1. About this policy
This policy explains which cookies and similar technologies GrantCookie uses on its own website and in its own application, why it uses them, how long they last, whether we ask for your consent and how you can control them. Section 4.5 explains how you can check, in your own browser, what the website and the application set.
GrantCookie provides a cookie consent management platform for websites. It includes a cookie scanner, a consent banner, a consent log and related features.
In this policy:
- “GrantCookie”, “we”, “us” and “our” mean GrantCookie, the provider of the service.
- “The website” means the public pages at grantcookie.com.
- “The application” means the pages at app.grantcookie.com, where customers register, sign in and use the service.
- “The service” means the cookie consent management platform we provide to customers through the website and the application: the cookie scanner, the consent banner, the per-market rules, the consent log, the cookie policy generator and the integrations, including the JavaScript API, together with related support.
- “A customer” is a person or organisation that holds an account in the application.
- “A visitor” is a person who reads the website, or opens the application without signing in.
- “An end user” is a person who visits a customer’s website where the banner runs.
- “A working day” is any day from Monday to Friday, including public holidays.
- “You” means a visitor, or a person signed in to the application, depending on what you are doing at the time.
This policy covers the website and the application only. It does not cover the consent banner that customers place on their own websites. Section 5 explains why.
This policy sits alongside our privacy policy, which is published on the website. The privacy policy explains how we handle personal data more generally, including the email address you give us when you subscribe to our monthly newsletter or write to us, and the consent records we hold for customers. Where a question is about personal data rather than about cookies, the privacy policy is the document to read.
2. What cookies and similar technologies are
2.1 Cookies
A cookie is a small text file that a website asks your browser to store on your device. Each time your browser sends a request to that website, it sends the cookie back with it. This lets the website recognise the same browser from one request to the next. A web request carries no memory of its own, so cookies are the usual way a website keeps you signed in, remembers a setting or tells one browser from another.
Cookies differ in who sets them and in how long they last.
- A first-party cookie is set by the site whose address appears in your browser. Your browser sends it back only to that site, although scripts running on that site’s pages may also be able to read it.
- A third-party cookie is set by a different domain, usually because the page you are on loads content, a script or an image from that domain. The third party can read its cookie on every site that loads its content, which is one way tracking across sites works.
- A session cookie has no expiry date. Your browser deletes it when you close the browser, although some browsers keep session cookies when they restore your previous session.
- A persistent cookie has an expiry date chosen by the site. It stays on your device until that date, or until you delete it, and can last anything from a few minutes to more than a year.
2.2 Similar technologies
Several other techniques can do the job a cookie does.
- Local storage and session storage are areas in your browser where a site can keep data. Local storage stays until it is cleared. Session storage is cleared when the tab is closed. Neither is sent automatically with each request, but a script on the page can read it and send it on.
- Pixels, also called web beacons, are tiny images or requests that a page loads from a server. The request tells that server that the page was opened, and it can carry an identifier with it.
- Scripts and software development kits are code that a page loads from another party. They can set cookies, read storage and send data to that party’s servers.
- Fingerprinting combines details of your browser and device, such as screen size, fonts and installed features, into an identifier without storing anything on the device.
The law usually treats these techniques in the same way as cookies. In this policy, “cookies and similar technologies” means all of them, and “cookies” on its own means cookies as described in section 2.1.
2.3 Purposes
Cookies and similar technologies are usually grouped by purpose. The service groups them into four categories: necessary, functional, analytics and marketing. This policy uses the same four.
- Necessary (also called strictly necessary): the site cannot provide the thing you asked for without them. Keeping you signed in and protecting the forms you submit from misuse are typical examples. Consent is not normally required for these, because refusing them would mean refusing the service itself.
- Functional: these remember a choice you made, such as a language or a layout, to make the site more convenient. The site still works without them.
- Analytics: these measure how the site is used, such as which pages are visited and for how long.
- Marketing: these build a profile of your interests, often across many sites, so that advertising can be targeted at you.
On the website we use analytics cookies only if you accept them, and strictly necessary cookies to remember the choice you make, as section 3 explains. We do not use functional or marketing cookies or similar technologies on the website or in the application. In the application we use only strictly necessary cookies, which section 4 describes.
3. What the website sets
3.1 Before you make a choice
When you first open the website, a banner asks whether we may use analytics cookies. Until you choose, the website sets no cookies and uses no local storage, and it loads nothing from other parties’ domains: your browser contacts grantcookie.com, and api.grantcookie.com, which serves the banner. The analytics script stays switched off, so nothing is sent to Google.
If your browser sends Global Privacy Control, the banner treats it as a refusal of analytics cookies and does not ask you: it sets the cookies in section 3.2 to remember the refusal, and we keep a record of it, as for any other choice. You can change it with the cookie button described in section 3.4.
Our privacy policy explains what our servers may record when your browser requests a page or loads the banner.
3.2 Cookies that remember your choice
When you make a choice, the banner sets the cookies below. They are first-party cookies on grantcookie.com, set by GrantCookie. They are strictly necessary: without them the banner could not apply your choice on each page or know when to ask you again, so we do not ask for your consent to them.
| Name | Category | What it does | How long it lasts |
|---|---|---|---|
| gc_consent | Necessary | Stores the choice you made for each category. | 30 days |
| gc_consent_time | Necessary | Stores when you last made a choice, so that the banner knows when to ask again. | 30 days |
| gc_consent_created | Necessary | Stores when you first made a choice. | 30 days |
| gc_consent_renewal | Necessary | Records whether we have since asked everyone to choose again, so that the banner can ask you again if we have. | 30 days |
| gc_consent_id | Necessary | A random identifier that links your choice to the record of it in our consent log. | 365 days |
After 30 days your choice expires and the banner asks you again.
3.3 Analytics cookies, only if you accept them
If you accept analytics cookies, the website loads Google Analytics, a measurement service provided by Google. It sets the cookies below, which are first-party cookies on grantcookie.com.
| Name | Category | What it does | How long it lasts |
|---|---|---|---|
| _ga | Analytics | Used to distinguish users. | 30 days |
| _ga_1J07HQ22RX | Analytics | Used to persist session state. | 30 days |
The descriptions are Google’s. We set both cookies to last 30 days, as long as the choice they depend on, and the website deletes them when that choice expires.
Google Analytics then sends Google information about your visit, such as the pages you open, how you arrived and details of your browser and device, so that we can see, in aggregate, how the website is used. Our privacy policy explains how this data is handled.
The website tells Google not to use this data for advertising: advertising storage and ads personalisation stay switched off, even if you accept every category in the banner, and so does Google signals.
If you refuse analytics cookies, or make no choice, Google Analytics is not loaded and the website sends nothing to Google.
3.4 Changing your choice
After you choose, a round cookie button in the bottom-left corner of every page opens your cookie preferences. You can change or withdraw your choice there at any time, as easily as you gave it. If you withdraw consent to analytics cookies, the website deletes the Google Analytics cookies and stops sending data to Google.
3.5 The newsletter form
The website includes a form for subscribing to our monthly newsletter. When you submit it, you send us the email address you typed. The privacy policy, not this policy, explains how we handle it.
3.6 Links to other sites
Where the website links to another site, the site you arrive at decides what it sets, and this policy no longer applies.
4. What the application sets
4.1 Before you sign in
The login page sets no cookies, and while it loads your browser contacts only app.grantcookie.com.
4.2 After you sign in
Once you sign in, the application sets cookies that are strictly necessary to run it. It uses them for two purposes only: keeping your signed-in session, and protecting the forms you submit.
The table describes these cookies by purpose rather than by technical name, because names can change between releases and the purpose is what tells you whether a cookie is acceptable. Your browser shows the name and exact expiry of each cookie, as section 4.5 explains.
| Purpose | Category | What it does | Set by | How long it lasts |
|---|---|---|---|---|
| Session | Necessary | Identifies your signed-in session, so that the application recognises you on each page without asking you to sign in again. | GrantCookie (first party) | No longer than your signed-in session needs it. Your browser shows the exact expiry. |
| Form protection | Necessary | Lets the application check that a form submitted in your signed-in session comes from you, and not from another website trying to act in your name. | GrantCookie (first party) | No longer than your signed-in session needs it. Your browser shows the exact expiry. |
Session. When you sign in, the application sets a cookie that identifies your signed-in session. On each page you open after that, the application checks the cookie and recognises you. Without it, you would have to sign in again on every page.
Form protection. When you change something in the application, such as your banner settings, you submit a form, and the change reaches us as a request made in your signed-in session. The form protection cookie lets the application check that the request comes from you, so that another website cannot trick your browser into sending a request to the application in your name, a technique known as cross-site request forgery.
4.3 What we do not use in the application
We do not use cookies or similar technologies in the application for analytics, advertising, tracking or profiling, and we do not use them to identify you to any party other than GrantCookie.
4.4 Consent
Where the law requires consent for cookies and similar technologies, it generally exempts those that are strictly necessary to provide a service you have asked for. The cookies described in section 4.2 are in that category: signing in is a request to be kept signed in, and protecting the forms you submit is part of providing that signed-in session securely. We therefore do not ask for your consent to them.
Where these cookies involve personal data, such as the identity of the signed-in account, our privacy policy explains how we use that data and the legal basis we rely on.
You can still block these cookies in your browser, as section 6 explains, but you will not be able to stay signed in to the application if you do.
4.5 Checking this for yourself
You can check what the website and the application set using an ordinary browser. Open the developer tools, find the storage or application view, and look at the cookies and the local storage listed for grantcookie.com and for app.grantcookie.com. The network view shows every domain your browser contacted while loading the page.
On the website, before you make a choice, you will find no cookies and no local storage, and only grantcookie.com and api.grantcookie.com in the network list. After you choose, you will find the cookies in section 3.2 and, only if you accepted analytics cookies, those in section 3.3 and requests to Google. On the login page of the application you will find no cookies, and only app.grantcookie.com in the network list. After you sign in, you will find the cookies that serve the purposes in section 4.2, with their names and expiry dates.
If you find anything else, tell us at privacy@grantcookie.com. We will investigate and correct either the pages or this policy.
5. The banner we provide to customers
Customers use the service to show a consent banner to end users on their own websites. That banner is separate from the website and the application described above, and this policy does not cover it.
The banner runs on the customer’s website, not on ours. The customer chooses which regulations apply, what the copy says and how the banner behaves on a first visit. Depending on the regulations the customer has chosen, the banner asks end users for consent to the cookies the customer’s website sets, or lets them opt out, and it records each choice in the customer’s consent log. Our privacy policy lists what a consent record contains.
Anything the banner stores in an end user’s browser, for example to remember that person’s choice, is stored on the customer’s behalf, and the customer’s own cookie policy is the place that describes it.
If you are reading this because you saw a banner provided by GrantCookie on another website, you are an end user of that website. The cookie policy of that website is the one that applies to you, and the operator of that website is the person to contact. That website decides what it sets and why. GrantCookie holds the consent records for that website on the customer’s behalf, as its processor under our data processing agreement with the customer, which is published at grantcookie.com/dpa/, and acts on them only on the customer’s instructions. Our privacy policy explains how we handle those records and how we can help you.
The service also includes a cookie policy generator, which turns what the scanner found on a customer’s website into text for the customer to review and publish. That text is the customer’s policy and describes the customer’s website. It is not this policy, and this policy does not describe any customer’s website.
6. How to control cookies in your browser
Every mainstream browser lets you see, block and delete cookies and other site data. The exact steps differ by browser and by version, so this section describes what you can do rather than which menu to open. Search your browser’s settings for “cookies” or “site data”, or consult its help pages.
- See what is stored. The privacy or site data settings list the cookies and other data your browser holds, by site. The developer tools show the same information in more detail.
- Delete cookies and site data. You can delete everything at once, or only what is stored for a particular site. Deleting what is stored for app.grantcookie.com signs you out of the application. Deleting what is stored for grantcookie.com removes your choice and any analytics cookies, and the banner asks you again on your next visit.
- Block cookies for one site. Most browsers let you block cookies from a named site while allowing them elsewhere.
- Block third-party cookies. Most browsers let you refuse cookies from any domain other than the one in the address bar, and some do this by default. The cookies described in sections 3 and 4 are first-party, so this setting does not affect them.
- Block all cookies. You can refuse every cookie. The website still works, but the banner cannot remember your choice, so it asks you on each visit, and no analytics cookies are set. You will not be able to stay signed in to the application.
- Use a private or incognito window. Cookies set in such a window are deleted when you close it. If you sign in to the application in such a window, you will be signed out when you close it.
- Do Not Track and Global Privacy Control. Some browsers can send a signal asking sites not to track you, or not to sell or share your personal information. We set analytics cookies on the website only if you accept them in the banner, and we do not use cookies or similar technologies in the application to track you. If your browser sends Global Privacy Control, the banner treats it as a refusal of analytics cookies, as section 3.1 explains. Our privacy policy explains how we handle personal information more generally.
To use the application, allow cookies and site data for app.grantcookie.com.
7. How this policy changes
We review this policy whenever the website or the application changes in a way that affects what it says. The “Last reviewed” date at the top is updated every time we review this policy, including reviews that find nothing to change, so that you can see when we last checked.
If we add a strictly necessary cookie or similar technology to the application, or change the purpose or duration of one described in section 4.2, we update this policy before the change takes effect and tell customers by email to the address on their account.
If we propose to use any other cookie or similar technology that is not strictly necessary, on the website or in the application, we will describe it in this policy first and, where the law requires consent, ask for your consent before it is set. We will ask in plain words, with an option to refuse that is as easy to use as the option to accept, and with no pre-ticked boxes. You will be able to change or withdraw your choice at any time, as easily as you gave it. We added the analytics cookies in section 3.3 in this way.
When this policy changes, we keep the earlier version. If you want to see what it said on a particular date, ask us at privacy@grantcookie.com and we will send it to you.
8. Contact and complaints
For questions about this policy, or about any cookie or similar technology described in it, write to privacy@grantcookie.com. That address also handles other privacy questions, including requests to exercise your rights, our data processing agreement and notices under it, sub-processors and security reviews.
For help with your account, including problems signing in or staying signed in, write to support@grantcookie.com.
We reply within one working day. If a question needs investigation, that reply tells you so. If you are asking to exercise a right over your personal data, section 9 of our privacy policy sets out how long we take to answer.
If you are not satisfied with our answer, you can complain to a supervisory authority, for example the data protection authority in the country where you live or work. Our privacy policy lists the authorities you can contact.