host the store and related services. Shopify Network Intelligence is enabled. In this context, Shopify may use information about interactions with the Site and with other Shopify merchants to provide Enhanced Services, including personalisation, measurement, fraud prevention and service improvement, depending on the applicable settings and your choices.
Further information about this processing, transfers and how to exercise your rights is available in our privacy policy, Shopify’s Consumer Privacy Policy and the Shopify Privacy Portal.
7. Providers
| Provider | Role | Information |
|---|---|---|
| Shopify | Store, security, basket, account, payment, consent, measurement and Enhanced Services. | Shopify privacy |
| Google Analytics, Google Ads, Google Merchant Center and associated measurement. | Google privacy | |
| OpenAI | Measurement of visits and confirmed quote requests, and advertising attribution according to your marketing choice. | OpenAI privacy |
| Klaviyo | Measurement and marketing communications according to your choices. | Klaviyo privacy |
| Intercom | Customer messaging and support. | Intercom Product Privacy Notice |
| Uploadcare | File uploading at your request. | Uploadcare privacy |
| Intuition Machines (hCaptcha) | Anti-abuse protection for Shopify forms. | hCaptcha privacy |
| Cloudflare | Turnstile and anti-bot security signals. | Cloudflare privacy |
Some providers may process data outside the European Economic Area. Where Today Merch is responsible for a transfer, it is protected using mechanisms provided by applicable law, including an adequacy decision or appropriate contractual clauses. Provider policies describe their own transfer mechanisms.
8. Duration and review
Duration depends on the tracker’s function. Session identifiers generally disappear when the browser closes; persistent identifiers remain until they expire, are replaced or are deleted. Today Merch limits trackers under its control to the period needed for their purpose.
Your choice is not requested again on every page. It may be requested again following a material change to the purposes, providers, mechanism or applicable requirements.
9. Contact and updates
For questions about trackers or associated personal data, you can write to contact@todaymerch.com or to TCES — Today Merch, 18 rue des Panoyaux, 75020 Paris, France.
This policy may be updated to reflect a change to the Site, the services used or applicable requirements. The date shown at the top identifies the current version.
Optional project activity tracking
With your separate consent, Today Merch tracks website and logo searches, logos applied and products viewed or customised. On personalised catalogue links: pages visited, visit times, estimated active time and clicks on the catalogue, products, variants, Studio and quotes. Time pauses when the tab is hidden or after inactivity. This pseudonymous activity, associated with the company’s link, helps prepare your proposal; a forwarded link does not prove the visitor’s identity. Activity is kept for 90 days; consent for 180 days. Declining does not limit the catalogue, logos or quotes. Withdrawal in “Manage cookies” stops collection and requests deletion. If the network fails, deletion is retried for up to 24 hours for searches and 90 days for personalised links, without resuming tracking. Quote requests and commercial documents follow our privacy policy.
Browser storage: todaymerch_commercial_consent_v1 keeps your choice for 180 days. With consent: todaymerch_commercial_visitor_v1 keeps an identifier and deletion key for 90 days; todaymerch_commercial_session_v1 groups actions less than 30 minutes apart. After withdrawal, todaymerch_commercial_revocations_v1:* retries deletion for 24 hours. Without tracking consent, tm-client-selection-access-v1 keeps personalisation for the browser session. With consent only: tm-client-shop-visits-v1 keeps measured visit IDs for 90 days and tm-client-shop-visit-v1:* groups actions less than 30 minutes apart. After withdrawal, tm-client-shop-withdrawals-v1 keeps pending deletion requests for up to 90 days. Withdrawal records contain no browsing history and never resume tracking.
To exercise your rights of access, correction or deletion, contact Today Merch at contact@todaymerch.com.