Cookie Policy

This Cookie Policy explains how The Site Book, operated by REDCLAN VENTURES LTD (Company No. 17142372), uses cookies and similar technologies when you visit our website at thesitebook.co.uk.

1. What are cookies?

Cookies are small text files stored on your device when you visit a website. They help the site remember your preferences and understand how you use the service. Some cookies are essential for the site to work; others help us improve it.

2. How we ask for consent

When you first visit The Site Book, we show a cookie consent banner. You can choose Analytics, Advertising and Personalised advertising separately, accept all, or reject all. Each choice is remembered for up to 180 days, after which we ask you to renew it. Essential cookies remain active because the site cannot function without them.

You can change any choice at any time using the Cookie preferences link in the site footer. Declining Analytics stops the analytics providers and removes the analytics cookies we can access. Declining Advertising stops advertising tags, removes advertising cookies and limited acquisition data from browser storage, and prevents new consented server-side advertising matches. Declining Personalised advertising stops Google building a remarketing audience from your visit; it has no effect on Advertising, which only covers campaign measurement.

Google Consent Mode starts with analytics_storage, ad_storage, ad_user_data and ad_personalization denied. Analytics acceptance controlsanalytics_storage. Advertising acceptance controls the advertising measurement and user-data signals used for conversion tracking. ad_personalization is controlled separately by the Personalised advertising choice, and remains denied unless you accept it — this is what allows Google to build a remarketing audience from your visit. Microsoft UET and Meta Pixel are controlled by the Advertising choice only; neither currently has a separate personalised-advertising signal wired here, so Personalised advertising affects Google alone. Server-side Google Ads matching additionally requires current, versioned consent on the source record and is blocked by any verified address withdrawal.

Our former all-in-one consent cookies are retired, and each new purpose-specific choice supersedes the one before it. An old acceptance is never treated as permission for a new, more specific choice: we remove it and ask again — most recently on adding Personalised advertising as its own purpose, distinct from Advertising. A still-current old decline may be migrated to decline every category so that a refusal is not lost.

3. Cookies we use

Essential cookies

These cookies are required for the site to function and cannot be disabled.

Consent preference cookies

These first-party cookies remember and safely order the choices you make. They contain a choice and time, not advertising identifiers or contact details. We use them only to apply and enforce your preferences.

Analytics cookies

These cookies help us understand how visitors use the site. They are only set if you allow Analytics via the consent banner.

If you decline Analytics, we do not configure or send events to Google Analytics, and Google Analytics cookies are not set. Microsoft Clarity is not loaded, its heatmaps and session recordings are disabled, and PostHog analytics are disabled. If you separately allow Advertising, the shared Google tag may still load for Google Ads while analytics_storage remains denied.

Advertising cookies

If you arrive via a Google Ads or Microsoft Advertising campaign, conversion tracking measures whether the ad led to a lead, Business signup, checkout or verified paid purchase. Advertising storage and user-data matching are only active if you allow Advertising.

Microsoft cookies MR and MUID may support both Microsoft Clarity analytics and Microsoft Advertising. We remove the copies we can access if either relevant category is declined, so one purpose cannot silently preserve them for the other.

Server-side conversion matching (not a cookie)

With your consent, we may create privacy-minimised Google Ads / Google Data Manager records for a submitted Business walkthrough request, a submitted, qualified or won Site Control lead, and a verified paid purchase. A record may contain a Google click identifier (gclid, gbraid or wbraid) and a normalised email address transformed into a one-way SHA-256 hash before it is stored or sent. We do not send the raw email address to Google Data Manager.

These are server-side records, not browser cookies. We retain them for up to 90 days for attribution, deduplication and retry handling, or delete them sooner when a valid withdrawal or erasure request is actioned. A hash is still pseudonymous personal data: Google may match it to an account it already holds. If ad-user-data consent is not granted on the originating submission, our server-side matching does not attach click identifiers or a hashed email and does not upload that record to Google Data Manager.

Google Ads withdrawal suppression (not a cookie)

After you confirm a Google Ads matching withdrawal, we keep a separate suppression record so deleting an enquiry, lead or account cannot silently restore that matching. It contains only one or more domain-separated, keyed HMAC-SHA-256 digests of the normalised email address — never the raw email, advertising click identifiers, campaign parameters or enquiry content. We retain the suppression record, and the cryptographic key history needed to recognise it, for as long as needed to keep the withdrawal effective. Accepting Advertising again does not remove it. A later Google Ads regrant would require a separate, verified request; contact us through the Privacy Policy if you want us to review that choice.

The one-time withdrawal form below applies only to Google Ads matching. It does not by itself withdraw your request for us to contact you, erase first-party campaign or UTM attribution, or change Microsoft Advertising identifiers. You can manage Analytics and Advertising separately with Cookie preferences and exercise your other data-protection rights through our Privacy Policy.

Account-deletion tombstone (not a cookie)

After an account is deleted, we retain a separate privacy-minimised record so a delayed or replayed paid Stripe event cannot recreate it. The record contains the opaque user ID and a domain-separated, keyed HMAC-SHA-256 digest of the normalised email address, never the raw email. It is used only for account anti-resurrection and billing, fraud or legal audit, and expires after a maximum of 7 years.

4. Local storage

We also use browser local storage for a small number of functional preferences (e.g. consent-state mirrors and UI preferences). After you allow Advertising, we also use it for limited first-party acquisition attribution. This may include campaign and referral parameters, landing page, referrer, a pseudonymous visitor identifier and a Google or Microsoft advertising click identifier if one was present in the arrival URL. It lets us carry the source through a lead, signup or checkout journey and measure our own marketing.

We do not store this acquisition attribution in local storage before Advertising acceptance, and we remove these entries when you decline Advertising. It is not itself a Google Data Manager upload: using a click identifier for Google matching also requires ad-user-data consent. You can also remove local storage by clearing your browser data.

5. Managing cookies in your browser

You can delete or block cookies through your browser settings. Note that blocking essential cookies may prevent the site from functioning correctly.

Declining Analytics stops browser and consented server-side product analytics. Declining Advertising prevents new advertising tags, attribution capture and advertising matching, and clears relevant optional identifiers from that browser. If you are signed in as the billing owner, we also store each current purpose-specific choice, its disclosure version and its change time on your product account. Declining Advertising then permanently removes the matching keys from every unsent Google Ads record linked to your user and creates a server-side Google Ads suppression barrier for the verified address. Accepting Advertising again can re-enable advertising tags, but it does not clear that barrier or authorise new Google Data Manager matching for the address. A separate, verified Google Ads regrant request would be required.

Allowing Advertising permits browser-based Microsoft UET measurement. It does not authorise a server-side Microsoft Business-outcome upload. That separate offline-measurement feature is disabled and would require its own specific choice and disclosure before use.

A signed-out, one-off setup-service checkout has no product account to update before provisioning, so any consented completion measurement is limited to the choice captured for that checkout. If you previously submitted a Site Control enquiry or Business walkthrough request, use the form below to receive a one-time confirmation link. After confirmation, we revoke the consent stored with every matching enquiry or walkthrough request for that verified email address and make every unsent Google Ads matching record permanently unmatchable. Data already submitted to Google cannot be recalled.

• Chrome
• Firefox
• Safari
• Microsoft Edge

6. Changes to this policy

We may update this Cookie Policy from time to time. The “Last updated” date at the top of this page reflects the most recent revision.

7. Contact

Questions about our use of cookies? Contact us at [email protected].

For more detail on how we handle personal data, see our Privacy Policy.