Cookies and external services

Preview review draft. Version cookies-review-draft-v1. Updated 23 October 2026. Business details and legal review remain outstanding; this page is not a guarantee of compliance.

Current workspace inventory

The PHP session cookie maintains authenticated access and security. It is HttpOnly, SameSite=Lax and Secure on HTTPS staging/production. The exact cookie name and lifetime must be confirmed against the deployed configuration. A private staging Basic-auth prompt is separate from customer login.

External resources

The workspace loads pinned Leaflet files from unpkg and OpenStreetMap tiles when displaying a map. These requests disclose ordinary request data such as IP address to those providers. Stripe-hosted checkout/onboarding has its own provider notices. Audit the final deployed site and provider behavior before launch; this page is not a claim that the wider marketing website has no other cookies.

Optional storage and marketing

No analytics or marketing consent is bundled into required account terms. Non-essential cookies or similar storage must remain disabled unless an applicable exception or separate valid consent has been established. If added, offer equally accessible accept/reject choices and withdrawal controls. Essential security storage is explained separately.

Official references

GOV.UK distance selling · CMA cancellation guidance · ICO cookies guidance