Cookie Policy
Last updated: 13 October 2026
1. About this policy
1.1 This policy explains the cookies and similar technologies that CERTSYNC LIMITED (“CertSync”, “we”) uses on certsync.co.uk and in the CertSync app, why we use them, how long they last, and how you can control them. We are the controller of the information they collect. Our full contact details are in clause 2 of our Privacy Notice, which you should read with this policy.
1.2 “Cookies” here means small files stored by your browser, and also other ways of storing information on your device, such as local storage, session storage and on-device databases.
2. The law and your consent
2.1 Regulation 6 of the Privacy and Electronic Communications Regulations 2003 (“PECR”) says we may only store or read information on your device with your consent, unless an exception in Schedule A1 to PECR applies. The exception we rely on is the one for storage that is strictly necessary to provide a service you have asked for (Schedule A1, paragraph 4). It covers keeping you signed in, security, preventing fraud and faults, and remembering choices and information you enter.
2.2 For everything else we ask for your consent first, including analytics. We do not rely on the exceptions for statistics or for the appearance of the website. Where a cookie collects personal data, your consent is also our lawful basis under Article 6(1)(a) of the UK GDPR. You can withdraw it at any time (clause 6).
3. The cookies we use
3.1 We group cookies into four categories. Only strictly necessary cookies are used without your consent. Durations are the longest a cookie lasts; many are removed sooner.
3.2 Strictly necessary cookies (always on)
| Name | What it does | Lasts |
|---|---|---|
authjs.session-token (__Secure- prefix on the live site) | Keeps you signed in. | 7 days (Admin sessions end after 24 hours) |
| authjs.csrf-token, authjs.callback-url | Protect sign-in against forged requests and return you to the right page afterwards. | Until you close the browser |
| csrf-token | Protects actions such as saving a certificate against forged requests. | 8 hours |
| certsync_reg_bind | Links your email-verification link to the browser you registered on, so only you are signed in automatically. | 24 hours |
| certsync_device | Recognises a browser you have marked as trusted. | 30 days |
| certsync_mfa_verified_… | Records that this browser passed a sign-in code check for one account, so you are not asked every time. | 30 days |
| certsync_uid | Keeps each person's offline data separate on a shared device. Removed when you sign out. | 30 days |
| certsync_shared_files | Passes files you share to CertSync from another app on your device into the dashboard. | 10 minutes |
| cs_verify_<certificate> | Unlocks one certificate on the public verification page after the correct postcode is entered. | 5 minutes |
| site_access | Used only by CertSync staff and authorised testers, on a password-protected test version of the site. Never set for customers or visitors. | 24 hours |
| internal_admin_session | Used only by CertSync staff, to sign in to our internal admin tool. Never set for customers or visitors. | 8 hours |
| cookie-consent (local storage) | Remembers your cookie choices. | 6 months |
3.3 Analytics cookies (only with your consent)
| Name | Provider | What it does | Lasts |
|---|---|---|---|
| _ga | Google Analytics | Tells visits from the same browser apart. | 2 years |
| _ga_<id> | Google Analytics | Keeps track of the current visit. | 2 years |
| certsync_attribution_v1 (local storage) | CertSync | Records how you reached us: campaign tags in the link, the referring website and the first page you saw. If you sign up, it is saved with your account so we can see which channels lead to sign-ups. Also set if you consent only to marketing cookies. | 90 days |
| sentryReplaySession (session storage) | Sentry | Marks a session recording of the signed-in dashboard, used to find faults. Text, form entries and images are masked. | Until you close the tab |
3.3.1 With your consent we also load Vercel Web Analytics, which counts page views without setting cookies, and Vercel Speed Insights, which measures how fast pages load.
3.4 Marketing cookies (only with your consent)
| Name | Provider | What it does | Lasts |
|---|---|---|---|
| _gcl_au | Google Ads | Measures sign-ups that follow a Google ad. | 90 days |
| _gcl_aw | Google Ads | Records that you arrived by clicking a Google ad. Set only after such a click. | 90 days |
3.4.1 When you complete sign-up, the Google Ads tag reports one conversion to Google, with an opaque payment reference so it is not counted twice. We do not send your name, email address, account or certificate details, and ad personalisation is switched off. A session-storage marker stops the same tab reporting it again. We do not use the Meta (Facebook) Pixel; if that changes we will update this policy and ask for your consent first.
3.5 Preference cookies
We do not currently use any. The Preferences switch in the cookie banner is there so you can decide in advance; it has no effect today.
3.6 Other storage on your device (strictly necessary)
- Offline working: an encrypted on-device database holding your drafts, cached certificates and customers, queued photos and changes waiting to sync. Signing out from the More menu removes it.
- Information you entered: the last client and site details you used, so they can be offered on your next certificate (7 days, removed when you sign out), and short-lived copies of form entries while you work.
- Settings and progress: choices you make in the app, such as dismissed tips, completed guides, layout and view settings, language and time zone, and whether the app is installed.
- Offline pages and notifications: the site installs a service worker that keeps cached copies of pages so it can work offline. If you allow notifications, your browser also stores a push subscription.
- Keeping things working: a device identifier for editing a certificate on more than one device, sign-in checks in progress, and markers that keep offline copies up to date.
None of this is used for advertising or shared with anyone. The CertSync mobile app uses only strictly necessary storage: it has no analytics or marketing cookies.
4. Other companies
4.1 Google (Google Ireland Limited) provides Google Analytics and Google Ads. Google uses your IP address only to estimate a rough location and does not store it. We switch off Google Signals and ad personalisation. Google Ads acts as an independent controller of the data its tag collects.
4.2 Vercel Inc. hosts the site and provides the analytics in clause 3.3.1. Sentry provides error monitoring on every page without cookies; its session recording (clause 3.3) runs only with your analytics consent.
4.3 When you pay, Stripe sets its own cookies on Stripe's pages under Stripe's cookie policy. We cannot read or remove them.
4.4 Each provider's role, location and transfer safeguards are listed on our sub-processors page.
5. How we ask for consent
5.1 On your first visit a banner offers “Accept All”, “Reject Non-Essential” and “Customise”. Accepting and rejecting are equally easy.
5.2 “Customise” opens a panel where you can switch each category on or off and save your choice. Pressing it again closes the panel without changing anything.
5.3 Until you choose, only strictly necessary cookies are used and no analytics or advertising script is loaded. The site works fully if you reject everything.
5.4 We record your choice and when you made it, with the version of our consent banner. We ask again after six months, and sooner if we change what we ask you to agree to.
6. Changing your mind
6.1 You can withdraw or change your consent at any time, and it is as easy as giving it. On the website, use the controls at the top of this page: “Withdraw All Consent” switches analytics and marketing off straight away and deletes the Google Analytics and Google Ads cookies on this site; “Manage Preferences” shows the banner again so you can choose afresh.
6.2 You can also block or delete cookies in your browser settings, but blocking strictly necessary cookies will stop sign-in working. We do not currently act on Global Privacy Control or Do Not Track signals, so please use the controls above.
6.3 Withdrawing consent does not affect what was collected before. Analytics data already sent is kept by the provider under its own retention rules.
7. Changes to this policy
7.1 The date at the top shows when this policy last changed. If we add a new category of cookie or a new provider, we will tell customers by email and ask for consent again where it is needed. Earlier versions are available on request.
8. Contact and complaints
8.1 Questions about this policy, or requests about your data, go to our privacy team:
Privacy Team
Email: privacy@certsync.co.uk
Post: CERTSYNC LIMITED (Company No. 17216573), at the registered office shown in the website footer.
8.2 You can also complain to the Information Commission (the ICO), the UK data protection regulator, at ico.org.uk, at any time.