WebPolisher Cookie and Browser Storage Policy
Version: cookies-v4.1
Legal set: webpolisher-legal-set-2026-08-27-v8
Status: Candidate.
1. Scope
This policy explains cookies, local storage and similar storage or access technologies used by WebPolisher.
Necessary technologies support requested security, authentication, checkout and consent functions. Optional analytics remains off until the user makes the required choice.
2. Necessary WebPolisher storage
| Name | Provider | Type | Purpose | Normal duration |
|---|---|---|---|---|
webpolisher-cookie-choice | PeckUK Limited | First-party local storage | Records whether optional analytics is accepted or rejected and when the choice was made | Six months, then the choice is requested again, or earlier if cleared or changed |
wp_auth_link_csrf | PeckUK Limited | First-party HTTP-only cookie | Protects the email authentication-link flow against cross-site request forgery | 10 minutes |
sb-<project-reference>-auth-token, including numbered chunks where required | Supabase for PeckUK Limited | First-party authentication cookie | Maintains and refreshes an authenticated WebPolisher session | Up to 30 days, refreshed where required during active authorised use, or earlier on sign-out, revocation or browser clearing |
These items are treated as strictly necessary because the requested security, authentication or consent choice would not work properly without them.
3. Stripe Checkout
When checkout is enabled and a user chooses to place an order, Stripe may use cookies or similar technologies on Stripe-hosted payment pages for checkout operation, security, fraud prevention, payment authentication and regulatory purposes.
Those necessary technologies are controlled by Stripe and may vary by payment method, device and fraud checks. Stripe provides further information in its own cookie and privacy notices.
WebPolisher does not use a Stripe payment choice as consent to optional WebPolisher analytics or marketing.
4. Optional analytics
WebPolisher may use Vercel Web Analytics to measure consented website use and selected product events.
Category: analytics.
The analytics integration must not be loaded and no analytics event may be sent until the user has positively accepted analytics, unless a future use is covered by a lawful statutory exception and this policy and the consent interface are updated first.
The current integration does not require a named WebPolisher analytics cookie. It may use limited request, network and device information to produce analytics.
5. Necessary security and error monitoring
WebPolisher is designed to use a Sentry-compatible Better Stack endpoint for error, security and reliability diagnostics.
Default personal-information collection must remain disabled and application scrubbing must remain enabled. The current integration does not create a named WebPolisher browser cookie.
This server-side processing is treated as necessary service security and is described in the Privacy Policy and Subprocessor Schedule. Production sending must remain disabled while Better Stack is marked Held in that schedule.
6. Disabled integrations
The following integrations are not authorised to receive production customer data unless they are deliberately approved, configured, documented and tested:
- Cloudflare Turnstile as a direct WebPolisher integration;
- Firecrawl;
- Google Analytics; and
- Google Search Console data access.
Cloudflare may still be used upstream by an approved infrastructure provider. That does not make a disabled direct WebPolisher integration active.
7. Managing choices
The cookie banner and Cookie preferences control must offer equally clear options to accept or reject optional analytics.
Optional technologies must remain off until the required consent is recorded.
Withdrawing consent must be as easy as giving it. A changed choice applies to future activity and does not make earlier lawful processing unlawful.
Necessary storage cannot be disabled through the WebPolisher preference manager because requested authentication, security, checkout and consent functions would not work properly. A user may clear browser storage through browser settings, but this may sign the user out and cause the banner to reappear.
8. Duration and review
Storage duration must be proportionate and limited to what is needed for the stated purpose.
We re-check production browser storage:
- before enabling a new provider or public feature;
- after a material authentication, checkout or analytics change; and
- at least annually.
A new optional technology must not be enabled until it is classified, documented and controlled by the preference manager where required.
9. Contact
Questions about this policy can be sent to updates@webpolisher.co.uk with the subject Privacy request.
10. Supplier details
WebPolisher is a trading name of PeckUK Limited.
PeckUK Limited is registered in England and Wales under company number 08756155.
Registered office: 90 Stowmarket Road, Needham Market, Ipswich, Suffolk, IP6 8DX, United Kingdom.
VAT number: 173 8752 74.