Cookies

Certified in the Claude Partner Network Microsoft Solutions Partner ISO 27001 ISO 9001 Independent since 1999

Last updated 16 October 2026

Not ready to publish

This page is a draft. The points below are unverified, so they are flagged rather than filled in with a guess. Each one needs confirming before this page goes live.

The Google Analytics 4 measurement id, still blank in hugo.toml. Until it is set, no banner appears and no analytics cookie gets set, so the Analytics section below describes nothing that is live. Paste the real id in to switch it on.
The Matomo URL and site id, both still blank in hugo.toml. Until they are set, our own analytics is not running either, and the opt-out control at the foot of this page does not render.
IP masking in the Matomo admin, under Privacy then Anonymise data, set to mask at least 2 bytes. The no-permission position below depends on it. Leave the IP unmasked and this page is making a claim that is not true.
Heatmaps and session recording staying switched off in Matomo. Both store data on the device, which would put our own analytics straight back behind the consent panel.
How long visit data is kept in Matomo, stated as 14 months below. Set it under Privacy then Anonymise data, and correct the figure here if you choose differently.

This page lists the cookies this site uses, who sets them and what they are for. Our privacy page covers everything else we do with data.

The short version

This site needs no cookies at all to work. Every cookie listed below is optional, apart from the one that records your answer, and nothing optional is set until you say yes.

We do count visits, using our own analytics that sets no cookies at all. That one runs without asking, for the reasons set out in the next section, and you can still switch it off at the bottom of this page.

We ask once, through a panel at the bottom of the page. Accept all and Reject all sit next to each other as the same size button, because refusing should be no harder than agreeing. You can change your mind at any time using Cookie settings in the footer.

If you reject, we do not load Google Analytics at all. Your browser never fetches it, nothing on the list below is set, and Google hears nothing from your browser.

We run Matomo on our own servers to see how the site is used. It is configured to store nothing whatsoever on your device: no cookies, no local storage, nothing to clear afterwards.

That is why it is not in the panel. The law that governs cookie banners is about storing or reading information on your device, and this stores nothing, so there is nothing to ask you about. It still counts as processing your data, and for that we rely on legitimate interests.

Legitimate interests is not a free pass, so this is what we hold ourselves to:

Your IP address is masked before it is stored, so it does not identify you.
It is on our own servers. The requests go to us, not to an analytics company, and nothing leaves the UK.
It does not follow you. There is no tracking across other websites, no advertising use, and no linking this to anything else we hold about you.
We do not share or sell it. Nobody else gets it.
We delete it after 14 months.
We respect Do Not Track. If your browser sends that signal, we do not count you at all.
You can opt out in one click at the bottom of this page, and we will remember your choice.

Without cookies, Matomo spots a returning browser by a short-lived technical fingerprint made from your IP address and browser configuration. The fingerprint changes daily. It is deliberately less precise than a cookie. We would rather have rougher numbers than track you.

How we group the cookies

Necessary. One cookie, which remembers the choice you just made. It has to be allowed, because it is what records that you said no.

Analytics. How people find the site and move through it, so we can make it better. One platform, Google Analytics 4.

There is no advertising category, because we run no advertising measurement on this site. The advertising section below says what happens if that changes.

Necessary

cdn_consent Set by us, on cardonet.ai. Stores what you agreed to, when you agreed and which version of these categories applied. We ask again after about six months. If we change the categories or add a platform, we ask again immediately, because agreeing to the old list is not agreeing to a new one.

Analytics

Google Analytics 4 is run by Google. It gives a fuller picture of how the site is used than our own cookieless analytics can. Nothing is fetched from Google until you tick Analytics. When you do, our page loads it directly, with no tag manager in between, and with Google signals and the advertising features switched off in our configuration, so the data serves our visit statistics and not advertising audiences.

_ga Distinguishes one browser from another. Two years.
_ga_ followed by our measurement id. Keeps track of the current visit. Two years.

Both are set on cardonet.ai. When you withdraw consent we delete them ourselves and reload the page without Google Analytics. Nothing is set on another company's domain, so there is nothing we cannot reach.

Our own Matomo sets no cookies and so appears nowhere on this list. It is covered in the section above.

Advertising

None. We run no advertising measurement on this site, so there is no Advertising box in the panel and no advertising cookie on this page. If that changes, we will list each company here, say what it sets and for how long, and the panel will ask you again before anything new is set.

Sending data outside the UK

Google is a United States company, and agreeing to the analytics cookies means data about your visit reaching it there. Where that happens we rely on the UK International Data Transfer Agreement, the UK Addendum to the EU standard contractual clauses, or the UK-US data bridge where the receiving company is certified under it.

That is one of the reasons the analytics cookies are optional and switched off by default.

Our own analytics is the exception. Matomo runs on our servers, so that data does not leave the UK and no transfer safeguard is needed for it.

Changing your mind

Use Cookie settings in the footer of any page. You can also block or delete cookies in your browser. If you turn off cookies entirely, this site still works, because none of them are needed to read it.

Do Not Track and Global Privacy Control

Our own analytics respects Do Not Track. Send that signal and we do not count you, with no further action needed from you.

For Google Analytics, the signals make no difference, because it is switched off until you turn it on. There is nothing for a Do Not Track header to protect you from when the default is already no.

Questions

Email hello@cardonet.com.