Cookies and Similar Technologies Policy
Version 1.0, effective 12 October 2026
Which cookies and browser storage Arubis uses, why each one is needed, how long it lasts, who can read it, and how you can control it.
1. About this policy
This policy explains how Olympus Pay Proprietary Limited ("Olympus Pay", "we", "us") uses cookies and similar technologies in Arubis, the accounting software available at arubis.olympuspay.co, on the pages that customers of a business open from Arubis (such as shared invoices and quotes), and on the Arubis legal pages.
It forms part of, and should be read with, our Privacy Policy, which explains more generally how we collect and use personal data, the legal bases we rely on and the rights you have under the Data Protection Act, 2024 of Botswana and, where it applies to you, other data protection laws. Words that are defined in the Privacy Policy or the Terms of Service have the same meaning here.
We have written this policy to describe what Arubis actually does. Each cookie and storage item we use is listed in section 6 with its purpose and how long it is kept. If we add one, we update the list before it is used. If we ever introduce a cookie that is not strictly necessary to provide the service you asked for, we will ask for your consent first, as described in section 8.
2. What cookies and similar technologies are
A cookie is a small text file that a website asks your browser to store and to send back with later requests to the same site. Cookies let a site recognise that two requests come from the same browser, for example so that you stay signed in as you move from one page to another.
Similar technologies work in comparable ways. In this policy they include:
- local storage, which lets a site keep small pieces of information in your browser that are not sent to the site with each request;
- session storage, which works like local storage but is cleared when you close the browser tab;
- tokens held in memory by the page while it is open.
Cookies may be set by the site you are visiting ("first-party cookies") or by another organisation whose content or service the site uses ("third-party cookies"). They may last only until you close your browser ("session cookies") or for a set period ("persistent cookies").
Some of these technologies can be used to identify a device or a person, in which case the information they hold is personal data and is protected under the Data Protection Act, 2024 and our Privacy Policy.
3. Our approach
Arubis holds the financial records of businesses. We therefore keep the use of cookies and browser storage to what the service needs to work securely and as you expect. In particular:
- we do not use advertising cookies, and we do not allow advertising networks to place cookies through Arubis;
- we do not use third-party analytics or session-recording tools inside Arubis;
- we do not use cookies to build profiles of you for marketing, or to track you across other websites;
- we do not sell information collected through cookies, and we do not share it with others for their own purposes;
- the financial content of your books (transactions, invoices, balances, documents) is never stored in cookies or in browser storage; it stays in our database and is fetched over an encrypted connection when you need it.
Because every item we use is strictly necessary to provide the service you requested, or is a preference you choose to set, Arubis does not show a consent banner for cookies. Section 8 explains what will change if that ever stops being true.
4. Categories we use
We group the technologies we use into the following categories.
Strictly necessary. These are needed to provide a service you have asked for and cannot be switched off in Arubis without the service failing. They keep you signed in, protect your session and your account, remember which set of books you are working in, and carry out actions you start, such as following a referral link. The Data Protection Act, 2024 permits processing that is necessary for the performance of a contract with you or for our legitimate interests in keeping the service secure, and these items rely on those grounds.
Preferences. These remember choices you make in the interface, such as whether the side navigation is open, or that you have already seen a setup guide, so you are not asked again. They are kept only in your browser and are not sent to us.
Security. Some strictly necessary items also protect you, for example by binding your sign-in to your browser so that a stolen link cannot be used on another device, and by helping us refuse requests that come from other websites.
We do not use performance, analytics, targeting or advertising cookies.
5. Cookies used across Olympus services
Arubis, Olympus Online Banking and Olympus Merchant Services share one sign-in system. When you sign in on any of them, the sign-in cookies are set for the domain olympuspay.co so that you can move between the Olympus services you use without signing in again. This means the sign-in cookies described in section 6 can be read by Olympus services on subdomains of olympuspay.co. They are not readable by any other organisation.
Having a login that works across Olympus services does not mean you hold a bank or merchant account. Creating an Arubis login does not open an Olympus bank account or merchant account; those are opened separately, by invitation, and under their own terms.
On preview and development addresses that are not part of olympuspay.co, the same cookies are set for that address only.
6. The cookies and storage items in Arubis
For each item below we give its name, its type, who sets it, what it is for and how long it lasts.
Sign-in session. Name: sb-[project]-auth-token, which may be split into numbered parts (for example .0 and .1) when it is long. Type: first-party cookie, set for olympuspay.co. Category: strictly necessary and security. Purpose: holds the encrypted session that proves you are signed in, so that each page and each request you make is carried out as you and only with your permissions. It is refreshed automatically while you use Arubis. Duration: until you sign out, or until the session expires and cannot be refreshed.
Sign-in code exchange. Name: sb-[project]-auth-token-code-verifier. Type: first-party cookie. Category: strictly necessary and security. Purpose: a one-time value used when you sign in with an emailed link or code, so that the link only completes sign-in in the browser that asked for it. Duration: removed once sign-in completes, and in any case short-lived.
Current set of books. Name: arubis_org. Type: first-party cookie, set for the Arubis address. Category: strictly necessary. Purpose: remembers which organisation's books you have open when you have access to more than one, so that pages show the right books. It contains only an internal identifier. Duration: up to one year, or until you switch to other books or sign out.
Referral link. Name: arubis_ref. Type: first-party cookie. Category: strictly necessary for the offer you followed. Purpose: when you open a referral link someone shared with you, it remembers the referral code so that, if you create your books, you receive the longer free trial and the person who referred you is credited, as described in our Subscription, Billing and Payment Terms. It contains only the code. Duration: 30 days, and it is deleted as soon as it has been used.
Side navigation. Name: op-sidebar. Type: local storage. Category: preference. Purpose: remembers whether you prefer the side navigation open or collapsed. Duration: until you clear your browser storage.
Setup guide. Name: arubis-setup-[books identifier]. Type: local storage. Category: preference. Purpose: remembers that the setup guide for a set of books has been shown, so that it does not open again every time. Duration: until you clear your browser storage.
Entrance animation. Name: arubis-entered. Type: session storage. Category: preference. Purpose: plays the opening animation of the navigation once per browser tab rather than on every page. Duration: until you close the tab.
Session tokens in the page. The signed-in page also keeps a copy of your session in memory, and the sign-in library may keep it in browser storage, so that the page can make secure requests to our database on your behalf. Category: strictly necessary and security. Duration: while the page is open, or until you sign out.
7. Third parties
Arubis itself does not load content from third parties that set cookies on arubis.olympuspay.co. Some actions take you to a service run by another organisation, which may set its own cookies on its own website under its own policy:
- Payments for Arubis subscriptions are taken on a checkout page and in a billing portal provided by Stripe, Inc. and its affiliates. When you choose a paid plan or manage billing, your browser leaves Arubis for a Stripe address. Stripe uses cookies there to process the payment securely and to prevent fraud. Arubis never sees or stores card numbers. Stripe's own privacy and cookie notices apply to those pages.
- If you use a share button on the referral page, such as WhatsApp, LinkedIn or X, your browser opens that service. Any cookies it uses are set by that service on its own website.
- Links to other Olympus services, such as Olympus Online Banking, Olympus Merchant Services or the Olympus website, take you to pages governed by their own notices.
Our hosting and infrastructure providers process technical information, such as IP addresses, in order to deliver pages and protect the service from attack. They act on our instructions under data processing terms, and they do not set advertising or analytics cookies on Arubis.
8. Consent and changes to the categories we use
Every item listed in section 6 is either strictly necessary to provide a service you have asked for or a preference held only in your browser. Under the Data Protection Act, 2024, and under the comparable rules that apply in other countries where Arubis may be used, consent is not required for these.
If we decide to use a cookie or similar technology that is not strictly necessary, for example to measure how features are used, we will:
- update this policy before it is introduced, describing the item, its purpose, its provider and how long it lasts;
- ask for your consent in Arubis before the item is placed, with a clear choice to refuse that is as easy as the choice to accept;
- not place the item, and not reduce the service you receive, if you refuse;
- let you change your choice at any time from the same place.
We keep a record of consent choices where consent is required, so that we can show what you agreed to and when.
9. Managing cookies in your browser
Most browsers let you see the cookies and storage a site has set, delete them, and block cookies for some or all sites. The help pages of your browser explain how. You can also use private or incognito windows, which clear cookies and storage when the window closes.
If you block or delete the strictly necessary cookies described in section 6:
- you will be signed out, and you will not be able to sign in to Arubis until cookies for olympuspay.co are allowed again;
- Arubis may open a different set of books from the one you were last using;
- if you were following a referral link, the referral may not be recorded, and you may receive the standard trial instead of the longer one.
Clearing local or session storage only resets your interface preferences, such as the side navigation and the setup guide.
Because the sign-in cookies are shared across Olympus services, deleting them signs you out of Arubis, Olympus Online Banking and Olympus Merchant Services in that browser.
10. Pages opened by your customers and suppliers
When a business that uses Arubis sends an invoice, quote or statement through Arubis, the recipient may open it on a page at arubis.olympuspay.co without signing in. Those pages:
- do not set sign-in cookies for the recipient and do not require an Olympus login;
- may record that the document was viewed, and when, so that the sender can see it has been opened. This is recorded in our database against the document, not in a cookie, and it uses the private link in the message rather than any tracking technology;
- do not use advertising or analytics cookies.
If the recipient chooses to pay through a payment service linked from the page, that service's own policies apply on its pages.
11. Security of information in cookies
We protect the information held in cookies and browser storage in the following ways:
- every page and request in Arubis is served only over encrypted connections (HTTPS), and cookies that matter for security are marked so that browsers send them only over encrypted connections;
- sign-in cookies are signed and time-limited, and are refreshed and rotated while you use the service;
- requests that change data and come from other websites are refused, so that a cookie in your browser cannot be used by another site to act in Arubis on your behalf;
- cookies and storage hold identifiers and preferences only. They do not hold passwords, card numbers, or the contents of your books.
No method of storage on a device is completely secure. Anyone with access to your unlocked device and browser may be able to use your signed-in session. Sign out on shared devices, lock your device when you leave it, and use the security settings described in our Privacy Policy and the Terms of Service.
12. Where cookie information is processed and how long we keep it
Cookies and browser storage stay on your device for the periods listed in section 6. When your browser sends a cookie to us, the information in it is used only to answer that request: to confirm who you are, which books you have open, or which referral you followed.
Some of that information is also recorded on our side, because the service needs it:
- your sign-ins, and the device and network details of each sign-in, are kept in the security records of your login so that you and we can review access and investigate misuse. They are kept for as long as your login exists and for the period afterwards described in our Account Closure and Data Erasure Policy;
- a referral that you complete is recorded against the referral, so that the offer and the credit can be applied and checked. It is kept for as long as the books it relates to are kept;
- requests to our servers are logged by our infrastructure providers for security and reliability, generally for no longer than 30 days, unless a log is needed to investigate an incident.
Our database and hosting providers may process this information outside Botswana. Where they do, we rely on the safeguards described in the Privacy Policy and the Data Processing Addendum, including contractual commitments that give the information a level of protection comparable to that required by the Data Protection Act, 2024.
Preference items held only in local or session storage never reach our servers, so we do not keep any copy of them.
13. Children
Arubis is a business service intended for people aged 18 and over who act for a business or for an accounting practice. We do not knowingly set cookies for children or use cookies to collect information about children.
14. Your rights
Where information collected through cookies is personal data, you have the rights described in our Privacy Policy, including the rights to be informed, to access the personal data we hold about you, to have inaccurate data corrected, to object to processing, to have data erased in the circumstances the law allows, and to complain to the Information and Data Protection Commission of Botswana.
You can exercise these rights from Settings, Data, privacy and closure in Arubis, or by writing to privacy@olympuspay.co. We respond within the time the law requires.
15. Changes to this policy and contact
We review this policy whenever we change the cookies or storage that Arubis uses, and at least once a year. The version and effective date at the top of the page show when it last changed. Where a change requires your consent, we ask for it as described in section 8 before the change takes effect.
If you have questions about this policy or about how Arubis uses cookies, contact us at privacy@olympuspay.co. For other questions about Arubis, contact support@olympuspay.co.
Olympus Pay Proprietary Limited, Gaborone, Botswana.