COOKIE POLICY
Last Updated: 22 October 2026
1. Introduction
This Cookie Policy explains how Mark Dodson T/A We Sweep ("We Sweep", "we", "us", "our") uses cookies on the We Sweep platform (the "Platform"). This Policy should be read alongside our Privacy Policy.
2. What Are Cookies?
Cookies are small text files placed on your device by a website or application. They are widely used to make websites and services work efficiently, and to provide information to the operators of the service.
3. Our Approach to Cookies
We Sweep uses only strictly necessary cookies. These cookies are essential for the Platform to function and cannot be switched off. We do not use any analytics, advertising, marketing, or third‑party tracking cookies.
Because all cookies used by the Platform are strictly necessary for the provision of the service, consent is not required under the Privacy and Electronic Communications Regulations 2003 (PECR), Regulation 6.
4. Cookies We Use
| Cookie Name | Purpose | Type | Duration | HttpOnly |
|---|---|---|---|---|
sb-* | Supabase authentication session management. Maintains your logged‑in state across pages. | Strictly necessary | Session | Yes |
wesweep_admin_last_activity | Tracks last activity timestamp to enforce a 30‑minute inactivity timeout for two‑factor authentication on the business admin panel. | Strictly necessary | 4 hours | Yes |
wesweep_admin_session_start | Records when the current business admin login began, to enforce a maximum session length. | Strictly necessary | 4 hours | No |
wesweep_platform_last_activity | Tracks last activity timestamp to enforce a 30‑minute inactivity timeout for two‑factor authentication on the platform admin panel. | Strictly necessary | 4 hours | Yes |
wesweep_platform_session_start | Records when the current platform admin login began, to enforce a maximum session length. | Strictly necessary | 4 hours | No |
wesweep_mfa_verified | Records when two‑factor authentication was last completed on the platform admin panel. | Strictly necessary | 4 hours | No |
wesweep_impersonation_auth | Contains a signed (HMAC) token to securely manage impersonation sessions when platform administrators access a Business User's account for support purposes. | Strictly necessary | Session | Yes |
wesweep_impersonation | Contains display information (business name, administrator name) for the impersonation notification banner shown during support sessions. | Strictly necessary | Session | No |
5. What We Do Not Use
We Sweep does not use:
- Analytics cookies (e.g., Google Analytics)
- Advertising or retargeting cookies
- Social media tracking cookies
- Any third‑party tracking scripts
- Browser fingerprinting or similar tracking technologies (the security check in section 6B reads browser and device information only to tell people from automated programs, never to track you)
6. The Booking Widget
The We Sweep booking widget, which Business Users embed on their own websites, does not itself set any cookies, use local storage, or employ any tracking mechanisms. Where the security check in section 6B is switched on, it runs inside the widget when you send a booking.
6A. Local Storage
In addition to cookies, some parts of the Platform store strictly necessary information in your browser's local storage (data held by your browser on your own device and never sent automatically to our servers):
- Customer portal (the pages where Customers view their bookings and certificates): after you sign in with a magic link, your login session is kept in local storage so you stay signed in between pages. It is removed when you log out.
- Business admin panel: the two‑factor authentication page briefly uses session storage during the verification step; it is cleared when the browser tab closes.
No local storage is used for analytics, advertising, or tracking. As with our cookies, this storage is strictly necessary and exempt from the consent requirement under PECR Regulation 6.
6B. Security Check (Cloudflare Turnstile)
The online booking form and the "Apply to join" form on our website use Cloudflare Turnstile, a security check that tells people from automated programs. It runs in your browser and reads technical information about your browser and device. Cloudflare says it does not read what you type into the form.
- It sets no cookie on our pages or on the booking form. We have not switched on Cloudflare's optional clearance cookie.
- The check runs in a frame served from Cloudflare's own domain. Cloudflare may use its own security cookies there, which its Cookie Policy describes as strictly necessary.
- The check gives the form a one‑time pass that lasts five minutes. We check it with Cloudflare when the form is sent and do not keep it.
This check is strictly necessary to keep the form you are using secure, so consent is not required under PECR Regulation 6. More detail, including Cloudflare's role, is in Section 7 of our Privacy Policy.
7. Managing Cookies
You can control and manage cookies through your browser settings. Most browsers allow you to:
- View what cookies are stored and delete them individually.
- Block cookies from particular sites.
- Block all cookies from being set.
Please note that blocking strictly necessary cookies may prevent the Platform from functioning correctly. You may not be able to log in or use certain features if these cookies are disabled.
Instructions for managing cookies in common browsers:
- Chrome: Settings → Privacy and Security → Cookies
- Firefox: Settings → Privacy & Security → Cookies and Site Data
- Safari: Preferences → Privacy → Manage Website Data
- Edge: Settings → Cookies and site permissions → Cookies
8. Changes to This Policy
We may update this Cookie Policy from time to time. Material changes will be notified via email or dashboard notification. The "Last Updated" date at the top of this page indicates when the Policy was last revised.
9. Contact
If you have questions about our use of cookies, please contact:
Mark Dodson Email: management@we-sweep.co.uk Address: Lower Moorlands, Sherburn‑in‑Elmet, LS25 6DN