Cookies notice.
What we set on your device, why, and how to switch the optional ones off. Written under the UK Privacy and Electronic Communications Regulations (PECR).
The short version.
We set a small group of strictly necessary cookies (login, security, your cookie choice). With your permission we also load Google Tag Manager, which in turn loads Google Analytics 4 and Meta Pixel. Analytics and advertising cookies never load until you accept them via the cookie banner. You can change your mind at any time from the Cookie preferences link in the footer.
Strictly necessary cookies.
These don't require consent because the site can't work without them.
- Supabase Auth cookies (
sb-access-tokenandsb-refresh-token), keep you signed in to the client portal between visits. Expire on sign-out or after a period of inactivity. - CSRF token, a small random value that stops a different website tricking your browser into submitting forms on this one. Set per session.
- Consent state (
tpc_consent), a small cookie that records your cookie banner choice so we don't ask on every page. Set only when you make a choice. Lasts 12 months.
Analytics.
These cookies are optional. They never load until you accept them via the cookie banner, and you can change your mind from the Cookie preferences link in the footer. If you say no, you'll see exactly the same site, just without us counting your visit.
- Google Tag Manager (container ID
GTM-PNSFHSQ2), the loader that fires the analytics and advertising tags below. Loads ONLY after you accept cookies via the banner. - Google Analytics 4, fired through Google Tag Manager. Counts page views and helps us see which pages bring real enquiries.
- Meta Pixel (sometimes called the Facebook Pixel), fired through Google Tag Manager. Measures which adverts result in a real enquiry so we can stop running the ones that don't.
Third-party cookies through Stripe.
When you pay an invoice, you're passed to Stripe's hosted checkout. Stripe sets its own cookies to keep the payment secure, run its fraud-prevention tools, and remember you between steps. Those cookies are governed by Stripe's own cookies policy. They're essential to processing the payment, without them, you can't check out.
How to control cookies.
You have two routes:
- The cookie banner, lets you accept all, reject all, or pick categories from the Customise option. You can change your mind any time from the Cookie preferences link in the footer.
- Your browser settings - every modern browser lets you block or delete cookies, including for a specific site. The trade-off is that strictly-necessary cookies are, well, necessary. Block them and you won't be able to log in to the client portal.
Mobile devices have their own ad-tracking settings, on iOS, in Settings → Privacy & Security; on Android, in Settings → Privacy → Ads. These apply across apps, not just this site.
How this relates to your data.
Cookies are only one way data ends up with us. Everything we hold, including any data created when you accept cookies, is described in the privacy notice. Your rights (access, erasure, objection, the rest) apply there.
Changes.
We'll update this notice whenever we add or remove a cookie category. The date at the top of the page reflects the most recent change. This version was published on 5 June 2026.
Questions.
Email hello@theplancompany.co.uk and we'll come back to you.