· revenue engineCookie and Tracking Technologies Notice
hyperpersonalised.com
1. What this notice covers
This notice describes the cookies and similar technologies (tags, pixels, SDKs, local storage entries, fingerprinting techniques, server-side identifiers) used on hyperpersonalised.com and on Hyper-hosted landing pages. It is issued to comply with Regulation 6 of the UK Privacy and Electronic Communications Regulations 2003 (PECR), Article 5(3) of the EU ePrivacy Directive 2002/58/EC as implemented in each EU member state, and the notice and opt-out requirements of US and Canadian law.
2. How we approach tracking
We divide cookies and similar technologies into five categories: strictly necessary, preferences, analytics, marketing, and visitor identification. Only strictly necessary technologies are available before you make a choice on our consent banner. Preferences, analytics, marketing and visitor-identification services are off by default.
3. What changes depending on where you are
Our consent banner detects your approximate location from your IP and applies rules that match your jurisdiction:
- UK and EU: we block all non-essential cookies, pixels, SDKs and visitor-identification tags until you give prior, informed, specific, granular consent. You can accept all, reject all or choose by category. Reject all is as easy as accept all.
- California: we display a notice at collection, show a "Do Not Sell or Share My Personal Information" link in the footer and respect the Global Privacy Control (GPC) signal automatically.
- Other US states with a Universal Opt-Out Mechanism (Colorado, Connecticut, Texas, Oregon, Delaware, New Jersey, Montana, Maryland): we respect that signal automatically.
- Canada (outside Quebec): we seek meaningful consent under PIPEDA for any processing beyond strictly necessary.
- Quebec: we apply Law 25 consent rules.
- Rest of world: we follow the UK/EU defaults as the higher standard.
4. The technologies in use
The tables below describe the cookies and trackers we set, who sets them, what they do and how long they last. We review this list quarterly. The current list at any time is visible through our consent banner preferences panel.
4.1 Strictly necessary
| Name | Provider | Purpose | Retention |
|---|---|---|---|
| next-auth.session-token / session | hyperpersonalised.com | Keeps your session active and preserves form state | Session |
| csrf | hyperpersonalised.com | Protects against cross-site request forgery | Session |
| klaro | hyperpersonalised.com (self-hosted Klaro!) | Records your consent choices and the banner version | 12 months |
| hyper_bucket | hyperpersonalised.com | Records the privacy-rule region selected from the request's approximate location | 15 minutes |
| ElevenLabs streaming TTS (no browser storage) | ElevenLabs Inc, called by Hyper's server | Generates synthetic narration after you start the interactive campaign demo. Narration text can include a person or company name. ElevenLabs does not receive your browser IP from Hyper's server-side request | Generated audio is cached by Hyper for up to 365 days |
| Sentry Error Monitoring (no browser storage) | Functional Software Inc (Sentry) | Reports unhandled site errors, stack traces and browser metadata so we can diagnose site breakage | 90 days |
| hyper.enginePersonalisation | hyperpersonalised.com | Keeps the homepage personalisation a visitor asked for when they typed their own company website into the homepage tool and named a company they want to approach. The entry holds the two website addresses the visitor supplied, the two company descriptions Hyper built from those public websites, and the campaign already shown to them, so reloading the page shows the same personalised homepage rather than the generic one. It is not read by any other website, is not sent to any other party, and is not used to measure, profile or advertise to the visitor | Until the visitor uses Reset this page on the personalisation panel, or clears browser storage. Nothing expires it on a timer |
| _calendly_session and _calendly_* (Calendly booking calendar) | Calendly LLC | Provides the inline scheduling calendar on our contact page so you can book a call without leaving the page. Calendly's script and the calendar it opens set Calendly's own session and product-analytics cookies; hyperpersonalised.com does not read or set them itself. These cookies are set only when you open the contact page | Session to 12 months, per Calendly's own cookie notice |
The Calendly booking calendar is treated as strictly necessary because a visitor opening a contact page is actively requesting the means to book a call. That classification is a recorded controller decision (18 August 2026). Calendly's own cookie banner is suppressed on the embed so that this notice remains the single place our cookie disclosures live, and a plain link to book through Calendly's own site is provided beside the embedded calendar if you prefer not to use the embed.
The homepage personalisation entry is treated as strictly necessary on the same basis: it holds the state of a service the visitor actively asked for by typing their own website into the homepage tool and naming a company to approach, it stays on their own device, and the panel that carries the personalisation also carries the one-click reset that deletes it.
4.2 Preferences (opt-in)
| Name | Provider | Purpose | Retention |
|---|---|---|---|
| pref_locale | hyperpersonalised.com | Remembers your preferred language | 12 months |
| returning_user | hyperpersonalised.com | Stores tryhyper:visitor to restore a completed visitor-requested campaign, tryhyper:recentTemplates to avoid immediately repeating a campaign template and hyper.loadingMuted to remember your loading-video audio choice | tryhyper:visitor: 30 days. tryhyper:recentTemplates and hyper.loadingMuted: until you withdraw consent or clear browser storage |
4.3 Analytics (opt-in)
| Name | Provider | Purpose | Retention |
|---|---|---|---|
| PostHog Analytics | PostHog Inc | Measures page views, session counts and feature usage using ph_phc_* and __ph_opt_in_out_*. PostHog initialises and captures only after you opt in to Analytics | 12 months |
| Google Analytics 4 | Google LLC | Measures aggregate website traffic using _ga, _ga_* and _gid. The Google tag loads only after you opt in to Analytics | Up to 13 months |
Both analytics services are blocked until you opt in to the Analytics category. If you withdraw analytics consent, Hyper disables measurement, removes the Google Analytics scripts and cookies, and resets and opts out the PostHog browser identity.
4.4 Marketing and visitor identification
No marketing tag or visitor-identification vendor is active on hyperpersonalised.com. If Hyper enables either category, Hyper will update this notice and the consent banner before the service is allowed to operate. Where UK, EU or Canadian consent rules apply, the service will remain off until you opt in. Where US opt-out rules apply, Hyper will honour the Global Privacy Control signal and any applicable Do Not Sell or Share request.
5. How to change or withdraw consent
- Click "Cookie preferences" in the footer of any page.
- Change your browser settings to block or delete cookies (this may degrade site functionality).
- Enable the Global Privacy Control (GPC) signal in your browser. We will treat that as an opt-out of sale/share in applicable US states.
- Email [email protected].
6. Enforcement of your choices
When you reject a category, the self-hosted Klaro! consent manager prevents the relevant service from initialising, making tracking requests, or writing or reading category-specific browser storage. Google Analytics scripts are not loaded and PostHog capture is not initialised until you opt in to Analytics. We log each consent decision with a pseudonymous daily session identifier, timestamp, banner version, category choices, IP-derived country and user agent.
7. Visitor identification - additional information
No visitor-identification provider is active on hyperpersonalised.com. A future visitor-identification service could link a business IP address, and sometimes a professional profile, to a visit. Any future use would be profiling within the meaning of Article 4(4) GDPR. Hyper would not use the service to make an automated decision with legal or similarly significant effects.
If visitor identification is enabled in future, the service will operate only with consent in the UK and EU. In the United States, Hyper will treat the use of a visitor-identification tag as a "sale/share" for CCPA/CPRA purposes and disable the service on receipt of a GPC signal or applicable Do Not Sell or Share request.
8. Third parties
Third-party processors are recorded in our Sub-processor Register, including the status of the relevant data processing agreement and international transfer safeguard. Our current list of sub-processors is available at hyperpersonalised.com/subprocessors.
9. Contact
Email [email protected] for any question about this notice or to report a cookie that you think should be disclosed here but is not.