This policy lists cookies and similar storage used on WebFundament after the 19 August 2026 consent remediation. Analytics cookies are not set until you accept them.
1. Overview
This Cookie Policy applies to webfundament.com and clients.webfundament.com. Necessary cookies run without optional consent. Functional, analytics and marketing storage are off by default until you accept them.
2. Consent manager
Our CMP stores a non-identifying preference record (wf_consent) with category flags, policy version 2026-08-19, and a timestamp. It may be set on .webfundament.com so choices can be shared between the marketing site and Client Area. It is not used for authentication and must not contain personal data. WHMCS session cookies remain host-only on the Client Area host.
3. Inventory
| Name | Provider | Domain | Purpose | Category | Duration | Party | Created when |
|---|---|---|---|---|---|---|---|
wf_consent | WebFundament | .webfundament.com | Store CMP categories + version + timestamp | Necessary | 1 year | First-party | When you save cookie preferences |
theme (localStorage) | WebFundament | webfundament.com | Light/dark theme | Necessary | Until cleared | First-party | Theme toggle |
| PHP session (forms) | WebFundament | webfundament.com (host) | CSRF token for Contact/Solutions | Necessary | Session | First-party | Opening a form page |
| WHMCS session cookie | WHMCS | clients.webfundament.com (host-only) | Authenticated session / cart | Necessary | Session | First-party | Visiting Client Area / login / cart |
| Remember-me (if enabled in WHMCS) | WHMCS | clients.webfundament.com | Stay signed in | Necessary (account feature you use) | Per WHMCS | First-party | If you choose remember-me at login |
| Currency / cart helpers | WHMCS | Client Area | Cart and currency display | Necessary | Session / short-lived | First-party | Cart use |
_ga, _ga_* | Google Analytics | .webfundament.com | Measurement (G-J7M31K09N8) | Analytics | Up to 2 years (Google default) | Set by gtag | Only after Analytics consent |
| reCAPTCHA cookies | google.com | Bot protection on Contact/Solutions when keys are configured | Necessary (security) | Per Google | Third-party | When a protected form loads reCAPTCHA | |
| Google Identity cookies | google.com | Social login, only if that button is used | Necessary for that login method | Per Google | Third-party | When you use Google Sign-In | |
| Amevia widget storage | Amevia | getamevia.com / local | Chat UI; optional resume only with Functional consent | Necessary UI + optional Functional | Per Amevia | Third-party | Widget load; optional features after consent |
| Payment provider cookies | PayPal / maib / Blockonomics | Provider domains | Complete payment / fraud checks | Necessary (transaction) | Per provider | Third-party | During checkout payment step |
4. Categories
- Necessary — language/theme, security, session, consent storage, checkout. Basis: contract / legitimate interest in operating a secure service.
- Functional — optional chat resume / personalization. Basis: consent. Off by default.
- Analytics — Google Analytics. Basis: consent. Off by default. gtag.js is not downloaded until you accept.
- Marketing — reserved; off by default. Basis: consent if used.
5. Transfers
Google (Analytics, reCAPTCHA, Identity) and Amevia may process data in countries other than where you or we are located. Transfer tools for hosted customer data are described in the DPA and Subprocessors pages.
6. How to manage
Use Cookie preferences, the banner buttons (Accept all / Reject optional / Customize), or browser controls. Withdrawing Analytics stops future gtag loads and clears accessible Analytics cookies.
7. Updates
When this policy version changes, the CMP may ask again. Editorial dates above are fixed and do not change per request.