Cookies & Storage
Cookie Policy
Last updated: 27 September 2026
This policy uses the broader term storage and access technologies in line with current ICO guidance. PECR can apply to cookies, local storage, pixels, scripts, tags, fingerprinting and other technologies that store information on, or access information from, a user's device. Non-exempt technologies are not intentionally enabled before the required choice or consent.
1. What cookies and similar technologies are
Cookies are small data files stored on a browser or device. Similar technologies, including local storage, pixels and tags, can also store information on or access information from a device. These technologies may support website functions, remember choices, measure usage or help assess marketing effectiveness.
2. Our consent categories
| Category | Purpose | Default |
|---|---|---|
| Essential | Website security, WordPress/WooCommerce sessions, login, cart, checkout, fraud prevention, payment and storage of your privacy choices. | Always active where required for the service requested. |
| Analytics | Helps us understand how visitors use the website, diagnose usability issues and improve performance. This may include Google Analytics, Hotjar or Microsoft Clarity when enabled. | Off until you consent. |
| Marketing & advertising | Measures campaigns, supports conversion attribution, audience creation or advertising. This may include Meta Pixel, LinkedIn Insight Tag and marketing tags deployed through Google Tag Manager when enabled. | Off until you consent. |
3. Essential technologies
| Technology / category | Purpose |
|---|---|
| WordPress session / login cookies | Authentication, account security and administration for logged-in users. |
woocommerce_cart_hash / woocommerce_items_in_cart | Allows WooCommerce to recognise changes to the shopping cart. |
wp_woocommerce_session_* | Associates a visitor with cart/session data during shopping. |
| Cloudflare Turnstile / bot-protection technologies | Used on selected login, password-reset, registration and enquiry forms where necessary to distinguish legitimate use from automated abuse. Turnstile can use browser/device, network and challenge-response signals and necessary storage or security technologies to provide the protection. |
| Security, payment and fraud-prevention technologies | Used where necessary to protect the service or complete a payment requested by you. Payment providers may use their own necessary technologies. |
| EaseThat AI Assistant anti-abuse control | The chatbot itself does not intentionally set a dedicated browser cookie or local-storage item. When a chat request is made, the server creates a short-lived pseudonymous rate-limit record derived from connection/browser information to protect the public endpoint from excessive automated use. The server-side record expires after approximately 10 minutes. |
| EaseThat public-form anti-abuse controls | Contact, quote and trade-account forms use server-side signed form values and short-lived pseudonymous rate-limit/duplicate records. These controls do not intentionally create a dedicated browser cookie or local-storage item; the form page refreshes its security values through a same-site request so cached pages remain usable. |
| Editorial REST/API publishing | Authorised external publishing tools can send draft Insights to WordPress through authenticated server-to-server HTTPS requests. This publishing route does not intentionally set or read a cookie, local-storage value or other storage/access technology on public visitors' devices. |
| Microsoft Bookings embedded scheduling | When you visit the Book a Consultation page, the site loads an embedded Microsoft Bookings scheduling interface from a Microsoft domain. Microsoft may use cookies or similar storage/access technologies needed to deliver, secure and maintain the requested booking session. These technologies are controlled by Microsoft and may be affected by your browser's third-party-cookie or tracking-prevention settings. |
easethat_consent_v1 (browser local storage) | Records your analytics and marketing preferences, consent version and choice time so the website can honour your decision on later visits. |
Cloudflare Turnstile is treated as an Essential security service when it is enabled on a protected form. It is therefore not switched on or off through the Analytics or Marketing consent categories. Disabling essential security technologies in the browser may prevent protected forms from being submitted successfully.
4. Microsoft Bookings and embedded scheduling
The Book a Consultation page embeds Microsoft Bookings in an iframe. The booking interface is supplied from a Microsoft domain and is loaded when you visit that booking page. Microsoft may store or access information on your device where this is necessary to provide, secure or maintain the scheduling service you have requested.
EaseThat treats storage/access that is strictly necessary to provide the requested appointment-booking service as Essential. We do not use the Microsoft Bookings embed for behavioural advertising. If Microsoft or EaseThat introduces optional analytics, advertising or other non-essential storage/access through the booking experience, we will review that technology and connect it to the appropriate consent mechanism before intentionally enabling it where consent is required.
Because the Bookings content is delivered by Microsoft, the exact names and durations of Microsoft-controlled cookies or similar technologies can change as Microsoft updates the service. Browser settings that block third-party cookies or cross-site storage may affect some Bookings functions. A direct link to the Microsoft-hosted booking page is provided as a fallback.
Personal information submitted through Bookings is described separately in our Privacy Policy.
5. AI Assistant and device storage
The EaseThat AI Assistant is an interactive service that runs only when you choose to open and use it. Its short conversation history is kept in JavaScript memory for the current page session and is not intentionally written by the chatbot to a dedicated cookie or browser local-storage item.
A server-side pseudonymous rate-limit transient is created when the assistant endpoint is used. This protects the service from abuse and is not used for advertising or analytics. Where the assistant sends a redacted message to OpenAI, that transfer is described in the Privacy Policy; it is a data-processing matter rather than a marketing cookie.
Likewise, EaseThat's external editorial/Insights publishing API is a server-to-server integration. WordPress Application Password authentication and REST publishing do not by themselves place storage/access technologies on a public visitor's device, so enabling that publishing workflow does not create a new Analytics or Marketing cookie category.
6. Optional analytics technologies
EaseThat uses Google Analytics 4 (GA4) and may also use Microsoft Clarity on eligible public pages only when the service has been configured by EaseThat and you have accepted the Analytics category. GA4 may process page views, referral source, approximate location derived from IP address, device/browser information, interactions and pseudonymous identifiers. Clarity may process page interactions, clicks, scrolling, device/browser information and masked session-replay data used to diagnose usability issues. EaseThat's GA4 integration removes query strings from page locations, disables Google Signals and advertising-personalisation signals, and excludes Team Portal, Customer/My Account, company-account, cart, checkout, password, quotation, invoice and protected PDF routes.
| Analytics technology | Purpose | Typical maximum duration |
|---|---|---|
_ga | Distinguishes pseudonymous visitors and sessions for GA4 reporting after Analytics consent. | Up to 2 years. |
_ga_<stream-id> | Maintains session state for the configured GA4 web stream after Analytics consent. | Up to 2 years. |
Microsoft Clarity, when configured, is loaded only after Analytics consent and receives an explicit consent signal. EaseThat may use consent-controlled analytics events for successful website enquiries and entry into the Book a Consultation journey. The embedded Microsoft Bookings service is cross-origin, so the website does not claim to detect a completed appointment unless a Microsoft-side confirmation integration is introduced. Google Tag Manager and Hotjar are not enabled by this theme.
7. Optional marketing and advertising technologies
If enabled and accepted by you, Meta Pixel, LinkedIn Insight Tag and similar technologies may measure advertising or campaign performance, record conversions, associate website activity with advertising identifiers and support audience or retargeting functions. These technologies are not treated as essential and will not be intentionally activated by the theme before the relevant consent.
8. Third parties and international processing
Optional technologies may be supplied by companies such as Google, Meta, LinkedIn, Hotjar and Microsoft. Those providers may process information under their own privacy terms and may process data outside the UK. Where required, EaseThat will use appropriate contractual or legal safeguards for restricted international transfers and will review supplier terms before enabling a service.
9. Your choices
When no preference has been stored, the website allows you to Accept all, Reject optional technologies, or Manage preferences by category. Rejecting optional technologies does not prevent access to ordinary website content or B2B shop functionality.
You can change or withdraw your choice at any time using the Cookie Preferences control in the website footer. You can also delete or restrict cookies through your browser, although blocking essential WordPress or WooCommerce technologies may prevent login, cart, checkout or payment functions from working correctly.
10. Cookie inventory and review
The exact cookie names, providers and durations can change as suppliers update their technology or as EaseThat changes configuration. Before activating a new analytics, advertising, CRM, embedded-media or marketing service, or materially changing the AI Assistant so that it stores information on a user device, we will review the actual technologies used, update this policy where appropriate and connect optional storage/access technologies to the consent mechanism where required.