Cookie Policy
Last updated: [TO CONFIRM: date of publication]. Applies to www.tulip-tech.com. Nothing optional is stored on your device until you choose it.
What this policy covers
This explains what we store on your device when you visit our website, why, and how you control it.
We use the word "cookies" throughout because it is familiar, but this policy covers all storage on your device: cookies, local storage and similar technologies. They are treated identically here and under UK law.
TulipTech Ltd is the data controller. Our Privacy Policy covers what we do with personal data more broadly; this document is specifically about your device.
Your choices
When you first visit, a banner asks what you are willing to accept. Nothing optional is stored until you choose. If you close the page without choosing, nothing optional is stored at all.
There are four categories. Only the first is always on.
| Category | Always on? | What it does |
|---|---|---|
| Necessary | Yes | Makes the site work and keeps it secure |
| Functional | No | Remembers things and enables the live chat |
| Analytics | No | Tells us how the site is used |
| Marketing | No | Measures our advertising and lets us show you ads elsewhere |
To change your mind at any time, use the Cookie settings link in the footer of any page. Your current choices load in, and you can change any of them. Clearing your browser data also resets everything.
We ask again after 180 days, so a choice you made six months ago does not follow you indefinitely.
Necessary
These are set without asking, because the site cannot work or stay secure without them. UK law does not require consent for these.
| Name | Set by | Type | Purpose | Expires |
|---|---|---|---|---|
tt-consent | TulipTech | Local storage | Records which categories you accepted. Contains only your choices, a version number and a timestamp. No identifier, nothing that can track you. | Kept until you clear your browser data, and treated as expired after 180 days |
_calendly_session | Calendly | Cookie | Runs the booking calendar on our contact page. Only set if you open the calendar, because the page loads a placeholder until you click it. | 21 days |
cal_anonymous_id | Calendly | Cookie | Calendly's own anonymous identifier for the booking widget. Set only if you open the calendar. | 1 year |
__cf_bm, _cfuvid | Cloudflare, on calendly.com | Cookie | Cloudflare's bot protection for Calendly's own service. Set only if you open the calendar. | 30 minutes / session |
| Cloudflare Turnstile storage | Cloudflare | [TO CONFIRM] | Distinguishes real visitors from automated bots on our contact form, so we are not flooded with spam submissions. | [TO CONFIRM] |
Functional
Only set if you accept Functional.
| Name | Set by | Type | Purpose | Expires |
|---|---|---|---|---|
session_id | Odoo (erp.tulip-tech.app) | Cookie | Runs our live chat widget | 7 days |
frontend_lang | Odoo | Cookie | Remembers your language in the chat | 1 year |
cids | Odoo | Cookie | Chat channel state | [TO CONFIRM] |
im_livechat_* | Odoo | Cookie / local storage | Your chat history, which advisor you spoke to last, and whether the chat has already popped up | [TO CONFIRM] |
presence.focus, presence.lastPresence | Odoo | Local storage | Whether the chat window is in view | Session |
Decline Functional and the live chat does not load at all. No chat scripts run and nothing is stored. You can still reach us by the contact form, email or phone.
Analytics
Only set if you accept Analytics. We use two tools, and they do different things.
Google Analytics 4
Counts visits and tells us which pages are used. It does not record your screen.
| Name | Type | Purpose | Expires |
|---|---|---|---|
_ga | Cookie | Distinguishes one browser from another | 2 years |
_ga_5WXYHKBEY0 | Cookie | Keeps track of your current visit | 2 years |
Microsoft Clarity
This one deserves a plain explanation, because it does more than counting.
Clarity records a replayable session recording of how you use our pages, covering mouse movement, scrolling, clicks and the timing of typing, and builds heatmaps from it. We use it to find parts of the site that confuse people.
Text you type into forms can be captured unless masking is configured to exclude it. We use Clarity's masking settings to keep form text out of recordings.
Clarity also sets Microsoft advertising identifiers, including MUID on clarity.ms and bing.com. These can be used to recognise the same browser on other sites in Microsoft's advertising network. That is why Clarity requires your consent and why we describe it here rather than filing it under simple analytics.
| Name | Host | Purpose | Expires |
|---|---|---|---|
_clck | tulip-tech.com | Identifies your browser to Clarity | 1 year |
_clsk | tulip-tech.com | Joins your pages into one recording | 1 day |
CLID | clarity.ms | Identifies your browser at Microsoft | 1 year |
MUID | clarity.ms, bing.com | Microsoft advertising identifier | About 390 days |
ANONCHK, SM, MR, SRM_B | clarity.ms, bing.com | Microsoft analytics and advertising | 1 day to about 390 days |
Marketing
Only set if you accept Marketing.
We advertise on Google and Meta, and we use these to measure whether that advertising works and to show ads to people who have visited us before. That includes showing you our ads on other websites. If you would rather that did not happen, decline Marketing.
Our own attribution
| Name | Type | Purpose | Expires |
|---|---|---|---|
tt-attr | Cookie | Records which campaign brought you here, and the advertising click identifier if there was one (gclid, gbraid, wbraid, fbclid). Sent with your enquiry if you submit the contact form. | 90 days |
tt-attr is not written without Marketing consent, and it is deleted if you later withdraw it.
Google Ads
| Name | Host | Purpose | Expires |
|---|---|---|---|
_gcl_au | tulip-tech.com | Links an ad click to what you do on our site | 90 days |
_gcl_aw | tulip-tech.com | Stores a Google Ads click ID. Only set if you arrived from an ad. | 90 days |
_gcl_gb | tulip-tech.com | Stores click IDs from ads in apps | 90 days |
_gcl_dc | tulip-tech.com | Stores a display advertising click ID | 90 days |
IDE, test_cookie | doubleclick.net | Ad targeting and remarketing | 15 minutes to about 13 months |
NID, AEC | google.com | Google account preferences and abuse prevention | About 6 months |
Meta (Facebook and Instagram)
| Name | Host | Purpose | Expires |
|---|---|---|---|
_fbp | tulip-tech.com | Identifies your browser to Meta | 90 days |
_fbc | tulip-tech.com | Stores a Meta click ID. Only set if you arrived from a Meta ad. | 90 days |
fr | facebook.com | Meta ad targeting | 90 days |
We also send Meta a record of enquiries from our own server, with your email address encrypted so Meta cannot read it, so that we can tell which ads produce real business. This only happens if you accept Marketing, and it sets nothing on your device.
Third parties we contact but who store nothing
Worth naming because your browser does connect to them.
- JW Player (
cdn.jwplayer.com) hosts the client story video on our homepage. The video file loads from there when you press play; the still image you see before that is served from our own site. No player script, no cookies. - Vimeo (
player.vimeo.com) hosts video on our About page. Loaded in do-not-track mode and only when you click play, so Vimeo sets no tracking cookies. - Google Tag Manager (
googletagmanager.com) loads the tools listed above according to your choices. Sets no cookies itself. - Google Fonts: our typeface is served from our own site, not from Google. No request reaches Google and no cookie is set.
What happens if you decline everything
The site works normally. You can browse every page, submit the contact form and book a call.
What changes: the live chat does not appear, we cannot see how you used the site, and we cannot tell whether an advertisement brought you here. Nothing optional is stored on your device.
Google's own tools are told your choice, and they operate in a restricted mode that does not store anything on your device. That gives us anonymous, aggregated figures only, with nothing tied to you.
Global Privacy Control
Some browsers, including Brave, DuckDuckGo and Firefox, can send an automatic signal that you do not want your data used for advertising. If we detect that signal, we treat it as declining Marketing before the banner even appears, and Accept all will not switch Marketing on. You can still turn it on yourself under Manage preferences if you want to.
Beyond your browser
Three things worth saying plainly, because they go further than a cookie.
Enquiry attribution. If you accept Marketing and then submit our contact form, the campaign information in tt-attr is saved alongside your enquiry in our CRM. It becomes part of your enquiry record rather than just a cookie, and is kept for [TO CONFIRM: CRM retention period].
Advertising click identifiers. Where an enquiry becomes a customer, we send the original advertising click identifier back to Google Ads so it can learn which advertising works. This carries no name, no email address and no contact details, only the click identifier, the date and the value.
Consent records. We keep a record of consent choices so we can show what was agreed and when. It holds your choices, the time, the version of this policy in force, and a one-way encrypted value derived from your IP address and browser, not the IP address itself. Kept for 24 months, stored by Neon, our database provider.
Contact
Questions about this policy, or a request about your data: info@tulip-tech.com
TulipTech Ltd, Leicester, United Kingdom