No banner. Here's why.

1. What happens on a first visit

Three things, and each one matters:

1. No Set-Cookie header on a cold GET /. Nothing is stored on your device before you do anything.
2. Fonts are self-hosted. The site uses next/font/google, which downloads the font files at build time and serves them from our own domain. There is no runtime request to Google and therefore no transfer of your IP address to Google when a page loads. No external host appears anywhere in the homepage HTML.
3. No third-party analytics, tag manager or advertising pixels. We run no Google Analytics, no Tag Manager, no Plausible, PostHog, Fathom, Hotjar, Meta pixel or Microsoft Clarity — in our source or in our dependencies. We count page views on our own server: no script runs in your browser, no pixel loads, and nothing is written to your device. See section 6.

The same three properties hold for the two client-facing products — see section 5.

2. Why that means no banner

PECR regulation 6 requires consent before storing or accessing information on a user’s device, except where the storage is strictly necessary to provide a service the user has explicitly requested.

Because nothing at all is stored until you take an action, and because everything that is then stored is needed to keep you signed in, the consent requirement is not engaged on arrival. There is nothing to consent to.

This does not remove the duty to tell you. Regulation 6 requires clear information about what is stored, whether or not consent is needed — which is what this page is for.

3. The cookies we do set, and when

All three are set only after you sign in or sign up. None is set on a visit to the marketing site.

Both session cookies are set SameSite=Lax, which also blocks cross-site request forgery.

4. Third parties

4.1 Stripe — on the payment step only

When you reach step 3 of signup, where you enter card details, we load Stripe.js. Stripe then sets two of its own cookies on our domain:

These are Stripe’s, not ours, and Stripe is the controller of what it does with them. They load only when you have reached the payment step — that is, only once you have asked us for a paid service. We treat them as strictly necessary to the payment you have requested, which is why Stripe.js is loaded at that step rather than site-wide.

4.2 YouTube — on the onboarding page

Our onboarding page embeds a video using youtube-nocookie.com. That domain does not set advertising cookies, but loading the embed still discloses your IP address and the referring page to Google. That is a data transfer even though it is not a cookie, so it belongs here.

5. The sites we host for clients

Each product we host is assessed on its own footing, because a hosted salon or takeaway site is a different surface from our marketing site.

ChairTime — salon booking sites

• Fonts self-hosted via next/font. No runtime request to Google.
• No analytics of any kind — no GA, GTM, Plausible, PostHog or Hotjar.
• The only cookies set are Auth.js session cookies, after sign-in.
• No consent banner required.

OrderBoard — takeaway ordering sites

• Sets no cookies at all.
• No analytics, no tracking, no pixels and no error-reporting SDK, in source or in dependencies.
• Uses localStorage for the shopping cart, the auth token, a pending order number and a dismissed-checklist flag. All are strictly necessary or functional.
• No consent banner required.

Two things on OrderBoard send data to third parties from the customer’s browser. They are not cookies, but they are disclosed here for completeness:

• The address autocomplete sends what the customer is typing to OpenStreetMap Nominatim, keystroke by keystroke on a 400ms delay.
• The driver page puts the full delivery address into a Google Maps URL.

6. How we count visits

We count how many people visit this site and which pages they read. That happens entirely on our own server. No script runs in your browser, no pixel loads, no third-party service is involved, and nothing is written to your device. This is why it does not engage the consent rule: PECR regulation 6 governs storing or reading information on your device, and this does neither.

What we keep for each visit:

• The page path — for example /chairtime. Never the query string.
• The site you came from, as a host only — for example google.com. Never the full address, which would carry the words you searched for.
• The country, where our host provides it.
• The date and time.
• A one-way fingerprint that lets us count different people without knowing who they are — see below.

We do not store your IP address, and we do not store your browser’s user-agent string. They are combined with a secret that changes every day and turned into an irreversible hash. Because the secret changes daily, the same person visiting on two days produces two unrelated values. That is deliberate: it lets us answer “how many different people came today” and makes it impossible for us to answer “is this the same person who visited last week”. There is no profile, and nothing that can be traced back to you.

The lawful basis is our legitimate interest in knowing whether the site works and which pages are read. You can object at any time — hello@customercloud.cc.

7. If this position changes

If we ever add analytics, an advertising or conversion pixel, session replay, A/B testing, a live chat widget, an error-reporting SDK, or any other third-party script that stores information on your device or calls home on page load, we will update this page and put a consent banner in place before it goes live — one that blocks the script until you consent.

8. Managing cookies

Because the only cookies we set are needed to keep you signed in, blocking them will sign you out. All modern browsers let you view and delete cookies from their settings, and you can clear ours at any time.

9. Contact

hello@customercloud.cc

See also our Privacy Notice and our Terms of Service.