Cookie Policy

Effective date: 8 August 2026

This Cookie Policy explains the cookies and similar technologies used by Ads.Mahhala, the advertising network operated by Mahhala Inc. It supplements our Privacy Policy.

There are two very different surfaces to talk about, and it matters which one you are on:

1. This website — ads.mahha.la, where advertisers and publishers sign in and manage campaigns. It sets a small number of cookies, all of them necessary to keep you signed in and to keep the forms safe.
2. The ads we deliver — the creatives shown on publisher websites across the network. These set no cookies at all. Not on our domain, not on the publisher's, not anywhere.

If you arrived here because you saw an ad somewhere and wanted to know what it stored on your device, the answer is in section three, and the short version is: nothing.

What cookies are

A cookie is a small text file a website asks your browser to store, which the browser then sends back on later requests. Some are essential — without them a site cannot keep you signed in or safely accept a form. Others remember a preference or track you between sites. Related technologies such as your browser's local storage work similarly, so we list those here too.

Cookies this website sets

These apply when you are signed in to the advertiser or publisher dashboard at ads.mahha.la.

Strictly necessary

These cannot be switched off. The dashboard does not function without them.

You can delete the last two at any time from Settings → Security, which revokes them on our side as well as in your browser. Signing out clears all of them.

Local storage (not cookies)

These are stored by your browser and are never transmitted to us.

Third parties on this website

• Google reCAPTCHA runs on the sign-in and registration forms, where enabled, to tell people apart from bots. Google may set cookies for that purpose, governed by the Google Privacy Policy.
• Stripe handles payments. Paying an invoice sends you to a checkout page hosted by Stripe on Stripe's own domain, where Stripe's cookies and privacy policy apply. Card details never reach our servers.

We run no advertising tags, no analytics tags, and no social trackers on this website. Our own reporting is generated from our own server-side records.

Advertising without advertising cookies

This is an ad network, so it is worth being explicit about the part people actually worry about.

We do not set cookies on the websites where our ads appear. Ads reach a page one of two ways, and neither one writes to your browser's storage:

• Direct server-to-server, where the publisher's own server asks our delivery API which ad to show and renders it into the page itself. Your browser never talks to us at all.
• Our JavaScript tag, where a small script on the publisher's page requests an ad and displays it. The script sets no cookie, reads no cookie, and creates no persistent identifier in local storage.

There is no Ads.Mahhala advertising cookie, no cross-site profile, and no ability on our part to recognise you as the same person on two unrelated websites and build up a history of what you like.

What we do record. When an ad is shown, clicked, or leads to a conversion, our servers log the event: which ad and which placement, the time, your IP address, your browser's user-agent string, and the country we derive from the IP address. Advertisers see this only as counts and totals — impressions, clicks, spend — never as a list of individuals.

How conversions are matched. If an advertiser installs our conversion pixel on their own site, we match a reported conversion back to an earlier click by comparing the IP address and user-agent, within an attribution window that defaults to 28 days. This is how measurement works without a cookie. It is genuinely less precise than cookie tracking, and we accept that trade: it means we are not carrying a persistent identifier for you between sites.

To be straight about it: an IP address is still personal data under laws such as the GDPR, even though it is not a cookie. How we handle that — the legal basis, how long we keep it, and how to object — is covered in the Privacy Policy, which is the right place for it. The point of this section is narrower: no consent-gated storage is placed on your device by our advertising.

Why you are not seeing a cookie banner

Under the EU ePrivacy Directive (and the UK PECR), consent is required before storing or reading information on a user's device — except where that storage is strictly necessary to provide the service the user asked for. Every cookie listed above is in that exempt category: session, CSRF, opt-in sign-in persistence, and opt-in two-factor device trust. Two of the four are set only when you actively choose them.

We set no advertising, profiling, or third-party analytics cookies. So there is nothing here for a consent banner to ask you about, and a banner that only ever says "we use necessary cookies" trains people to click through banners that do matter.

If that changes, this changes. The moment we introduce a non-essential cookie — a third-party analytics tag, a retargeting pixel, anything that profiles — a consent mechanism ships with it, and this section is rewritten. That is a commitment, not an oversight.

Managing cookies

Every major browser lets you view, block and delete cookies in its settings, usually per site. You can also use private/incognito windows, which discard cookies when closed.

Blocking the strictly necessary cookies listed above will stop you signing in to the dashboard — the site will not work. Clearing local storage will reset your theme preference and nothing else.

Because our ads set no cookies, there is nothing to opt out of on the delivery side. If you want to limit what any advertising system can infer from your connection, a VPN or a browser that masks your IP address is the control that actually applies here.

Changes

We will update this page whenever the cookies we use change, and revise the effective date above.

Contact

Questions about this policy: support@ads.mahha.la