Cookie policy

1. Who we are and what this policy covers

Kalotect Ltd, trading as Kalotect, is a company registered in England and Wales with company number 17517329. Its registered office is at Lambourne House, London Road, Riverhead, Sevenoaks TN13 2DE. In this policy it is “we”, “us” or “our”. We decide what our pages store on and read from your device, so we are responsible for it.

This policy covers three places:

• our public website at kalotect.com;
• the client portal at portal.kalotect.com, where our clients sign agreements, approve work, answer our questions and see their Ledger; and
• our staff console at console.kalotect.com, where the people who work for us run the studio.

Each of these addresses keeps its own cookies. A cookie set on one is not sent to the others, so signing in to the portal does not sign you in anywhere else.

This policy does not cover the websites we build for our clients. Each of those has its own cookie notice, published by the client whose site it is.

Our privacy notice explains what personal data we hold about you, why, for how long and your rights over it. This policy explains what is stored on, or read from, the device you use to visit us.

2. Cookies and similar technologies

A cookie is a small piece of text a website asks your browser to keep and send back on later visits. Browsers can also keep information for a site in local storage, which stays until it is cleared, and in session storage, which is cleared when you close the tab. A script on a page can also read details of your browser and device, such as its type and screen size, and an image in an email can report that the email was opened.

The law treats all of these in the same way as cookies, and so does this policy. Where we say “cookie” below, we mean any of them.

3. The rules we follow

Regulation 6 of the Privacy and Electronic Communications Regulations 2003, as amended by the Data (Use and Access) Act 2025, sets the rules in the United Kingdom. A site may store information on your device, or read information from it, only if you have consented, or if one of the exceptions in the regulations applies. We rely on these exceptions:

• Strictly necessary. The storage is strictly necessary to provide a service you have asked for, including keeping it secure, checking that you are who you say you are, and keeping what you have entered into a form.
• Appearance and preferences. The storage lets the site look or work the way you have chosen. We must tell you about it and give you a simple way to object.
• Statistics. The storage collects information about how the site is used, so that we can improve it. We must tell you clearly, give you a simple way to object that costs nothing, and use the information only for that purpose. A provider that helps us may use it only on our behalf.

Advertising, anything that tracks you from site to site, and anything a third party stores for its own purposes fall outside every exception and always need your consent first. Our own pages do none of these.

Where a cookie involves your personal data, the UK GDPR applies as well, and our privacy notice gives the lawful basis we rely on.

We follow the UK rules. Wherever you are, the opt-out described under “Counting visits” stops counting.

4. Cookies that make the service work

These are strictly necessary for something you have asked us to do. Without them, signing in or finishing a brief would not work.

• kalotect_session. A cookie that keeps you signed in to the portal or the console. It is set on whichever of our addresses you sign in to. It holds a random token, marked with how you signed in: with a passkey or with an email link. On our side we keep a SHA-256 hash of the token, never the token itself, so a copy of our database could not be used to sign in as you. With the hash we keep the time, the connection address and the browser you signed in from, so that we can look into a sign-in you do not recognise. Scripts on the page cannot read the cookie, and it is sent only over a secure connection. After a sign-in with an email link it lasts twelve hours. After a sign-in with a passkey the cookie lasts up to thirty days, and the sign-in behind it ends after twelve hours without use. Signing out deletes it. Consent: not needed, because signing you in and keeping your account secure is strictly necessary for the service you asked for.
• kalotect_brief. A cookie set when you start a brief on our website, and set again each time you save an answer or follow the link in our email back to your brief. It holds only the token for your brief, so that you can come back and carry on where you left off. Scripts on the page cannot read it. It lasts thirty days from the last time it was set, and a brief you have not completed is deleted thirty days after your last answer. After you finish, it lets this browser show you the confirmation page with your answers until it expires, so clear it if you share the device. Consent: not needed, because keeping what you have entered into a form, and showing it back to you, is strictly necessary for the brief you asked to complete.

One more cookie belongs with signing in, although signing in works without it:

• kalotect_passkey_offered. A cookie set the first time you sign in on a device with an email link, or accept an invitation, while you have no passkey. It records only that we have offered to set one up on that device, so that we offer once and do not keep asking. Scripts on the page cannot read it. It lasts one year. Consent: we treat it as part of keeping your account secure, because it belongs to setting up passkey sign-in and records nothing else about you. If you would rather not have it, delete it in your browser: the only effect is that we offer a passkey again after your next sign-in with an email link.

When you create a passkey, your device or password manager stores it at your request. We hold only the public part of it, which cannot be used to sign in on its own.

5. Choices we remember for you

These remember a choice you have made about how our pages look or work. Each is set only when you make that choice.

• kalotect-theme. Set only when you press the switch between the light and dark themes in the header of our public pages. If you never press it, nothing is stored and our pages follow your device’s own setting. It is kept twice: as a cookie, so that our server can draw the page in your theme, and in local storage, so that the page does not flash the wrong theme while it loads. It holds only “light” or “dark”. The cookie lasts one year from the last time you pressed the switch, and the local storage copy stays until you clear it. Consent: not needed, under the exception for letting a site look the way you have chosen. To have us forget it, clear this site’s cookies and local storage in your browser, as described under “Changing your choice or blocking cookies”. That also removes the cookie for a brief you started on this device, though the link in our email still takes you back to it.
• kalotect:welcome-later. A session storage entry in the portal and the console, set when you choose “Not now” on the welcome screen or close it. It holds the internal reference of your account, so that it applies only to you. It is cleared when you close the tab, and the welcome asks again the next time you open the portal or the console in a new tab. Consent: not needed, because it only remembers the choice you made.
• kalotect_consent. A cookie, with a copy in local storage, set only when you make a choice about visit counting: opting out, or opting back in. If we ever ask for your consent to anything, it also records your answer. It holds the choice, the version of this policy you made it against, and when you made it. The cookie lasts one hundred and eighty days. The local storage copy stays until you clear it, and we read it if the cookie has expired or is blocked, so that an opt-out keeps being honoured. Today we keep no copy of your choice on our side. If we ever ask for your consent, we will keep a record of your answer, with its time and the version of this policy, as evidence that you gave it. Consent: not needed, because it is how we respect the choice you made.

6. Counting visits

At the date of this version, visit counting is not switched on for our pages: no analytics script runs in your browser and no performance reports are sent. When we switch it on, it will work exactly as this section describes, and the notice in the footer of every page will be in place before the first visit is counted. If we extend it to the portal or the console, it will work in the same way, with the same opt-out, and we will update this policy first.

We count visits with PostHog, on its cloud service in the European Union. The script loads from our own address, and your browser sends the counts only to our own site, which passes them to PostHog. PostHog processes them for us under a contract, and may not use them for its own purposes.

For each page you view, the script sends the address of the page, the address you came from, your browser, operating system and type of device, your screen size, your browser’s language and time zone settings, and the time. PostHog receives your connection’s address (your IP address) with each count, as any server you connect to does. It is set to discard the address rather than keep it with the count, and not to work out from it where you are.

The script identifies a visit by a random reference held only in the page’s memory, which is lost when you close the tab or reload the page, so two visits cannot be linked to each other. Nothing that identifies you is kept on your device. The script checks your browser’s local storage and cookies for an earlier opt-out, writing and removing a test entry to do so, and keeps nothing else. It does not record your clicks, where you move or scroll on the page, or what you type. It does not record your session or show surveys, it builds no profile of you, and it is never linked to your account in the portal.

Our pages will also measure how quickly they load and respond on your device, and send one short report to our own site when you leave the page. The report holds the page address, the timings, your browser and operating system, whether your device is a mobile one, the size of the window, the type of network connection (such as 4G), and how the page was opened (for example by following a link or by reloading it). It uses no cookie and no stored identifier. Our server sends each report on to PostHog under a code that changes every day. The code is made from your connection’s address and browser details with a secret that our server holds only in memory and replaces every day, so the code cannot be worked out from your address and, once the day is over, no one, including us, can link it back to your connection. Your connection’s address itself is not passed on with the report.

We rely on the exception for statistics, so this runs without asking first. You can object at any time, at no cost:

• Choose “Opt out” in the notice in the footer of any page. Counting and performance reports stop straight away, and the analytics script is not loaded on later visits. Your choice is kept in the kalotect_consent cookie described above.
• If you opt out while the analytics script is already running on the page, PostHog also keeps your answer in your browser’s local storage, under a name that starts with __ph_opt_in_out_ followed by our PostHog project key, so that it stays switched off. It holds only your answer and stays until you clear it.
• Choose “Opt back in” in the same place if you change your mind.
• Set your browser to send the Global Privacy Control or “Do Not Track” signal. We treat either as a standing objection: while your browser sends it, we do not count your visits or send performance reports, on any visit, whether or not your browser lets us store your choice.

7. What we would ask you about first

Nothing our own pages set needs your consent today. A video from YouTube or Vimeo in the portal does, and asks you first, as “Previews and media in the portal” explains. If we add anything else that needs consent, such as recordings of how pages are used, advertising tags, or analytics that a provider uses for its own purposes, we will update this policy first and ask you before it runs.

We would ask with a notice offering “Accept all”, “Reject all” and “Choose”, in the same style and size, so that saying no is as easy as saying yes. Nothing that needs your consent would run until you had chosen. You could choose by category, and change your mind at any time from “Cookie preferences” in the footer, as easily as you gave your answer.

If this policy changes in a way that affects a choice you made, we will ask again. An opt-out from visit counting stays in place across versions, because it is a standing instruction.

8. Previews and media in the portal

The portal shows you the work we are doing for you. Some of it comes from other services, and what is served from somewhere else can set cookies of its own, on its own address, under its own policy. We choose what the portal loads, so we tell you about it here, and we ask you first wherever a service would store something for its own purposes.

• Vercel deployments. Previews of a website or an app we are building for you are served by Vercel, on an address ending in vercel.app, with files stored with them on an address ending in vercel-storage.com. Vercel shows the previews only to people it lets in, so the portal opens each one in its own tab, through a link we make for you when you ask to see it. Vercel then sets a cookie on the preview’s own address that lets your browser keep seeing it while that access is valid. That is strictly necessary to show you the preview you asked to see. You comment on and approve work in the portal, not through Vercel’s own comment toolbar.
• Sites we have built for you. A page from one of them is shown inside a frame and asks for consent in the frame in the same way it asks any visitor. A page from a version we are still building may instead open in its own tab, through a link we make for you, in the same way as a Vercel preview.
• Other sites of yours. A site we did not build is not loaded inside the portal unless you ask. It opens in its own tab, or loads in the portal only when you press to load it, after we have said that the site may set cookies of its own.
• Files we keep for you. Images, documents and videos we keep for you are served by our own site from our database, and play in your browser’s own player. We set no cookies on them beyond the sign-in cookie described above.
• Video platforms. Where a video lives on YouTube or Vimeo, for example on your own channel, the portal does not load that platform’s player until you ask. In its place we show a still image and a note that pressing play loads YouTube’s or Vimeo’s player, which sets cookies or uses local storage on your device for that platform’s own purposes as well as to play the video, with a link to watch it on YouTube or Vimeo instead. Until you press play, nothing from the platform loads. Pressing play is your consent to what that player sets. We use YouTube’s privacy-enhanced player, at youtube-nocookie.com, and ask Vimeo’s player not to track you. To undo your consent, clear that platform’s cookies in your browser.
• Pull requests. Code changes on GitHub are linked, not shown in a frame. GitHub sets its own cookies when you open them on its site.
• Payments. When you pay an invoice by card or set up a Direct Debit, you go to a page that Stripe hosts. Stripe sets the cookies it needs there, under its own cookie policy. We load no Stripe script on our own pages.

Some browsers block cookies set inside a frame, or keep them apart from that site’s cookies elsewhere. If a page shown in a frame in the portal does not load for that reason, open it in its own tab.

Each of these services explains what it does with the information its cookies collect:

• Vercel: vercel.com/legal/privacy-policy
• Google, for YouTube: policies.google.com/technologies/cookies
• Vimeo: vimeo.com/cookie_policy
• GitHub: docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement
• Stripe: stripe.com/privacy

9. Security cookies from our host

Our pages are hosted by Vercel. If Vercel has to check that a visitor is a person, for example during an attack, it can set a short-lived security cookie on our address to remember that your browser passed the check. That is strictly necessary to keep the service secure and does not need consent. Our pages set no such cookie themselves.

10. Our emails

The emails we send carry no tracking image, and their links are not changed to record whether you clicked them. We do not measure whether you opened an email.

11. What we do not set

We set no advertising cookies, no social media pixels and no sharing buttons that load from social networks. We do not track you across other sites, we do not combine details of your device to recognise you, and we do not sell or share information from cookies with anyone for their own use.

12. Changing your choice or blocking cookies

You can object to visit counting with one click from the footer of any page, or by having your browser send the Global Privacy Control signal, as described in “Counting visits”.

Your browser’s settings let you see, block and delete cookies and other site data, for all sites or for one. The help pages for the main browsers explain how:

• Chrome: support.google.com/chrome/answer/95647
• Safari on a Mac: support.apple.com/guide/safari/manage-cookies-sfri11471/mac; on an iPhone or iPad, the Safari section of Settings
• Firefox: support.mozilla.org/kb/clear-cookies-and-site-data-firefox
• Edge: support.microsoft.com/microsoft-edge/delete-cookies-in-microsoft-edge-63947406-40ac-c3b8-57b9-2a946a29ae09

A private window keeps nothing after you close it.

If you block or delete our cookies, this is what changes:

• Without kalotect_session you cannot sign in to the portal or the console.
• Without kalotect_brief a brief you started will not be waiting for you when you come back. If you gave us your email address, the link in the email we send you still takes you back to it.
• Without kalotect-theme our pages follow your device’s light or dark setting.
• Without kalotect_passkey_offered we may offer to set up a passkey again after you sign in with an email link.
• Without kalotect_consent, and its copy in local storage, we cannot remember an opt-out from visit counting, so you would need to opt out again on each visit. A browser that sends the Global Privacy Control signal is never counted, whether or not it lets us store anything.

Blocking cookies from other sites, often called third-party cookies, does not affect our own pages. It can stop a page shown in a frame in the portal from loading.

13. Changes to this policy

The version and the date it took effect are at the top of this policy. Before we release a change that could alter what our pages store or read, we check this list against what they actually do, and we update the policy before the change goes live.

If we add anything that needs your consent, we will ask before it runs. If a change affects clients, we will also tell you in the portal. We do not expect you to check this page for changes.

14. Questions and complaints

Questions about this policy, or about anything our pages store or read, go to hello@kalotect.com.

Our privacy notice explains your rights over your personal data and how to use them. If you are unhappy with how we have dealt with a concern, you can complain to the Information Commissioner’s Office, which enforces these rules in the United Kingdom, at ico.org.uk.