Cookie Policy
Last updated · 21 August 2026
This Cookie Policy explains how ClientLoop uses cookies and similar technologies (such as local storage) on the marketing website at clientloop.digital, the application at app.clientloop.digital, workspace subdomains, custom workspace domains and client portals.
ClientLoop is a trading name of Pleesys Technology Limited (company number 17350856, registered office 11 Rosemary Court, York, England, YO1 9UQ). This policy should be read together with our Privacy Policy.
1. What cookies are
Cookies are small text files that a website stores on your device. Local storage is a similar browser feature that stores small amounts of data without sending it to the server on every request. Both help a site remember who you are, keep you signed in, and — where you allow it — understand how the site is used.
2. Our approach
- We use no advertising, marketing or cross-site tracking cookies anywhere.
- On the marketing website, analytics run only after you opt in through the cookie banner. Until then, nothing beyond strictly necessary storage is used.
- In the application and client portals, we set only strictly necessary cookies, plus Vercel’s measurement components, which their provider states operate without cookies.
3. Cookies and storage on the marketing website (clientloop.digital)
| Name | Type | Purpose | Duration | How to control |
|---|---|---|---|---|
clientloop_consent_v1 (local storage) |
Strictly necessary | Remembers your cookie choice so we do not ask again and analytics stay off if you declined | 365 days, then we ask again | Clear browser data; choice can be changed any time via the Cookies control in the footer |
ph_* (first-party cookies set by PostHog) |
Analytics | Aggregate usage measurement via PostHog (EU region) — set only after you opt in | Up to 365 days | Decline or withdraw consent via the footer Cookies control (withdrawal also deletes these cookies), or block/delete in browser settings |
| Cloudflare Web Analytics | Analytics | Aggregate, privacy-focused page measurement — loaded only after you opt in; Cloudflare states its beacon is cookieless | No cookie set | Decline or withdraw consent via the footer Cookies control |
__cf_bm and similar Cloudflare cookies |
Strictly necessary | Our marketing website is hosted and delivered by Cloudflare, which may set short-lived cookies to distinguish real visitors from automated traffic and to keep the site available | Typically 30 minutes | Required for the site to be served securely; can be cleared in browser settings |
Our marketing website is hosted on Cloudflare Pages and the application is hosted on Vercel. PostHog is configured to respect the browser Do Not Track signal and to create person profiles only for identified users; we do not identify marketing-site visitors.
4. Cookies and storage in the application (app.clientloop.digital, workspace subdomains and custom domains)
These cookies are strictly necessary — the application cannot work without them, so they are not subject to a consent choice.
| Name | Type | Purpose | Duration | How to control |
|---|---|---|---|---|
__Secure-authjs.session-token |
Strictly necessary | Keeps a Team Member signed in; set across ClientLoop subdomains so one session works throughout the Service | Up to 30 days | Sign out, or clear browser cookies (you will be signed out) |
__Host-authjs.csrf-token |
Strictly necessary | Protects sign-in and account actions against cross-site request forgery | Browser session | Required for security; clearing it signs you out of the flow |
__Secure-authjs.callback-url |
Strictly necessary | Remembers where to return you after signing in | Browser session | Clear browser cookies |
portal_session |
Strictly necessary | Signed session for a Client using a portal after following a magic link | 12 hours | Close the session by clearing cookies; a new magic link creates a new session |
theme (local storage) |
Functional | Remembers your light/dark display preference | Until cleared | Clear browser data |
| Demo workspace state (local storage) | Functional | If you try the interactive demo, the sample workspace you create is kept in your own browser so it survives a page refresh. It never reaches our servers | Until cleared or the demo is reset | Reset the demo, or clear browser data |
On connections that are not HTTPS (local development only), the __Secure-/__Host- prefixes are omitted.
Vercel Web Analytics and Speed Insights run on application pages to measure service usage and performance. Vercel states these components do not use cookies and do not track visitors across sites. They are first-party measurement, never advertising.
Support chat (Tawk.to). Where the in-application support chat is enabled in our deployment, the Tawk.to widget loads on team dashboard pages only — never on client portals — and may set its own cookies (typically prefixed twk_ or TawkConnectionTime) to keep your chat session. See Tawk.to’s privacy policy.
5. Third parties
The third parties that may process data through the technologies above are:
| Provider | Role | Their policy |
|---|---|---|
| PostHog (EU) | Marketing-site analytics, only after consent | posthog.com/privacy |
| Cloudflare | Marketing-site analytics, only after consent | cloudflare.com/privacypolicy |
| Vercel | Application hosting and cookieless measurement | vercel.com/legal/privacy-policy |
| Tawk.to | In-application support chat, where enabled | tawk.to/privacy-policy |
We do not allow any of these providers to use data collected through our sites for their own advertising.
6. How to manage cookies
- Cookie banner and settings: on the marketing website, use the banner shown on your first visit, or the Cookies control in the footer at any time, to grant or withdraw analytics consent. Withdrawing consent stops future analytics and removes the PostHog cookies.
- Browser settings: you can block or delete cookies in your browser — see instructions for Chrome, Firefox, Safari and Edge.
- Effect of blocking: blocking the strictly necessary cookies listed in Section 4 will prevent sign-in, client portal access and other core parts of the Service from working.
7. Do Not Track and Global Privacy Control
Our marketing-site analytics tool respects the browser Do Not Track signal, and analytics never run without your opt-in consent in any case. Because we do not sell personal information or share it for cross-context behavioural advertising, there is no sale or sharing for signals such as Global Privacy Control to opt out of. Beyond this, the Service does not respond to Do Not Track signals, as no uniform standard has been adopted.
8. Changes to this policy
We may update this policy when the cookies or technologies we use change. We will update the date above; material changes will be reflected in the cookie banner where consent is affected.
9. Contact
Questions about this policy: info@clientloop.digital, or write to Pleesys Technology Limited, 11 Rosemary Court, York, England, YO1 9UQ.