COOKIE POLICY

1. WHAT THIS PAGE IS

This page is a complete, code-verified inventory of the cookies and similar technologies used on vazgro.com and in the Vazgro client, partner and staff portals. It is maintained alongside the software: every entry below corresponds to a named cookie or browser-storage key that actually exists in our codebase.

Cookies are small text files a website asks your browser to store. Related technologies — localStorage and sessionStorage — keep data on your device instead, and are never transmitted to our servers. Both are covered here.

VAZGRO LTD is the data controller: a company registered in England and Wales under company number 15902777, whose registered office is at Innovation Centre, Knowledge Gateway, Boundary Road, Colchester, England, CO4 3ZQ. You can write to us at that address, or email hello@vazgro.com. Where a cookie involves personal data, our Privacy Policy explains the lawful basis, retention and your rights.

One cookie is not listed below because it is never set for visitors: vz_dsr_subject exists only inside our own staff administration console, where it holds the email address of the person whose data-protection request is being worked on, so that the address does not appear in a web address or a server log. It is restricted to that one console, cannot be read by any script, and expires after 30 minutes.

2. ANALYTICS, ADVERTISING AND TRACKING

We use two privacy-preserving measurement tools from Vercel, the company that hosts this website: Vercel Web Analytics, which counts page views, and Vercel Speed Insights, which measures how quickly pages load and respond for real visitors. Neither of them stores anything on your device, and neither can recognise you on a later visit or on any other website. The rest of this section sets out exactly what each one sends.

Apart from those two, we run nothing else. There are no advertising or retargeting pixels, no social media trackers, no session-recording or heatmap tools, and no third-party tag manager. There is no Google Analytics, no Meta Pixel, no LinkedIn Insight Tag, no Hotjar, no PostHog and no A/B testing service. No advertising network receives data about your visit, and we do not sell or share personal data for advertising purposes.

What the two tools actually send. We have listed these fields by reading what the software transmits, rather than by summarising a supplier brochure, because that is the only version of this that is worth publishing.

Vercel Web Analytics records, for each page view: the address of the page you are on, including any campaign tags that were in the link you followed; the general pattern of that page rather than your specific one (for example /services/[slug]); the address of the site that linked you here, and only when that site is not our own; the time; and the version of the measurement script. It does not send your device type, your screen size, your browser identification string, or any identifier for you.

Vercel Speed Insights records, for a sample of page views: standard web performance timings (how long the main content took to appear, how stable the layout was, how quickly the page responded to your first interaction, and how long the server took to respond), together with the page address, the page pattern, a broad category for your connection quality such as "4g", and — where an interaction was slow — a description of which element on the page was involved. It does not send any identifier for you either.

Both send their measurements to Vercel, who process them on our behalf as our data processor. Neither sets a cookie, and neither reads or writes anything in your browser storage.

Where the country or device information in our dashboards comes from. Vercel can show us a rough breakdown by country and by device type. That is not read from your device by the measurement scripts, which send no such thing. It is worked out by Vercel from the network address and browser identification that your browser necessarily sends with every request for every page, image and file on any website you visit. We see it only in aggregate.

Our lawful basis for this measurement is our legitimate interests (UK GDPR Article 6(1)(f)) in understanding whether our website works, is fast enough, and is worth running. We consider the impact on you to be minimal, because none of it identifies you or follows you. You can object to processing based on legitimate interests at any time — see the Privacy Policy for how.

How long it is kept. These measurements are aggregate statistics that contain no identifier for you. They are retained by Vercel under the retention period that applies to our plan, and we do not hold a separate copy.

Every cookie described below is a first-party cookie set by vazgro.com itself. None of them is used to build a profile of you, to follow you across other websites, or for advertising.

Why there is no cookie consent banner. This is the question the rest of this page exists to answer honestly, so here is the reasoning in full.

Regulation 6 of the Privacy and Electronic Communications Regulations (PECR) is not a rule about cookies as such. It applies when a website stores information on the equipment you are using, or reads information already stored there. Where a website does neither, regulation 6 is not engaged and consent is not required — and that is the case for both measurement tools described above. We checked this rather than assuming it: the scripts that actually do the measuring were examined directly, and they contain no cookie, no local or session storage, no database storage in the browser, and no identifier that could persist between visits.

That is why there is no site-wide consent banner. A banner on every page would be asking your permission for analytics, advertising and third-party tracking that are not happening here, and would train you to click through a dialogue that protects you from nothing.

There is, however, one thing here that does need your permission, and we used to get this wrong. The referral cookies in section 4 are not strictly necessary, and regulation 6 requires both clear information and consent for anything that is not — it does not offer information as an alternative to consent. This page described those cookies accurately and we then set them anyway, without asking. It no longer works that way. They are set only if you say yes, and you are only asked if you actually arrive through a referral link. Every other visitor is asked nothing, because there is nothing else to ask about.

If that position ever changes — if we enable a cookie-based mode of these tools, or introduce advertising or any third-party tracking technology — we will implement a consent mechanism before doing so, and update this page in the same change.

3. STRICTLY NECESSARY COOKIES

These cookies are required to deliver the service you have asked for. Without them, signing in, staying signed in, switching between workspaces, or seeing prices in your own currency would not work. They are exempt from the consent requirement under PECR regulation 6(4).

sb-<project>-auth-token (and its numbered chunks) — set by our authentication provider, Supabase. Holds your signed-in session and refresh token. Without it you would be signed out on every page load. Duration: for the life of your session, refreshed while you remain active; cleared when you sign out.

vz_active_account — remembers which client workspace you are currently viewing, for people who belong to more than one. Duration: up to 1 year. Contains an internal account identifier, not your name or email.

vz_active_partner — the same thing for partner organisations: which partner team you are acting within. Duration: up to 1 year.

vz_brand — remembers the selected brand inside a multi-brand client workspace, so your assets and requests stay filtered to the right brand. Duration: up to 1 year.

vz_cc — a two-letter country code, taken from your connection or from your own selection. Used to show prices in the appropriate currency and to apply the correct tax treatment at checkout. Duration: up to 1 year. It is a country code only — never a precise location.

vz_flash_error — carries a single error message across one redirect so a failed form can tell you what went wrong. Duration: seconds; deleted as soon as it is read.

vz_pf — a short-lived carrier for an email address you have just typed into a sign-in or registration form, so that we can pre-fill the next step WITHOUT putting your email address into a web address. Web addresses are recorded in browser history, in server access logs and in referrer headers; a five-minute cookie is not. Duration: 5 minutes, then it expires; it is also deleted immediately after it is used.

vz_ck_ref — records your answer to the referral question in section 4, so that we act on it and do not ask you again. It holds one word, either granted or denied, and nothing else: no identifier, and nothing about you. It is written whichever way you answer, including when you say no, because storing the refusal is the only way to keep it — without it we would have to ask again on the next referral link, which would defeat the refusal. That is why we treat this one as strictly necessary. Duration: 6 months, after which we would ask you again.

4. REFERRAL COOKIES — WE ASK BEFORE WE SET THEM

Three cookies support our referral programmes. None of them is required for this website to work: nothing you see, nothing you are shown and nothing you are charged depends on any of them, and the site behaves identically when they are absent. So we do not set them unless you tell us we may. If you arrive through a referral link, the referral code travels to the page you land on inside the web address rather than being stored on your device, and we ask you there, once. Saying no costs you nothing at all — every page, price and feature behaves exactly the same. The only consequence is that the partner or client who referred you may not be credited.

vz_ref — set, and only if you agree, when you arrive through a Vazgro partner's referral link (vazgro.com/r/...). It records the partner's public referral code so that, if you later become a client, the partner is credited with the referral and paid their commission. Duration: 90 days. It contains a partner code, not information about you. It is not used for advertising, is not shared with any third party, and is not read by anyone other than Vazgro.

vz_cref and vz_cref_m — the same mechanism, and the same permission, for our client referral programme (vazgro.com/cr/...): they record which existing client, and optionally which member of their team, referred you, so the referral reward can be credited. Duration: 90 days. vz_cref_m holds an internal identifier for that team member, which is why it is only ever set alongside vz_cref and only after you have said yes.

You can change your mind at any time, and it takes the same single click that agreeing did: choose Cookie choices in the footer of any page. Refusing there also deletes any of these cookies already on your device. You can of course still block or delete them in your browser settings as well (section 7).

We also record a referral click event when one of these links is used. This happens on our own servers whether or not you agree to the cookies above: it stores nothing on your device and reads nothing from it, so regulation 6 does not govern it, and it is how a partner gets accurate statistics for the links they share. That record contains the referral code, the page you landed on, any campaign tags in the link, your browser's user-agent string, and a one-way salted hash of your IP address. The hash cannot be reversed to recover your IP address. Our lawful basis is our legitimate interests in measuring our own referral programme. These records are deleted automatically after 26 months.

5. BROWSER STORAGE ON YOUR DEVICE

The following are stored in your browser's localStorage. They hold interface preferences only, are never sent to our servers, and are not cookies — but we list them for completeness.

vazgro-vb-theme — light or dark appearance on the public website.

portal-theme — light or dark appearance inside the portals.

portal-nav-collapsed and portal-nav-open — whether your sidebar is collapsed and which navigation groups you have expanded.

vz.editor.sidebar — whether the sidebar is collapsed in the content editor.

vz.tour.<name>.v<number> — records that you have seen or skipped a guided product tour, so it does not reappear every time you sign in.

vz.coach.<name> — records that you have dismissed a one-off tooltip.

vz_geo_v1 — a short-lived cache of the currency and country lookup described in section 3, so we do not repeat the request on every page.

Clearing your browser storage resets these preferences. Nothing is lost except the preferences themselves.

6. EMAIL TRACKING

Cookies are not the only technology PECR covers. When we send you an email, our email provider (Resend) can report whether the message was delivered, whether it bounced, whether you reported it as spam, and — where open and click tracking is enabled — whether the message was opened or a link in it was clicked. Open tracking works by including a small invisible image in the message.

We rely on delivery, bounce and complaint reporting for a specific and necessary purpose: it is how an address that no longer works, or someone who has marked our mail as spam, is automatically added to our suppression list and never emailed again.

Open and click records are deleted automatically after 13 months. Most email clients let you block remote images, which prevents open tracking entirely. You can stop all marketing email from us at any time using the unsubscribe link in any message, or by emailing hello@vazgro.com — and we keep a record of that request permanently, precisely so that it is honoured.

7. HOW TO CONTROL COOKIES

Every major browser lets you see the cookies a site has set, delete them, and block future ones — usually under Settings, then Privacy. You can also browse in a private or incognito window, which discards all cookies when you close it.

Please note that blocking the strictly necessary cookies in section 3 will prevent you from signing in to the Vazgro portals, because your session cannot be maintained without them.

Your browser may also offer a Global Privacy Control or Do Not Track signal. As we operate no advertising or cross-site tracking, there is nothing for such a signal to switch off.

For the referral cookies in section 4 you do not need your browser settings at all. Cookie choices, in the footer of every page, shows what you have chosen and lets you change it — allow them, or refuse and delete any that are already set. Withdrawing is exactly as easy as agreeing, because the law requires it to be and because a choice you cannot easily reverse is not much of a choice.

8. CHANGES AND CONTACT

We will update this page whenever we add, remove or change a cookie or a measurement tool, and always before introducing anything that would store information on your device or read information from it. The effective date above tells you when it was last revised.

Questions about this page, or about cookies and tracking generally, can be sent to hello@vazgro.com. You also have the right to complain to the Information Commissioner's Office (ico.org.uk), the UK supervisory authority.