Cookie policy

Cookies on Superfactor

We use cookies and similar technologies to support essential website functions and remember your preferences. With your permission, we also use analytics cookies to understand website visits and interactions, improve our website, and connect visits with enquiries you submit.

You can accept all cookies or continue with essential cookies only. You can update your cookie preferences anytime.

This policy covers cookies and similar browser storage on superfactor.com. “Accept all” currently permits essential storage and analytics. It does not sign you up for marketing emails or authorize advertising cookies.

Essential cookies and storage

Essential storage supports website security, remembers your cookie choice and lets us record that choice. It remains available when you select Essential only. We use a random browser identifier in a first-party cookie and keep your preference in your browser’s local storage. These are used to manage consent, not as advertising identifiers.

Product and article pages use a separate first-party cookie, sf_product_cheer, to remember this browser’s cheers and let you add or remove them. It lasts up to one year and is not connected to analytics or your contact details. Your per-browser cheer record becomes eligible for automatic deletion one year after its last change; the shared total for each product or article remains. Clearing cookies or using another browser starts a separate cheer allowance. Cheer security counters use a protected hash of an IP address and become eligible for deletion after two minutes.

A do-not-track preference may also be stored to tell a previously loaded analytics service to stop tracking after you withdraw permission. HubSpot keeps this preference for up to six months. Restricted administrative pages use separate necessary security and sign-in cookies.

Expiration

We remember each saved cookie choice for six months (180 days) from the time you make it. Your browser stores a local preference, and our server stores the corresponding choice. When you make a new choice, its own 180-day period begins.

After your preference expires, optional analytics stays off until you make a new choice. We may also ask again if you clear browser storage, use another browser or device, or we change the purposes covered by the consent notice.

The consent browser identifier cookie has a 180-day lifetime that can be renewed when you return. Renewing that identifier does not extend the permission granted by your saved choice. The longer audit retention described below also does not extend your analytics permission. Expiry controls whether we rely on your choice; local browser data may remain until it is cleared or updated.

Optional analytics

We currently use HubSpot to understand visits and interactions with our public website. Analytics is off until you choose Accept all and your acceptance has been saved. If you submit an enquiry after accepting, we may connect your consented website activity with your contact record to understand the context of your enquiry.

HubSpot uses cookies such as hubspotutk, __hstc, __hssc and __hssrc for visitor and session recognition. Its visitor cookies last up to six months; session cookies last 30 minutes or until the browser session ends. HubSpot’s cookie information and privacy policy explain its current cookie settings and data practices.

You can browse the website and send an enquiry with essential cookies only. We do not load analytics on our consent-records or authentication pages, or on pages whose address or referring address contains query parameters or fragments that could disclose private information.

Managing cookie preferences

You can review and change your cookie preferences at any time. Choosing Essential only stops analytics in your browser immediately and removes accessible first-party analytics identifiers. The contact form, enquiry emails and operational handling of your enquiry continue to work.

If your connection is interrupted, analytics stays off and we retry saving your essential-only choice when the connection returns or on a later visit. Server processing can apply the new choice once it receives it. Acceptance does not enable analytics until it has been saved successfully.

Withdrawal does not recall information already sent while your permission was active. It also does not erase the history of your cookie choices: we keep the earlier decision and the withdrawal as separate audit records for the period below.

Audit records

We keep a separate record of each saved acceptance, essential-only choice or withdrawal for three years (1,095 days) from the date that decision is recorded. This lets us demonstrate what you chose, what information you were shown and when your choice changed. A new decision does not restart the retention period for older decisions.

Each record includes a random browser ID, a unique receipt ID, the choice and permissions, the date and time, the page where the choice was made, the selected button, and the exact versions and wording of the consent notice and cookie policy. We do not add your name, email address, raw IP address or analytics cookie value to these consent audit records.

Keeping this limited evidence is separate from running optional analytics. We retain it when you choose Essential only or withdraw permission, and we do not use it for advertising. Clearing your browser storage does not delete audit records already saved on our server.

Storage and expiry

Consent audit records are stored in an encrypted database on Amazon Web Services in the United States. Connections to the website use HTTPS. Access is restricted to authorized personnel, and the online audit report requires secure sign-in. It is not a public directory or an analytics report.

At the end of the three-year retention period, expired consent records are excluded from the audit report and become eligible for automatic deletion. Database deletion runs in the background and typically completes within a few days, rather than at the exact moment a record expires.

Protected disaster-recovery backups can retain earlier copies for up to 35 days after deletion from the active database. These backups support recovery, rather than routine reporting or analytics. We also preserve historical notice and policy wording so we can explain what visitors were shown; those text archives contain no individual visitor’s choices or identifiers.

Access and records

Authorized administrators use a necessary sign-in cookie for a session of up to eight hours. Their emailed sign-in links can be used once and expire after 24 hours. Administrator authentication records contain the authorized email address and protected sign-in information. These access controls do not enable visitor analytics.

Separate security counters use a protected hash of an IP address or sign-in identifier to limit repeated requests. They expire after 24 hours and are then removed by the automatic deletion process. They are separate from the three-year consent audit history. Background deletion and backup retention also apply to these security and authentication records.

Updates and contact

We update this policy when our use of cookies or similar technologies changes. Adding a tool does not by itself expand the purposes you have accepted. If we change the consent notice or introduce a new optional purpose, we ask you to review your choice again. Clarifying this policy does not overwrite the wording attached to earlier consent records.

For questions about your cookie choice or the storage of consent records, contact hello@superfactor.com.