Cookie Policy

Last reviewed: [PLACEHOLDER: date] — this section is factually accurate as of the current build; re-check it after any change to what the site loads or stores.

The short version

Right now we use one cookie, and it's strictly necessary — it isn't used for advertising, analytics, or tracking you across sites, so under UK PECR rules it doesn't require your consent on its own. We plan to add Google Analytics and Google Ads measurement (see below) — when that happens, this page and the cookie banner will be updated, and those cookies will only be set once you've given consent via the banner.

Cookies we set

• Session/access cookie (name: sludge_ops) — set only when someone signs in to the ops or provider area. httpOnly, holds no personal data itself, expires after 30 days or on sign-out. Strictly necessary to keep you signed in; there is no way to switch this off other than not signing in.

We do not set any cookie on the public booking pages you use to get a quote.

Other local storage

While you're booking, we save your in-progress answers (tank type, postcode, quote) in your browser's own session storage — not a cookie, not sent to us, cleared when you close the tab or finish booking. This is so an accidental refresh doesn't lose your place.

Third parties who may set their own cookies or receive data

Some steps of the site hand off to other services, who set their own cookies under their own policies:

• Stripe — handles card authorisation and payment. When you're taken to Stripe's own checkout page, Stripe sets its own cookies for fraud prevention and payment processing. See Stripe's privacy policy.
• OpenStreetMap — the map on the booking page loads map tiles directly from OpenStreetMap's servers, which see your IP address like any web request.

The following services receive limited data (typically just a postcode or coordinates) to do their job, but don't set cookies in your browser:

• postcodes.io — turns your postcode into a map location.
• OS Places API / getAddress.io — looks up the list of addresses at your postcode (whichever is configured).
• what3words — turns a map pin into a three-word address, when configured.
• Resend — sends you booking-related emails on our behalf.

Planned: analytics and advertising (not yet active)

[PLACEHOLDER — genuinely not built yet, described here so the policy is ready when it is: we intend to add Google Analytics (to understand site usage) and Google Ads conversion tracking (to measure whether ads led to a booking). Both set cookies that can be used to recognise you across visits and, for Google Ads, across other sites. When added:]

• [PLACEHOLDER] Neither will load until you actively choose "Accept all" on the cookie banner — choosing "Necessary only" keeps them off.
• [PLACEHOLDER] You'll be able to change your choice at any time from a link in this page's footer.
• [PLACEHOLDER] Name, purpose, and expiry of each specific cookie Google sets (e.g. _ga, _gcl_au) should be listed here once wired in — Google publishes the current list.

The banner and the consent gate it controls already exist in the code (see components/CookieNotice.tsx,lib/consent.ts) — only the actual Google tags are missing, pending a GA4 property / Google Ads account and their measurement IDs.

Managing cookies

You can block or delete cookies in your browser settings at any time. Since our only cookie is needed to keep you signed in, blocking it just means you'll be asked to sign in again — it won't affect the public booking flow at all.

Questions

[PLACEHOLDER: contact email for privacy/cookie questions, e.g. privacy@sludge.co]