Cookie Policy
Last updated: 14 October 2026
1. What cookies are
Cookies are small files stored on your device by your browser. Some are needed to make a website work at all; others are optional and help us understand how the site is used.
Under PECR we may set strictly necessary cookies without asking. Anything else — including analytics — requires your consent first, and we do not load it until you give that consent.
2. Strictly necessary cookies
These keep you signed in and protect the service. They cannot be turned off, because the portal will not function without them.
| Cookie | Provider | Purpose | Expiry |
|---|---|---|---|
| sb-<project>-auth-token | Supabase (via CuraFlow) | Keeps you signed in across the CuraFlow suite. Set on .curaflow.net so a single sign-in covers Policies, Compliance, Care and Registration. | Session / until sign-out |
| cf_consent | CuraFlow | Remembers the cookie choice you made on this banner, so we do not ask again on every page. | 6 months |
3. Analytics cookies (optional)
These load onlyif you choose “Accept all”. If you choose “Essential only”, the scripts are never sent to your browser at all.
| Cookie | Provider | Purpose | Expiry |
|---|---|---|---|
| Vercel Web Analytics | Vercel Inc. | Aggregated page-view counts, so we can see which pages are useful. No cross-site tracking and no advertising profile. | 24 hours |
| Vercel Speed Insights | Vercel Inc. | Measures real-world page load performance so we can fix slow pages. | 24 hours |
| _ga, _ga_<container-id> | Google Analytics 4 (Google Ireland Limited) | Distinguishes returning visitors and groups their page views into a session, so we can see which pages bring people to CuraFlow. Advertising features and Google Signals are switched off, so these are not used to build an advertising profile or to follow you across other sites. | Up to 2 years |
| cf_ft | CuraFlow (first party) | Remembers the first page of your visit and the website that sent you (for example a search engine or an AI assistant), so that if you later contact us, request a sample or buy, we know which of our pages and channels led to it. It holds no personal details and is not shared with anyone. | 30 days |
4. Similar technologies
We also use your browser’s local and session storage for two strictly necessary conveniences: remembering that you dismissed the WhatsApp greeting, and remembering that you dismissed a promotional notice. These stay on your device and are never sent to us. If you have accepted analytics, session storage also notes that a purchase has already been counted, so reloading the thank-you page does not count it twice.
5. Changing your mind
Withdrawing consent is as easy as giving it. Use the button below, or the “Cookie settings” link in the footer of any page. Your choice applies across the whole CuraFlow suite.
You can also block or delete cookies in your browser settings, though the portal will not keep you signed in if you block the necessary ones.
6. Complaints
If you are unhappy with how we handle cookies or personal data you can complain to the Information Commissioner’s Office at ico.org.uk. We would appreciate the chance to put things right first — contact us at curacompliance@gmail.com.