Back to website

Bankful® Cookie Policy

Version V.1.0RC · Effective date: November 2, 2026 · Last updated: November 2, 2026

This policy applies to you, however you got here. Bankful, eMerchantBroker.com and First American Merchant are one company. Its legal name is eMerchantBroker.com LLC. In this policy, “Bankful,” “eMerchantBroker,” “we,” “us” and “our” mean that company.

This policy explains how we use cookies and similar tools on these sites (the “Sites”):

  • bankful.com
  • support.bankful.com
  • emerchantbroker.com
  • firstamericanmerchant.com
  • paybybankful.com
  • our merchant application at atlasmanager.com

It should be read with our Privacy Policy at https://support.bankful.com/privacy-policy/.

2985 E. Hillcrest Dr. Suite #209
Thousand Oaks, CA 91362
Phone (888) 882.9494
www.bankful.com

1. What cookies are

Cookies are small text files that a website saves on your device. Similar tools include pixels, tags and local storage. We call all of these “cookies” in this policy.

Some cookies are set by us. Others are set by third parties whose tools we use, such as analytics and advertising providers.

2. How we ask for your choice

When you first visit a Site, a banner lets you accept all cookies, reject all cookies, or choose by category. Rejecting is as easy as accepting.

  • All regions: Advertising cookies and session recording stay off until you opt in, wherever you are.
  • EU and Quebec: Only strictly necessary cookies run until you say yes. All other categories stay off until you opt in.
  • UK: Only strictly necessary cookies run until you say yes. All other categories stay off until you opt in.
  • United States and other regions: Only strictly necessary cookies run until you say yes. All other categories stay off until you opt in.
  • Global Privacy Control (GPC): If your browser sends a GPC signal, we treat it as a request to opt out of advertising cookies and of the sale or sharing of your personal information.
  • Do Not Track: Our Sites do not respond to browser “Do Not Track” signals, because there is no common standard for them. We honor GPC instead.

3. The cookies we use

You can see each cookie we use, who sets it and how long it lasts in “Cookie Settings,” the icon on every page.

Strictly necessary

These keep the Sites working and secure. They cannot be turned off.

  • Google Tag Manager: loads and manages the other tools on the Sites. It only loads them after you consent where consent is required.
  • Cloudflare: protects the Sites from attacks and bots and helps them load reliably.
  • Session cookie (PHPSESSID): keeps your session active as you move between pages.
  • Google reCAPTCHA: protects our forms, including the online application, from spam and bots. Google receives device and browser data to do this.
  • Device fingerprint (online application): our own fraud-prevention cookie and device ID, built from your browser and device settings. It helps us spot fraud and protect accounts.
  • Consent cookie: remembers the choices you made in the cookie banner and, on our online application, that you have seen our privacy notice.

Analytics

These help us understand how visitors use the Sites so we can improve them. We link visits across our Sites and our online application (cross-domain tracking), following the choices you make in the cookie banner.

  • Google Analytics 4
  • May use: Optimizely (atlasmanager.com) and Formbricks (support.bankful.com).

Default: off until you opt in, in every region.

Session recording

These record how visitors move, click and scroll on a page so we can find problems in the design. Form fields are masked.

  • Microsoft Clarity

Default: off until you opt in, in every region.

Advertising

These measure our ads, show Bankful ads to people who have visited the Sites, and record which ad brought you to us. Under some US state laws this counts as “selling” or “sharing” personal information.

  • Google Ads
  • Meta (Facebook and Instagram)
  • Reddit
  • YouTube and SoundCloud: video and audio players on some pages. They set their own cookies, so they stay blocked until you accept advertising cookies.
  • Bankful lead attribution: our own cookies and records that note how you found us (such as an ad campaign or the web page that sent you) and link it to your application. Campaign details in the web address you arrive from (UTM parameters) are read into your application form and are not stored on your device. Anything we save on your device for attribution waits until you accept advertising cookies.
  • May use: LinkedIn, Microsoft Advertising, StackAdapt and ChatGPT Ads (OpenAI). These are not active today and will follow the same rules if added.

Default: off until you opt in, in every region.

Support chat

This lets you chat with our support team on the Sites.

  • Tidio

Default: loads when you open a page, so the chat window is ready. It saves a small amount of data on your device to keep your chat session working.

4. Sharing for advertising

When advertising cookies are on, the providers listed above may receive information such as the pages you visit, your device and browser details, and an online identifier. If you submit a form on our Sites, Google may also receive a hashed (scrambled) version of the email address you entered, which it uses to match your visit to our ads. They may use this information to measure and show ads. You can stop this by rejecting advertising cookies or turning on GPC.

5. Changing your mind

You can change your choices at any time through the “Cookie Settings” icon at the bottom of every page. You can also delete or block cookies in your browser settings. Blocking some cookies may stop parts of the Sites from working.

6. Third-party policies

Each provider listed above has its own privacy policy that explains how it uses information. You can find a link to each one in “Cookie Settings.”

7. Contact us

Questions about this Cookie Policy can be sent to [email protected].

8. Changes to this policy

We review this Cookie Policy at least once a year and when we add or remove a tool. The “Last updated” date at the top shows when it last changed.