Draft – to be reviewed before launch.

Cookie and similar technologies notice

Last updated: 4 October 2026

1. About this notice

This notice explains how SitePaper uses cookies and other technology that stores information on, or accesses information from, your browser or device.

SitePaper is a trading name of Toolhouse Labs Ltd. Contact us at hello@sitepaper.co.uk if you have a question about this notice.

2. Strictly necessary SitePaper cookies

We use the following first-party cookies:

| Cookie | Purpose | Normal duration |

|---|---|---|

| `sp_session` | Keeps you securely signed in after you use an email magic link | 30 days |

| `sp_docs` | Remembers up to 15 documents created in the current browser so that they can be linked to your account | 30 days |

| `sp_co` | Binds a Stripe Checkout return to the browser that started the checkout and helps prevent replay or unauthorised access | 1 hour |

These cookies are used only for authentication, security, document access, checkout security or remembering a privacy choice.

They are not used for advertising or cross-site tracking.

The service cannot provide the relevant requested function without these cookies.

In production, authentication and checkout cookies are configured with security protections including `HttpOnly`, `Secure` and an appropriate `SameSite` setting.

3. Stripe Checkout

When you choose to pay, we redirect you to Stripe’s hosted Checkout.

Stripe may use cookies or similar technologies on its own website for payment processing, authentication, fraud prevention, security and regulatory purposes. Stripe is responsible for explaining its own use of those technologies and obtaining consent where required.

You can read the Stripe privacy policy.

We do not receive your full card number or card security code.

4. Self-hosted Umami analytics

If analytics is enabled, we use a self-hosted version of Umami to understand how SitePaper is used and improve the website.

It is configured:

• without analytics cookies;
• without storing anything in your browser, unless you switch analytics off (see section 5);
• without advertising identifiers;
• without cross-site tracking;
• without user profiles;
• without sharing analytics data with an advertising network; and
• without using analytics to make decisions about individuals.

The limited information collected includes:

• the page or SitePaper event;
• date and time;
• general referral source;
• broad browser and device category; and
• approximate country or region derived from network information.

We do not store your IP address in the analytics database. Before anything is sent, sign-in tokens and other personal details are removed from page addresses and document numbers are replaced with a placeholder. If your browser sends a Do Not Track signal, nothing is recorded.

Where the analytics tag accesses device information, we rely on the statistical-purposes exception in the Privacy and Electronic Communications Regulations. We use that information solely to produce statistics about SitePaper with a view to improving the service.

Visits are linked only by an anonymous identifier that changes every month, and analytics records are kept for up to 24 months. We do not use them for advertising, profiling or decisions about a user.

5. Objecting to analytics

You can object to statistical analytics at any time, free of charge, using the analytics setting.

When analytics is switched off:

• the analytics tag will not collect statistical events from that browser; and
• we store a single setting (`umami.disabled`) in your browser's local storage so that we remember the choice. It contains no personal information.

Blocking all cookies in your browser may also stop analytics, but it may prevent sign-in, document recovery or checkout from working correctly.

6. No advertising or marketing tracking

We do not use:

• advertising cookies;
• behavioural profiling;
• remarketing pixels;
• cross-site tracking;
• social-media tracking pixels; or
• analytics data to target advertising.

We do not place tracking pixels in transactional emails.

7. Browser controls

Most browsers allow you to view, block and delete cookies.

Blocking `sp_session` will prevent account sign-in. Blocking `sp_docs` may prevent anonymous documents from being linked to your account. Blocking `sp_co` may prevent us from securely completing the browser return from Stripe Checkout.

Browser controls vary, so consult your browser’s privacy or cookie settings for instructions.

8. If our technology changes

If we introduce a technology that is not strictly necessary and does not fall within another lawful PECR exception, we will provide clear information and obtain valid consent before using it.

We will not treat continued browsing as consent.

We will update this notice and the cookie inventory when our use of cookies or similar technologies changes.

9. Contact

For questions about cookies, analytics or privacy, contact hello@sitepaper.co.uk.