This Cookies Policy explains what cookies and similar technologies Supplio uses, what they do, and how you can manage them. It supports our Privacy Policy and is written to comply with the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR) and the UK GDPR.
1. What are cookies?
Cookies are small text files that a website saves on your device when you visit. They let the website remember things like your sign-in state, your preferences and which pages you have viewed. We use the word "cookies" loosely here to also cover similar technologies such as browser local-storage entries and session-storage entries used for the same purposes.
2. How we use cookies
We use as few cookies as possible. On supplio.co.uk (the marketing site) we use only cookies that are strictly necessary to make the site work, plus Google Analytics cookies if you opt in. We also count visits with a cookieless analytics tool (see 3.3). In the Supplio platform at app.supplio.co.uk we use only cookies that are strictly necessary to keep you signed in securely and to remember your preferences.
We do not use cookies for cross-site advertising, behavioural profiling for marketing, or to share your activity with social networks or ad networks. We do not place any third-party advertising tags on our sites.
3. Marketing-site cookies (supplio.co.uk)
3.1 Strictly necessary
These cookies are required for the site to work. They do not need your consent under PECR Regulation 6(4).
| Name | Purpose | Type | Duration |
|---|---|---|---|
__Host-csrf | Anti-CSRF token protecting the contact form and Stripe Checkout flow. | First-party, session | Browser session |
cookie-consent | Remembers your cookie preferences so we don't ask again on every page. | First-party, persistent | 12 months (rolling) |
3.2 Google Analytics (opt-in)
We use Google Analytics 4, provided by Google, to understand which pages perform well and what we should improve. It only loads if you opt in via the cookie banner: until then your browser sends nothing to Google and no analytics cookies are set. We have switched off Google signals and ad personalisation and keep advertising storage denied, so Google Analytics sets no advertising cookies and builds no advertising profiles. Google states that Google Analytics 4 does not log or store IP addresses.
| Name | Purpose | Type | Duration |
|---|---|---|---|
_ga | A random identifier that lets Google Analytics tell a returning browser from a new one. | First-party, persistent | 2 years |
_ga_GTQSEWW0R2 | Keeps track of the current visit for Google Analytics. | First-party, persistent | 2 years |
If you withdraw consent, we delete these cookies and reload the page, so Google Analytics stops collecting straight away. If your browser sends a Do Not Track (DNT) or Global Privacy Control (GPC) signal, Google Analytics does not load at all, even if you opt in.
3.3 Cookieless visit counts
We also count page views with Vercel Web Analytics, provided by Vercel, which hosts this site. It sets no cookies and stores nothing on your device. Vercel tells visitors apart with a hash of the incoming request that it discards after 24 hours, so it cannot follow you from one day to the next or across other websites. Page addresses are cleaned before they are sent: we keep only campaign (utm_) tags from the query string and replace sign-up links with a placeholder.
Because it sets no cookies and stores nothing on your device, it counts every visit, whatever you choose in the cookie banner and whether or not your browser sends a DNT or GPC signal.
3.4 Stripe Checkout
When you start the checkout flow, you are redirected to Stripe's payment pages on checkout.stripe.com. Stripe sets its own cookies on that domain to prevent fraud and enable the checkout to function. These are governed by Stripe's cookie policy.
4. Platform cookies (app.supplio.co.uk)
All cookies and local-storage entries used in the platform are strictly necessary to keep you signed in, to keep the platform secure, and to remember your settings.
| Name | Purpose | Type | Duration |
|---|---|---|---|
__Host-supplio-access | Your signed-in session token, used to authenticate API requests. HttpOnly and Secure, so page scripts cannot read it. | First-party, persistent | 30 minutes |
__Host-supplio-refresh | Allows the platform to renew your session in the background without making you sign in again. HttpOnly and Secure. The session behind it ends after 30 minutes of inactivity and after 12 hours at most, after which the cookie can no longer be used. | First-party, persistent | Up to 7 days |
__Host-supplio-sso | Set only while you sign in with Microsoft single sign-on, to protect that sign-in attempt against tampering. HttpOnly and Secure. | First-party, session | 10 minutes |
supplio-auth-epoch, supplio-refresh-at (local-storage) | Non-secret markers that keep sign-in, sign-out and session renewal in step across your open tabs. They contain no token. | First-party, local-storage | Until you clear browser data |
supplio_cookie_consent (local-storage) | Records your in-product cookie preferences. | First-party, local-storage | Until you clear browser data |
supplio-prefs and interface settings (local-storage) | Remembers your display preferences and interface choices, such as theme, dashboard layout, saved filter views and list or card view. | First-party, local-storage | Until you clear browser data |
| Draft entries and recent searches (session-storage) | Saves a working draft of long forms so you don't lose work if the page reloads, and remembers your recent searches and filters for the current visit. | First-party, session-storage | Browser session (drafts expire after 7 days at most) |
supplio.sso.pendingLink (session-storage) | Remembers a pending request to link your Microsoft account while you complete single sign-on. Removed as soon as it is used. | First-party, session-storage | Browser session (ignored after 10 minutes) |
5. Other technologies
- Server-side logs capture your IP address, user-agent and request path for security and audit purposes. See the Privacy Policy for retention.
- Web fonts (Inter, Poppins) are loaded through Next.js's built-in self-hosting pipeline; they do not set cookies or report back to a third-party font server while in use.
6. Your choices
- Cookie banner: on first visit to the marketing site you are asked whether to accept all cookies, reject non-essential cookies, or customise your preferences. Your choice is honoured straight away.
- Change your mind: use the Cookie settings link in the footer of every page to change your preferences. Withdrawing consent is as easy as giving it.
- Browser controls: most browsers let you block or delete cookies through their settings. Blocking strictly necessary cookies may prevent the site or platform from working.
- Do Not Track / GPC: if your browser sends a DNT or GPC signal, we treat it as a refusal of consent: Google Analytics does not load, whatever you choose in the cookie banner. The cookieless visit counts in 3.3 are not affected.
7. Changes to this Cookies Policy
We may update this Cookies Policy if our use of cookies changes. The "Last updated" date at the top reflects the most recent change.
8. Contact
Cookies questions? Email privacy@supplio.co.uk.