· revenue engineCookie and Tracking Technologies Notice
hyperpersonalised.com
1. What this notice covers
This notice describes the cookies and similar technologies (tags, pixels, SDKs, local storage entries, fingerprinting techniques, server-side identifiers) used on hyperpersonalised.com and on Hyper-hosted landing pages. It is issued to comply with Regulation 6 of the UK Privacy and Electronic Communications Regulations 2003 (PECR), Article 5(3) of the EU ePrivacy Directive 2002/58/EC as implemented in each EU member state, and the notice and opt-out requirements of US and Canadian law.
2. How we approach tracking
We divide cookies and similar technologies into five categories: strictly necessary, preferences, analytics, marketing, and visitor identification. Only strictly necessary technologies are available before you make a choice on our consent banner. Preferences, analytics, marketing and visitor-identification services are off by default.
3. What changes depending on where you are
Our consent banner detects your approximate location from your IP and applies rules that match your jurisdiction:
- UK and EU: we block all non-essential cookies, pixels, SDKs and visitor-identification tags until you give prior, informed, specific, granular consent. You can accept all, reject all or choose by category. Reject all is as easy as accept all.
- California: we display a notice at collection, show a "Do Not Sell or Share My Personal Information" link in the footer and respect the Global Privacy Control (GPC) signal automatically.
- Other US states with a Universal Opt-Out Mechanism (Colorado, Connecticut, Texas, Oregon, Delaware, New Jersey, Montana, Maryland): we respect that signal automatically.
- Canada (outside Quebec): we seek meaningful consent under PIPEDA for any processing beyond strictly necessary.
- Quebec: we apply Law 25 consent rules.
- Rest of world: we follow the UK/EU defaults as the higher standard.
4. The technologies in use
The tables below describe the cookies and trackers we set, who sets them, what they do and how long they last. We review this list quarterly. The current list at any time is visible through our consent banner preferences panel.
4.1 Strictly necessary
| Name | Provider | Purpose | Retention |
|---|---|---|---|
| next-auth.session-token / session | hyperpersonalised.com | Keeps your session active and preserves form state | Session |
| csrf | hyperpersonalised.com | Protects against cross-site request forgery | Session |
| hyper_paid_submission_v1 (sessionStorage) | hyperpersonalised.com | After an explicit enquiry submission, remembers a pending submission UUID and a SHA-256 form signature to prevent duplicate submissions. Does not store the contact field values | Browser tab session, maximum 24 hours |
| klaro | hyperpersonalised.com (self-hosted Klaro!) | Records your consent choices and the banner version | 12 months |
| hyper_bucket | hyperpersonalised.com | Records the privacy-rule region selected from the request's approximate location | 15 minutes |
| ElevenLabs streaming TTS (no browser storage) | ElevenLabs Inc, called by Hyper's server | Generates synthetic narration after you start the interactive campaign demo. Narration text can include a person or company name. ElevenLabs does not receive your browser IP from Hyper's server-side request | Generated audio is cached by Hyper for up to 365 days |
| Sentry Error Monitoring (no browser storage) | Functional Software Inc (Sentry) | Reports unhandled site errors, stack traces and browser metadata so we can diagnose site breakage | 90 days |
| hyper.enginePersonalisation | hyperpersonalised.com | Keeps the homepage personalisation a visitor asked for when they typed their own company website into the homepage tool and named a company they want to approach. The entry holds the two website addresses the visitor supplied, the two company descriptions Hyper built from those public websites, and the campaign already shown to them, so reloading the page shows the same personalised homepage rather than the generic one. It is not read by any other website, is not sent to any other party, and is not used to measure, profile or advertise to the visitor | Until the visitor uses Reset this page on the personalisation panel, or clears browser storage. Nothing expires it on a timer |
| _calendly_session and _calendly_* (Calendly booking calendar) | Calendly LLC | Provides the inline scheduling calendar on our contact page so you can book a call without leaving the page. Calendly's script and the calendar it opens set Calendly's own session and product-analytics cookies; hyperpersonalised.com does not read or set them itself. These cookies are set only when you open the contact page | Session to 12 months, per Calendly's own cookie notice |
The Calendly booking calendar is treated as strictly necessary because a visitor opening a contact page is actively requesting the means to book a call. That classification is a recorded controller decision (18 August 2026). Calendly's own cookie banner is suppressed on the embed so that this notice remains the single place our cookie disclosures live, and a plain link to book through Calendly's own site is provided beside the embedded calendar if you prefer not to use the embed.
The homepage personalisation entry is treated as strictly necessary on the same basis: it holds the state of a service the visitor actively asked for by typing their own website into the homepage tool and naming a company to approach, it stays on their own device, and the panel that carries the personalisation also carries the one-click reset that deletes it.
4.2 Preferences (opt-in)
| Name | Provider | Purpose | Retention |
|---|---|---|---|
| pref_locale | hyperpersonalised.com | Remembers your preferred language | 12 months |
| returning_user | hyperpersonalised.com | Stores tryhyper:visitor to restore a completed visitor-requested campaign, tryhyper:recentTemplates to avoid immediately repeating a campaign template and hyper.loadingMuted to remember your loading-video audio choice | tryhyper:visitor: 30 days. tryhyper:recentTemplates and hyper.loadingMuted: until you withdraw consent or clear browser storage |
4.3 Analytics (opt-in)
| Name | Provider | Purpose | Retention |
|---|---|---|---|
| PostHog Analytics | PostHog Inc | Measures page views, session counts and feature usage using ph_phc_* and __ph_opt_in_out_*. PostHog initialises and captures only after you opt in to Analytics | 12 months |
| Google Analytics 4 | Google LLC | Measures aggregate website traffic using _ga, _ga_* and _gid. The Google tag loads only after you opt in to Analytics | Up to 13 months |
| hyper_paid_attribution_v1 (sessionStorage) | hyperpersonalised.com | Remembers the first and last campaign source parameters for an enquiry after Analytics consent | Browser tab session, maximum 24 hours; removed on Analytics withdrawal |
Both analytics services are blocked until you opt in to the Analytics category. If you withdraw analytics consent, Hyper disables measurement, removes the Google Analytics scripts and cookies, and resets and opts out the PostHog browser identity.
4.4 Marketing (opt-in)
Hyper also uses Google Ads conversion measurement on the dedicated prospecting enquiry page after you opt in to the Google Ads Marketing service. Google receives advertising identifiers, technical request data and a conversion event after the server confirms delivery of your enquiry. Hyper's conversion event contains a receipt identifier and the page address without query parameters; Hyper does not send contact form values or enable enhanced conversions. Google Ads measurement is separate from Google Analytics and requires its own Marketing consent.
| Name | Provider | Purpose | Retention |
|---|---|---|---|
| _gcl_* cookies, including _gcl_aw, _gcl_au and _gcl_gs | Google Ads | Associate advertising clicks with subsequent enquiry conversions | Up to 90 days, vendor controlled |
| _gcl_ls (localStorage) | Google Ads | Stores advertising click information used by Google's conversion-linking technology | Vendor controlled; Hyper clears this key on Google Ads consent withdrawal |
Google's cookie guidance gives a 90-day period for gcl cookies. Google's conversion-linker guidance identifies _gcl_ls browser storage without specifying a fixed expiry. Actual storage depends on Google's tag, browser controls and consent. Sources: https://policies.google.com/technologies/cookies and https://support.google.com/tagmanager/answer/7549390.
Google lists ordinary Google Ads services under its controller terms. Google may process advertising data outside the UK or EEA. Google's published transfer information describes the EU-US Data Privacy Framework, UK Extension and contractual safeguards. Details and Google's privacy controls are available at https://business.safety.google/adsdatatransfers/ and https://policies.google.com/privacy. Withdrawing Google Ads consent stops Hyper's Google Ads integration and removes accessible gcl cookies and _gcl_ls storage; Hyper cannot directly remove data already received by Google.
| Name | Provider | Purpose | Retention |
|---|---|---|---|
| hyper_paid_ad_attribution_v1 (sessionStorage) | hyperpersonalised.com | Remembers advertising click identifiers after Marketing consent | Browser tab session, maximum 24 hours; removed on Marketing withdrawal |
| hyper_paid_conversion_v1 (sessionStorage) | hyperpersonalised.com | Remembers a confirmed enquiry receipt to prevent duplicate advertising conversion events after Marketing consent | Browser tab session, maximum 24 hours; removed on Marketing withdrawal |
Hyper keeps campaign source parameters and advertising click identifiers in separate consent categories. Consented attribution accompanies an enquiry only when you submit the enquiry. Hyper sends the configured LinkedIn enquiry conversion only after the server confirms receipt and Marketing consent remains in place. Hyper does not send form-field values or hashed email addresses through that conversion event.
Hyper uses the LinkedIn Insight Tag on configured marketing pages to measure advertising visits and confirmed enquiries. The tag loads only after you opt in to the Marketing category. LinkedIn receives page and referrer URLs, IP address, browser and device information, timestamps and conversion events. LinkedIn may match website activity with LinkedIn accounts and use the data for advertising, reporting and service improvement. Hyper receives advertising reports, not the identity of individual LinkedIn members.
LinkedIn controls the cookies and browser storage used by the Insight Tag. The following identifiers may be used, depending on browser settings, region and LinkedIn configuration. LinkedIn's current cookie table is available at https://www.linkedin.com/legal/l/cookie-table.
| Name | Provider | Purpose | Retention |
|---|---|---|---|
| li_fat_id | First-party advertising and conversion identifier | 30 days | |
| UserMatchHistory, AnalyticsSyncHistory, lms_ads, lms_analytics | Advertising identity matching and measurement | 30 days | |
| li_sugr, _guid | Advertising identity matching | 90 days | |
| li_giant | Group-based conversion identifier | 7 days | |
| bcookie, bscookie | Browser security and diagnostics | 1 year | |
| lidc | Data-centre routing | 24 hours | |
| li_gc, li_mc | LinkedIn consent preferences | 6 months | |
| JSESSIONID, lang, sdsc, ar_debug | Security, language, routing and attribution support | Session | |
| BizographicsOptOut | Non-member advertising opt-out | 10 years | |
| li_adsid (browser storage) | Advertising identifier outside the EU, EEA, UK and Quebec | 6 months |
Every LinkedIn request on Hyper's configured pages is gated on Marketing consent, including requests involving LinkedIn's security or consent cookies. LinkedIn states that direct member identifiers are removed within seven days and remaining pseudonymous Insight Tag data is deleted within 180 days. Cookie expiry and LinkedIn's server retention are separate periods.
Withdrawing Marketing consent stops further LinkedIn requests from Hyper's integration and clears Hyper's marketing session records and accessible first-party LinkedIn identifiers. Hyper cannot directly delete cookies on LinkedIn's own domain or data already received by LinkedIn. You can use browser cookie controls and LinkedIn's privacy controls at https://www.linkedin.com/legal/privacy-policy.
LinkedIn's published terms describe independent controller processing for Insight Tag data, except California consumer data covered by the service-provider provisions of its Data Processing Agreement. LinkedIn stores Insight Tag data in the United States. LinkedIn publishes EU-US Data Privacy Framework and UK Extension commitments, with controller-to-controller Standard Contractual Clauses and the UK transfer addendum in its Independent Controller Addendum. Further details: https://www.linkedin.com/legal/l/linkedin-independent-controller-addendum and https://www.linkedin.com/help/linkedin/answer/a1343190.
Hyper uses optional Microsoft Advertising Universal Event Tracking and Meta Pixel integrations on the exact canonical managed new-business page when the corresponding public tag identifier is configured. Each integration loads only after you opt in to its matching Marketing service. A conversion event is sent only after the server confirms a delivered enquiry, using an opaque receipt identifier rather than contact form values.
Microsoft UET receives page and referrer information, IP address, browser and device information, advertising identifiers and the confirmed submit_lead_form event. Hyper does not implement enhanced conversions and does not send names, email addresses, phone numbers or other contact form values. Microsoft states that UET data is retained for 390 days. Its UET FAQ lists the cookies UET stores or accesses and describes the periods below.
| Name | Provider | Purpose | Retention |
|---|---|---|---|
| _uetsid | Microsoft Advertising | First-party identifier for a unique UET session | 1 day |
| _uetmsclkid | Microsoft Advertising | First-party Microsoft Click ID used for conversion attribution | 90 days |
| _uetvid | Microsoft Advertising | First-party pseudonymous visitor identifier | 13 months |
| MUID | Microsoft Advertising | Microsoft-domain browser identifier used for advertising and measurement | 13 months |
| MR and MSPTC | Microsoft Advertising | Microsoft-domain flags or partitioned identifiers accessed by UET | Vendor controlled; Microsoft's UET FAQ does not state a fixed per-cookie period |
| _clck and _clsk | Microsoft UET Insights / Clarity | Conditional user and session identifiers if UET Insights is enabled in the advertising account | Vendor controlled; the account setting was not inspected and Microsoft's cited UET and Clarity pages do not state a fixed period |
Microsoft's Advertising Agreement names Microsoft Ireland Operations Limited as the contracting entity for an EMEA customer and says Microsoft controls UET data and uses it for its own advertising, reporting, performance analysis and service-improvement purposes. Microsoft's Privacy Statement publishes Standard Contractual Clauses and Microsoft Corporation's EU-US Data Privacy Framework and UK Extension commitments. Published terms were verified on 12 October 2026; account acceptance, UET Insights settings and a transfer assessment were not verified. Sources: https://help.ads.microsoft.com/apex/index/3/en-gb/53056 ; https://learn.microsoft.com/en-us/answers/questions/2289901/purposes-of-bing-cookies ; https://learn.microsoft.com/en-us/clarity/setup-and-installation/clarity-cookies ; https://help.ads.microsoft.com/resources/microsoft_advertising_agreement/en.pdf ; https://privacy.microsoft.com/en-gb/privacystatement.
Withdrawing Microsoft UET consent stops further requests from Hyper's integration, removes the loaded script and clears accessible first-party _uetsid, _uetvid and _uetmsclkid cookies before reloading the document. Hyper cannot directly delete Microsoft-domain cookies or data already received by Microsoft.
Meta Pixel receives page and referrer information, IP address, browser and device information, advertising identifiers, PageView and the confirmed Lead event. Hyper runs the Pixel in Meta's manual-only mode with automatic configuration and automatic advanced matching disabled. Hyper does not send names, email addresses, phone numbers or other contact form values.
| Name | Provider | Purpose | Retention |
|---|---|---|---|
| _fbp | Meta Platforms | First-party browser identifier for advertising and site analytics | 90 days |
| _fbc | Meta Platforms | First-party Meta click identifier used for advertising attribution | 90 days |
| fr | Meta Platforms | Meta-domain advertising delivery and measurement identifier | 90 days |
Meta's Business Tools Terms state that Event Data may be retained for a maximum of two years. For UK data, those terms describe Meta Platforms, Inc. as processor for matching, measurement and analytics, joint controller for collection and transmission, and independent controller for later processing. The terms apply Meta's UK Data Transfer Addendum, which incorporates the ICO UK Addendum to the EU Standard Contractual Clauses and provides Modules 1 and 2 according to Meta's role. Published terms were verified on 12 October 2026; account acceptance, account settings and a transfer assessment were not verified. Sources: https://www.facebook.com/legal/technology_terms ; https://mbasic.facebook.com/privacy/policies/cookies/printable/ ; https://developers.facebook.com/documentation/meta-pixel/advanced ; https://www.facebook.com/legal/terms/UK_Data_Transfer_Addendum.
Withdrawing Meta Pixel consent stops further requests from Hyper's integration, removes the loaded script and clears accessible first-party _fbp and _fbc cookies before reloading the document. Hyper cannot directly delete Meta-domain cookies or data already received by Meta.
4.5 Visitor identification
No separate visitor-identification vendor is active on hyperpersonalised.com. A future visitor-identification service will remain off until you opt in to that category. Hyper honours Global Privacy Control and applicable Do Not Sell or Share requests for marketing tracking.
5. How to change or withdraw consent
- Click "Cookie preferences" in the footer of any page.
- Change your browser settings to block or delete cookies (this may degrade site functionality).
- Enable the Global Privacy Control (GPC) signal in your browser. We will treat that as an opt-out of sale/share in applicable US states.
- Email [email protected].
6. Enforcement of your choices
When you reject a category, the self-hosted Klaro! consent manager prevents the relevant service from initialising, making tracking requests, or writing or reading category-specific browser storage. Google Analytics scripts are not loaded and PostHog capture is not initialised until you opt in to Analytics. Google Ads, LinkedIn Insight, Microsoft UET and Meta Pixel each require the matching Marketing service consent. We log each consent decision with a pseudonymous daily session identifier, timestamp, banner version, category choices, IP-derived country and user agent.
7. Visitor identification - additional information
No visitor-identification provider is active on hyperpersonalised.com. A future visitor-identification service could link a business IP address, and sometimes a professional profile, to a visit. Any future use would be profiling within the meaning of Article 4(4) GDPR. Hyper would not use the service to make an automated decision with legal or similarly significant effects.
If visitor identification is enabled in future, the service will operate only with consent in the UK and EU. In the United States, Hyper will treat the use of a visitor-identification tag as a "sale/share" for CCPA/CPRA purposes and disable the service on receipt of a GPC signal or applicable Do Not Sell or Share request.
8. Third parties
Third-party processors and their recorded due-diligence status are listed at hyperpersonalised.com/subprocessors. LinkedIn's role varies as described in section 4.4; LinkedIn is not described as a processor for all Insight Tag data.
9. Contact
Email [email protected] for any question about this notice or to report a cookie that you think should be disclosed here but is not.