Cookie Policy

We are ITSM Ltd, a company incorporated in England and Wales with company number 17339600 and registered office at 167-169 Great Portland Street, 5th Floor, London, W1W 5PF. This one Cookie Policy covers our standalone Services, each named in an annex to it — for each, its website and its application together (Services). What is common to all of them is set out in sections 1 to 6. What is specific to one Service is in that Service's annex (an Annex), printed after section 6 and headed with the Service's name, one letter for each Service.

Please read this policy carefully, as it contains important information on who we are and how we use cookies. It should be read together with our Privacy Policy, which sets out who we are, how to contact us, what data is collected, how and why we collect, store, use and share personal information generally, your rights in relation to your personal information, and how to contact us and the supervisory authority if you have a complaint.

1. Cookies

A cookie is a small text file placed onto your device when you use a website. We use only cookies that are essential to provide the Services you have asked for, so you will not see a cookie consent banner. If we ever introduce a cookie that is not essential, we will ask for your consent before placing it.

Cookies let a Service recognise your device from one request to the next — in practice, that you are signed in. We do not use cookies to collect location data, to build a profile of you, or to follow you across other websites. Each Service's Annex lists every cookie that Service sets and says when each one is first set.

For further information on cookies generally, including how to control and manage them, see the guidance published by the UK Information Commissioner's Office, or visit www.aboutcookies.org.

2. Consent to use cookies

We will ask for your consent before placing cookies or similar technologies on your device, except where they are essential for us to provide a service you have requested — for example, to let you sign in and stay signed in as you move around a Service.

Every cookie we currently place on your device is essential in that sense, so we do not ask for your consent and you will not see a consent banner. Each Service's Annex explains each of its cookies — what it holds, when it is set, how long it lasts and why it is essential — and lists the similar technologies that Service does not use.

3. The cookies our Services set

The Annex for each Service lists every cookie that Service sets: its name, who sets it, what it holds, when it is set, how long it lasts and why it is essential. A Service sets no cookie of its own that its Annex does not list. Cookies that other companies set are dealt with in section 4.

When we offer a further standalone Service, this policy gains an Annex for it, listing that Service's cookies before the Service is offered. A cookie that is not strictly necessary is placed only with your consent, as section 2 says, and a change to this policy is notified as section 6 describes.

4. Third-party services and cookies

Our Services use other companies' services — for example to take payments, to host the Service, to handle sign-in, to send email and to report errors. We do not load third-party advertising, analytics or tracking into our Services. Some of those companies set cookies on their own websites — for instance when you leave a Service to pay on a page the payment provider runs — and any cookie set there is that company's, under its own policy. The Annex for each Service names the third-party services it uses and, for each, says whether your browser deals with that company directly.

5. How to turn off all cookies, and the consequences of doing so

If you do not want to accept any cookies, you may be able to change your browser or device settings so that cookies — including those which are essential to the services you have requested — are not accepted. If you do, you will not be able to sign in to a Service that keeps your sign-in in a cookie, or to stay signed in to it; its public pages that need no account continue to work. Each Service's Annex says what this means for that Service. For further information about cookies and how to turn them off, see the resources in section 1.

6. Changes to this policy

We may change this Cookie Policy from time to time. We will post the updated version on the website of each Service it covers, showing the date it takes effect, and give at least 30 days' prior notice by email to the address held for your account, in the same way as clause 19 of our SaaS Terms and Conditions. Questions about this policy go to support@itsm-ltd.com.

Annex A — Martyn's Law Evidence Kit

This Annex covers the Martyn's Law Evidence Kit: its public website and the application you reach after signing in. It forms part of this Cookie Policy.

A1. Cookies this Service sets

This Service sets no cookie until you ask for a sign-in link. If you only read its public pages and use the forms on them — the landing page, the tier checker (including its PDF download and the email it can send you repeating the result's headline), the enquiry and waitlist forms, the guides, these legal pages, and the page that the link in a reminder opens to stop it — it sets no cookie on your device. The sign-in form is also how an account is created, so there is no separate sign-up.

Asking for a sign-in link writes the verifier cookies in the table below — even if you never use the link, and even if it cannot be sent. Following the link adds the session cookie. All of them are written by the authentication software the Service uses, which comes from our authentication provider, Supabase. In the verifier cookies' names, <…> stands for the same first part as in the session cookie's name.

How a sign-in link completes. Depending on the link, signing in finishes in one of two ways. On the Service's confirmation page, you press a button to finish signing in, and none of the verifier cookies is read. On the Service's code-exchange route, only the latest verifier (the last row above) is read, and it is then deleted. Neither route removes the per-request verifiers or the index.

How these cookies are set. Each cookie in the table is a first-party cookie: the Service writes it on its own address — from its servers and, once you choose a photograph on the Drills & refreshers page for a premises, from the Service's own script in that browser tab — using Supabase's software. Every one has the same attributes:

• Host-only. No Domain attribute is set, so your browser sends the cookie only to the address that set it, never to any other website — including another ITSM Ltd website, such as our support portal.
• Path /: it is sent with every request to this Service.
• SameSite Lax: your browser does not send it with requests another website makes to this Service in the background, or with a form another website posts to it, but does send it when you follow a link to this Service.
• Not HttpOnly: script running on this Service's pages can read it. The Service's own script does so once you choose a photograph on the Drills & refreshers page, to upload it and then to keep your session renewed while that browser tab stays open.
• No Secure attribute: the Service does not set one. It does send a header telling browsers to use only HTTPS for it for two years; a browser follows that once it has reached the Service over HTTPS.
• Max-Age of 400 days, counted afresh each time the cookie is written.

If you block these cookies, you cannot sign in or stay signed in, because the session cannot be held. Everything that needs no account keeps working: the landing page, the tier checker (including its PDF download), the enquiry and waitlist forms, the guides and these legal pages.

A2. Cookies and similar technologies this Service does not use

This list is longer than the table in section A1, and that is the point of publishing it.

• No appearance cookie. The light or dark theme follows your device's own setting, and there is no switch to remember, so nothing is stored.
• No analytics cookie. The Service counts visits to its public pages for itself, as section A2 of Annex A to the Privacy Policy describes, and needs no cookie to do it: the Service's own script in the page tells our server which page was opened, and nothing is written to your device or read back from it, on that visit or any later one. No analytics or performance-measurement product is loaded, and no session is replayed. Our error-reporting library, running on our servers, sends our error-reporting provider aggregate counts of the requests the server handled and how many failed; they carry no personal data and involve no cookie. See section A2 of Annex A to the Privacy Policy.
• No advertising, no cross-site tracking, no social media plugins and no embedded video.
• No bot-protection cookie. The tier checker's PDF download, the enquiry form and the waitlist are limited by counting submissions per email address and per network address, not by a third-party challenge; the limits are in section A1 of Annex A to the Privacy Policy. The sign-in form relies on our authentication provider's own limits.
• No support-widget cookie. Support is by email and through our separate support portal (section A3); there is no chat window.
• No third-party script or embedded frame. Every script on the Service's pages is served by the Service itself, and no page embeds another website.
• No font provider. The Service's typefaces are served from its own address, so a page makes no request to a font provider.
• No local or session storage. The Service keeps nothing in your browser's local storage or session storage. On the Drills & refreshers page, the authentication software checks that local storage is available as it loads, by writing a test entry and deleting it at once, and looks there for a debugging setting of its own; it leaves nothing behind.
• No tracking image in our emails. The emails the Service sends itself, through Resend, are plain text, so they cannot carry a tracking image. Some emails come from others: the sign-in email is written in HTML and sent by our authentication provider, and invoices for purchase orders are sent by Stripe.

A3. Third-party services on this Service

This section says what the Service's own code shows about the other companies it uses; the one exception is the company that hosts our support mailbox, which we state from our own arrangements. None of them has a script on the Service's pages (section A2).

Stripe processes card payments for us; we are the seller. When you pay by card, manage billing on Stripe's billing page, or open an invoice that Stripe has emailed, you are on a page Stripe runs on its own domains, and any cookie set there is Stripe's, under Stripe's own policy. No Stripe script is loaded into this Service: none of its pages includes one, and checkout and billing are reached by the Service sending your browser on to Stripe. Stripe's checkout and billing addresses are named in the Service's content security policy, as places a form on the Service may take you, but that policy is sent in report-only mode and blocks nothing (section A6 of Annex A to the Privacy Policy).

Supabase provides the Service's database, sign-in and photograph storage. The cookies in section A1 are written on this Service's own address, by the Service, using Supabase's software. Your browser also contacts Supabase's own address directly. On the Drills & refreshers page for a premises, it does so to show the photographs already logged there, through links that work for an hour. When you attach a photograph there, it uploads the photograph and, if your access token has expired or is about to, renews your session. From then on, until that browser tab is closed, reloaded or signed out, it renews your session whenever the access token is about to expire, while the tab is visible. This continues even if you move on to other pages of the Service through its own links. A sign-in link that completes through the Service's code-exchange route (section A1) also opens Supabase's own address first, which checks the link and sends your browser on to the Service. This policy lists only the cookies the Service itself sets; it does not describe any that Supabase's own address may set on those requests.

Vercel hosts the Service. The Service includes no Vercel analytics or performance-measurement script; the page-visit count described in section A2 is the Service's own, sent to the Service's own address. As with any website host, every request your browser makes to the Service reaches Vercel with your IP address; see section A3 of Annex A to the Privacy Policy.

Sentry receives reports of errors from the Service's servers. No Sentry client is started in your browser, so Sentry has no contact with your browser and cannot set a cookie in it. Before a report is sent, the request details in it are cut down to the page's path, with no cookies and no headers; see section A3 of Annex A to the Privacy Policy.

Resend delivers the emails the Service sends itself (section A2), and reports back to our servers about them. It works between our servers and Resend's, never in your browser, so it has no way to set a cookie on this Service.

Our support portal at support.itsm-ltd.com is a separate ITSM Ltd website, with its own sign-in and its own password. This Service's cookies are host-only, so your browser never sends them to the portal. This policy does not cover the portal, and says nothing about any cookie it may set.

Our support mailbox, on Google Workspace, receives the large-estate enquiries and waitlist registrations the Service forwards to us, and every reply to an email the Service sends itself through Resend, because each one's reply-to address is that mailbox. The Service reaches it only by email, from our servers. An uptime-monitoring service, where one is set up, receives a message from our servers when the Service's daily job finishes, carrying counts of what the job did and nothing else. Your browser has no contact with either of them through this Service, so neither can set a cookie through it.