Cookie Policy | Pepperseed

1. About cookies and similar technologies

Cookies are small pieces of information stored by a website in a browser. Similar technologies include browser session storage, service workers, payment-provider storage and push-notification subscriptions. UK privacy rules apply to storing information on, or accessing information from, a device—not only to traditional cookies.

Pepperseed separates essential storage from optional analytics. Essential storage supports features you request and remains active. Google Analytics 4 and Microsoft Clarity are optional: their scripts do not load until you choose Allow analytics. Rejecting analytics is equally available and does not affect core Pepperseed features.

Advertising storage and advertising-personalisation consent remain denied whether you allow or reject analytics. Pepperseed does not use these tools to build advertising profiles.

2. Technologies currently used

Technology	Purpose	When it is used
Supabase authentication and PKCE/session storage	Creates and refreshes secure login sessions, supports email confirmation and password recovery, and protects authenticated dashboard routes.	When an owner signs up, logs in or uses an authenticated account feature.
Stripe cookies and payment-security storage	Displays Stripe Checkout or the Stripe Payment Element, collects a payment method, prevents fraud and completes subscription or booking payments. Stripe controls its own storage under its policies.	When a user starts/manages a Pepperseed subscription or a customer chooses an online-payment service.
Pepperseed session storage	Temporarily remembers an opaque booking-attempt identifier and access token so retrying an interrupted payment does not create a duplicate hold. It does not contain full card details.	During an online-payment booking attempt; browser session storage is normally cleared when the tab or browser session ends.
Service worker and PWA installation support	Allows Pepperseed to be installed and supports optional booking push notifications. The service worker is deliberately configured not to cache pages, authenticated API responses, bookings or customer data.	When the site loads in a supported browser. Installation remains optional.
Push-notification subscription	Stores a device-specific push endpoint and cryptographic subscription keys after the owner actively enables notifications.	Only after browser/device permission is granted; it can be disabled in Pepperseed or device settings.
Security and request controls	Uses request and origin information to reject cross-site mutations and creates pseudonymised rate-limit identifiers to prevent abusive public booking requests.	When protected or public booking endpoints are requested.
Pepperseed analytics preference	Stores whether analytics was allowed or rejected, together with the preference version and update time, so the banner does not repeatedly interrupt you.	After you choose either analytics option. This preference is essential to remember and respect your choice.
Pepperseed growth consent (`pepperseed_growth_consent`) and attribution (`pepperseed_growth_attribution`) cookies	Uses a signed, first-party attribution identifier with bounded source, medium, campaign and landing-page categories to understand how a consented visitor found Pepperseed and whether that visit later leads to account or business setup. It does not use fingerprinting or retain raw advertising click identifiers.	Only after you choose Allow analytics. Both cookies last up to 30 days and are removed when analytics is rejected or withdrawn.
Google Analytics 4 (`_ga` and measurement-specific `_ga_*` cookies)	Measures consented page views, approximate acquisition, useful scroll milestones and selected conversion events. Pepperseed does not send names, contact details, customer notes, payment details, passwords or authentication tokens in event parameters.	Only after you choose Allow analytics. Google advertising storage, ad-user-data and ad-personalisation consent remain denied.
Microsoft Clarity (`_clck`, `_clsk` and related provider storage)	Provides consented heatmaps and session recordings to help us understand appropriately masked patterns of use. Input and select values are masked by Clarity, and Pepperseed also masks non-public application screens.	Only after you choose Allow analytics, on supported public Pepperseed pages. Advertising storage remains denied.
Pepperseed analytics event deduplication	Uses browser session storage to prevent one-off conversion and meaningful-view events being counted repeatedly in the same browser session.	Only after analytics has been allowed; it normally ends when the browser session ends.
Review and feedback submission events	Measures only that a review, review response or feedback form was successfully submitted. Pepperseed does not send the rating, written content, booking reference, review token or contact details to analytics providers.	Only after analytics has been allowed. The forms themselves still work when analytics is rejected.

3. Essential and optional technologies

Authentication and security storage is needed to keep a user signed in, protect private business data and carry out actions the user requests. Payment storage is needed to securely collect a payment method or complete a card payment. Temporary booking-attempt storage prevents accidental duplicate payment holds. These purposes are integral to the requested service.

Push notifications are optional and are not enabled until the owner takes a positive action and accepts the browser or device permission prompt.

Google Analytics, Microsoft Clarity and Pepperseed's first-party attribution cookies are not necessary for Pepperseed to work. They are controlled by analytics consent. Before consent, Google's analytics, advertising, ad-user-data and ad-personalisation storage states default to denied, and optional measurement scripts and attribution storage are withheld. Allowing analytics grants analytics storage only.

4. Your controls

Browser settings usually allow you to view, block or delete cookies and site data. Blocking necessary authentication or Stripe storage may prevent login, password recovery, subscription management or online payment from working. Clearing site data may sign you out or reset an in-progress payment attempt.

You can disable Pepperseed push notifications in Dashboard Settings and can also change notification permissions in your browser or device settings. You can remove an installed PWA using your device's normal app-removal controls.

Use Cookie settings in any Pepperseed footer to reopen the analytics controls. You can switch from rejected to allowed without reloading the page. If you switch from allowed to rejected, Pepperseed sends updated denied consent signals, removes accessible Google Analytics and Clarity cookies where appropriate, and erases the matching optional first-party attribution record where it can be identified from the attribution cookie. This does not erase separate operational account, booking or payment records.

Stripe and Supabase may provide additional controls and information in their own privacy or cookie notices.

5. Changes and contact

We will update this policy if our providers, purposes or consent controls change.

Operator: PEPPERSEED LTD
Company number: 17471549
Registered office:
Unit 13 Freeland Park
Wareham Road
Lytchett Matravers
Poole
England
BH16 6FA
Email: info@pepperseed.co.uk

This wording describes the current technical implementation but is not a substitute for independent legal advice. Pepperseed should review the disclosure, provider contracts, international-transfer position and configured retention periods as part of its ongoing privacy review.