Last updated: 20 October 2026
1. What this notice covers
This notice describes the website's current cookies, browser storage and security services. Our Privacy Notice explains related handling of enquiry and contact information. This technical description does not replace the remaining business and legal review.
2. Necessary functions
Customer sessions, administrator sessions, Google sign-in state and one-time email verification use first-party, HttpOnly cookies. Browsing products and references does not require registration. Filling in or submitting a website enquiry requires a verified customer account. Administrator access remains restricted to authorised staff. We also remember privacy choices on this device.
The enquiry form uses Cloudflare Turnstile to help prevent abuse. Cloudflare processes technical and security signals for this check. Turnstile is separate from optional website analytics. See Cloudflare's Turnstile privacy information.
3. Optional analytics
Analytics are off until you choose Allow Analytics or enable Analytics in Cookie Settings. If allowed, we record these actions for signed-in customer accounts: page views, opening the enquiry page, successful enquiry saves, WhatsApp link clicks and direct-chat link clicks. Administrator activity and signed-out visits are excluded. Each account counts once per action within the selected reporting dates and source, including across devices. We may associate these events with the public page, product or reference, button position and limited campaign tags. Clicks are not proof that a message was sent or received.
We do not include enquiry comments, contact details, enquiry reference numbers or full WhatsApp message links in these events. We attach a server-generated pseudonymous account key to deduplicate actions across sessions and devices. The analytics event does not contain your email, phone number or name. These first-party events are separate from the external services described below. WhatsApp messages are not imported automatically. Events are stored in our Cloudflare-hosted website database and scheduled for deletion after 90 days. Campaign tags must not contain personal information.
If you allow Analytics, we also load Google Analytics 4, Microsoft Clarity and Shipsolo-hosted Plausible on public marketing pages. These services can measure signed-out visitors as well as signed-in customers. Google Analytics measures traffic and public contact-button actions. Clarity creates heatmaps and session recordings to help us understand page interactions; it masks sensitive input content. Shipsolo/Plausible measures page views, sources and engagement without setting analytics cookies. These external services use their own visitor/session definitions, so their totals differ from our account-deduplicated administrator reports.
We do not load these external scripts on administrator, sign-in, account, enquiry-form or policy pages, or for recognised administrator sessions. Contact data, uploaded files, enquiry references and WhatsApp message contents are not passed as custom analytics fields. Public-page URL parameters are limited to validated campaign tags before the external scripts can load. Advertising consent remains denied; no Meta Pixel or Google Ads tracking is enabled.
The scripts remain blocked until you allow Analytics. Rejecting or withdrawing consent prevents them loading; withdrawing on a page with active scripts clears their first-party analytics cookies and reloads the page to unload the collectors. See Google privacy information, Microsoft privacy information and Shipsolo/Plausible.
4. Technology list
| Identifier | Provider/domain | Purpose | Category | Duration | Activation |
|---|---|---|---|---|---|
| csf_customer | This website | Verified customer session and access to your own enquiries | Necessary | Up to 7 days; sign-out revokes the session | Successful customer sign-in |
| csf_customer_email | This website | Bind customer email verification to the requesting browser | Necessary | 10 minutes | Customer code request |
| csf_customer_oauth | This website | Validate Google customer sign-in state, nonce and PKCE | Necessary | Up to 10 minutes; cleared on successful callback | Choosing Google customer sign-in |
| csf_oauth | This website | Validate Google administrator sign-in state, nonce and PKCE | Necessary | Up to 10 minutes; cleared on successful callback | Choosing Google administrator sign-in |
| csf_admin | This website | Authorised administrator session | Necessary | Up to 8 hours; logout revokes the session | Successful administrator sign-in |
| csf_email | This website | Bind a one-time email sign-in attempt to the requesting browser | Necessary | 10 minutes | Email sign-in request |
| csf-cookie-preferences | This website, local storage | Remember privacy choices | Necessary preference | Choice valid for 180 days; browser storage remains until replaced or cleared | Saving a privacy choice |
| csf-first-source | This website, local storage | Remember the first permitted campaign source and entry page | Optional analytics | Up to 90 days of use, replaced on expiry; removed on withdrawal | Analytics allowed |
| csf-current-source | This website, session storage | Carry the current permitted campaign source between pages | Optional analytics | Current tab session; removed on withdrawal | Analytics allowed |
| _ga, ga* | Google Analytics, this website / Google | Traffic and public contact-button statistics | Optional analytics | Google-managed; _ga cookies can persist up to 2 years; cleared on withdrawal | Analytics allowed on eligible public pages |
| _clck, _clsk | Microsoft Clarity, this website / Microsoft | Heatmaps and session recordings | Optional analytics | _clck up to 1 year; _clsk up to 1 day; cleared on withdrawal | Analytics allowed on eligible public pages |
| Shipsolo/Plausible script | plausible.shipsolo.io | Page views, sources and engagement; no analytics cookies | Optional analytics | No analytics cookie; server-side retention is controlled by the service | Analytics allowed on eligible public pages |
| Cloudflare Turnstile | challenges.cloudflare.com | Detect automated enquiry and customer code-request abuse | Security | Challenge and provider-controlled technical processing | Enquiry form security check |
Choosing Continue with Google takes you to Google for identity verification. Google processes its own sign-in cookies and security information under its Privacy Policy. This website requests identity and email only. Google sign-in is not loaded automatically while browsing; your choice opens the sign-in service. Customer sign-in and account pages are excluded from our optional event analytics.
5. Your choices
Reject Optional and Allow Analytics are available on the initial notice. Cookie Settings in the footer lets you change your choice later. Rejecting or withdrawing stops analytics collection and removes the campaign-source browser storage. A page reload after withdrawal unloads external collectors. Previously collected external statistics remain subject to the provider’s retention settings. Previously recorded account-linked events expire under the stated 90-day retention schedule. The website asks for a new analytics choice when the consent version changes.
Declining analytics does not prevent browsing, customer sign-in, submitting an enquiry from your verified account, emailing us or choosing WhatsApp. Campaign tags present in a submitted enquiry's URL can still be attached to that enquiry as part of handling it; they are separate from optional event tracking.
You can also clear browser storage using your browser controls. Blocking necessary functions may prevent administrator sign-in or the enquiry security check.
6. Questions
Contact hello@customsignforge.com with questions about storage or privacy choices.