Version: 2.2 (names the Meta Pixel). The same policy is shown inside the Gwithva app.
1. The rules we follow
Cookies are small files stored on your device when you visit our website or use our app. This policy also covers similar technologies such as local storage, pixels and session-replay scripts; we call all of these "cookies" here. Under the Privacy and Electronic Communications Regulations 2003 (PECR), as amended by the Data (Use and Access) Act 2025, we must get your consent before using cookies that are not exempt. Two kinds do not need consent: strictly necessary cookies, and — since 5 February 2026 — certain low-risk statistical and appearance technologies used solely for that purpose (we still tell you about these and let you opt out). Everything else — including behavioural analytics, session replay and marketing — we use only with your consent.
2. The categories we use
- Strictly necessary (no consent needed) — keep you logged in, security, load balancing, remembering your booking and remembering your cookie choices. Set by Gwithva, Supabase, Cloudflare and Stripe (at checkout).
- Functional / appearance (exempt — opt-out available) — remember your preferences and how the Platform is displayed.
- Statistical / analytics, first-party (exempt — opt-out available) — used only by us to count visits and measure performance, not shared with third parties for their own purposes.
- Behavioural analytics & session replay — Microsoft Clarity (consent required) — heatmaps and session recordings so we can see how the Platform is used and fix problems. Because this data is processed by Microsoft on its own systems and goes beyond aggregate statistics, it does not fall within the exemptions above, so we use it only with your consent. We mask text and form inputs and do not record checkout or account pages. Microsoft acts as an independent controller for this data, not as our processor — see Privacy Policy §6 and Microsoft's own Privacy Statement.
- Marketing — Meta Pixel (consent required) — tells us which Facebook and Instagram ads bring people to Gwithva (page visits and sign-ups on our website) and lets Meta measure those ads. We and Meta are joint controllers for collecting and sending this data; Meta is an independent controller for its own use of it afterwards — see Privacy Policy §6 and Meta's Privacy Policy. Website only; not in the mobile apps.
3. The cookies we use
A representative list is below; the complete, current list is maintained in the app and surfaced from the cookie banner.
| Cookie / technology | Provider | Purpose | Category | Duration |
|---|---|---|---|---|
| sb-access-token, sb-refresh-token | Supabase | Keep you signed in | Strictly necessary | Session / persistent |
| __cf_bm, cf_clearance | Cloudflare | Security and bot management | Strictly necessary | ~30 mins / session |
| __stripe_mid, __stripe_sid | Stripe | Fraud prevention at checkout | Strictly necessary | 1 year / 30 mins |
| gwithva_cookie_prefs | Gwithva | Remember your cookie choices | Strictly necessary | 12 months |
| _clck, _clsk, CLID | Microsoft Clarity | Behavioural analytics & session replay | Consent required | Up to 1 year |
| _fbp, _fbc | Meta (Meta Pixel) | Measuring which ads bring visitors and sign-ups | Consent required | Up to 90 days |
4. Your choices
When you first visit, our cookie banner lets you accept or reject non-essential cookies, or choose by category — "Reject" is as easy as "Accept". You can change your choices at any time via the "Cookie settings" link in our footer, and you can opt out of the exempt statistical and appearance technologies in the same place. You can also control cookies in your browser settings, though blocking strictly necessary cookies may stop the Platform working.
5. Third-party providers and international transfers
Some technologies are set by our providers (for example analytics, security and our payment processor), who have their own privacy notices. Microsoft Clarity and the Meta Pixel involve transferring data to Microsoft and Meta, which may process it outside the UK. Microsoft is an independent controller rather than our processor for that data, and Meta is as described in §2; where we transfer personal data outside the UK we rely on appropriate safeguards such as the UK IDTA or the UK Addendum to the EU Standard Contractual Clauses. See our Privacy Policy for the full provider list.
6. Changes and contact
We may update this policy and will post a new version with a new date, notifying you of significant changes. For how we handle the data collected, see our Privacy Policy. Questions about cookies: [email protected].