Legal Cookies
Cookie Policy
- Last updated
- 1 October 2026
- Effective
- 1 October 2026
01
About this policy
We're Glasgow GFX, a small design and print studio in Glasgow (the company is GLASGOWGFX LTD). This page explains the cookies and similar storage our website uses, what each one is for, how long it lasts, and how to change your mind. Read it alongside our Privacy Policy, which covers what we do with the information.
The rules we follow are the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR) and the Data (Use and Access) Act 2025.
02
Cookies, storage and your choice
Cookies are small text files a website keeps in your browser. Sites can also keep information in your browser's localStorage and sessionStorage, or load small pieces of code ("tags" or "pixels") from other companies. The law treats all of these the same way, and so does this policy.
Our cookie banner groups them into three categories:
- Strictly necessary: what the site needs to work, such as signing in, your basket, checkout and security. Always on.
- Analytics: shows us which pages help people and where they get stuck, using our own measurement, Google Analytics and PostHog (including session replay). Off unless you say yes.
- Marketing: measures our adverts on Google, Microsoft, Meta, LinkedIn and Pinterest, so we know which ones bring people to us. Off unless you say yes.
Nothing optional before you choose
Until you accept analytics or marketing, we set no optional cookies and use no optional storage, and none of the analytics or advertising tags load. "Reject all" is as easy as "Accept all", and nothing is pre-ticked when you choose category by category.
03
Measuring visits without cookies
Even before you choose, and if you say no, we count visits in a way that stores nothing on your device. When a page loads, our server works out a code from your IP address, your browser's details and our web address, scrambled with a secret key (a "hash"). That code is never stored on your device and never sent to your browser. It changes every day, so it cannot follow you from one day to the next, and we never keep the IP address it came from.
We use it for statistics only: how many visits we get, which pages people land on, where they came from (for example a search engine, an advert or an AI assistant such as ChatGPT), and whether a visit led to an enquiry that day. We don't share it with advertisers or analytics companies. Our Privacy Policy explains why we rely on our legitimate interests for this, and how to object.
04
Strictly necessary
These keep the site working and secure. PECR lets us use them without asking, because you can't use the parts of the site you ask for without them. Several are only created when you use the feature they serve.
| Name | Provider | Category | Purpose | Duration |
|---|---|---|---|---|
| ggfx_consent | Glasgow GFX | Strictly necessary | Remembers your cookie choices so we only use what you agreed to. Cookie. Holds your choice and the date you made it, nothing else. | 6 months, then we ask again |
| sb-<project>-auth-token | Supabase (our sign-in provider) | Strictly necessary | Keeps you signed in to your account. Cookie. Only set when you sign in. | Until you sign out, or up to 400 days |
| guestId | Glasgow GFX | Strictly necessary | A random number that holds your basket if you shop without an account. Local storage. Only created when you first add something to your basket. | Until you clear it. An unused basket is deleted from our system after 7 days |
| gla-checkout-form-data,gla-checkout-pending-payment | Glasgow GFX | Strictly necessary | Keeps what you have typed at checkout, and a payment in progress, if the page reloads. Session storage. | Until you close the tab |
| __stripe_mid,__stripe_sid | Stripe | Strictly necessary | Fraud prevention when you pay. Cookies. Only on the checkout and payment pages. | __stripe_mid 1 year, __stripe_sid 30 minutes |
| theme,product-favorites,artwork-favorites,product-comparison | Glasgow GFX | Strictly necessary | Remember things you ask the site to remember: light or dark mode, favourites, and products you are comparing. Local storage. Only set when you use that feature. | Until you clear them |
| savedProductConfigs | Glasgow GFX | Strictly necessary | Keeps a product set-up you chose to save. Local storage. Only set when you save one. | Until you clear it |
| ggfx_signal_debug | Glasgow GFX | Strictly necessary | Turns on our measurement test panel for our own staff. Session storage. Only set if someone opens a special debug link; ordinary visitors never get it, though the site checks for it on each page. | Until the tab is closed |
Since the Data (Use and Access) Act 2025, strictly necessary storage explicitly includes storage used to detect and fix technical faults and to keep a service secure. That is what Sentry, our error monitoring, does. Error reports reach Sentry through our own web address, and our server passes on the report alone, never your cookies. Sentry sets no cookies. Its session replay is optional and listed under analytics below.
05
Analytics (optional)
These help us see how the site is used so we can improve it. We only use them if you accept analytics cookies.
| Name | Provider | Category | Purpose | Duration |
|---|---|---|---|---|
| sentryReplaySession | Sentry (EU) | Analytics | Lets our error monitoring replay what happened on the page around a fault, with all text, typing and images hidden. Session storage. Only with analytics consent, and never on account, sign-in, checkout, order or proposal pages. | Until you close the tab |
| ggfx_vid | Glasgow GFX | Analytics | A random visitor number, so we can tell a returning visitor from a new one and count visits properly. Cookie, set by our server and not readable by scripts. | 13 months |
| ggfx_sid | Glasgow GFX | Analytics | A random number that groups the pages you see in one visit. Cookie, set by our server. | 30 minutes after your last page |
| gfx_first_touch,gfx_first_touch_session | Glasgow GFX | Analytics | Remembers how you first found us (landing page, referring site, campaign tags), so an enquiry can be linked to it. Local storage and session storage. | 90 days (local storage); until you close the tab (session storage) |
| ggfx-lane | Glasgow GFX | Analytics | Remembers which part of the site you picked on the homepage (print, digital or gallery) so it can greet you there next time. Local storage. | Until you clear it or withdraw consent |
| _ga,_ga_<ID> | Google Analytics 4 | Analytics | Tell visitors and visits apart, so we can see which pages help people. Cookies. | 2 years |
| ph_<key>_posthog | PostHog (EU) | Analytics | A random visitor number and visit state for PostHog product analytics and session replay. Cookie, with a copy in local storage. | 1 year |
| __ph_opt_in_out_<key> | PostHog (EU) | Analytics | Records that you said yes to analytics, so PostHog only runs with your consent. Local storage. | Until you withdraw consent |
With analytics consent PostHog can also record how a visit moves around a page (session replay). Everything you type is hidden, and replay never runs on account, sign-in, checkout, order or proposal pages. We also use Ahrefs Web Analytics, which loads only with analytics consent and sets no cookies or storage. Vercel Web Analytics and Speed Insights measure page views and loading speed without cookies or storage.
06
Marketing (optional)
These let the ad platforms tell us which adverts led to an enquiry or an order. We only use them if you accept marketing cookies. When you do, we may also send the platforms details of an enquiry or order from our server, as our Privacy Policy explains.
| Name | Provider | Category | Purpose | Duration |
|---|---|---|---|---|
| ggfx_cid | Glasgow GFX | Marketing | Keeps the ad click identifier from the advert you clicked, so a later enquiry or order can be credited to that advert. Cookie, set by our server and not readable by scripts. | 90 days |
| _gcl_* | Google Ads | Marketing | Store the Google Ads click (for example _gcl_au, _gcl_aw, _gcl_gb) so Google can tell us which advert led to a phone call, enquiry or order. Cookies. | 90 days |
| _fbp,_fbc | Meta (Facebook, Instagram) | Marketing | A browser identifier, and the Meta ad click, so Meta can measure our adverts. Cookies. | 90 days[OWNER TO CONFIRM: Meta does not publish the _fbp lifetime] |
| _uetsid,_uetvid,_uetmsclkid | Microsoft Advertising (Bing) | Marketing | Visit and visitor identifiers, and the Microsoft ad click, so Microsoft can measure our adverts. Cookies, with copies in local storage. | _uetsid 1 day, _uetvid 13 months, _uetmsclkid 90 days[OWNER TO CONFIRM: Microsoft does not publish the _uetsid and _uetvid lifetimes] |
| li_fat_id | Marketing | The LinkedIn ad click, so LinkedIn can measure our adverts. Cookie. The LinkedIn tag can also keep li_adsId, li_giant and li_hem in cookies or local storage; we delete those too when you withdraw. | 30 days[OWNER TO CONFIRM: lifetimes of li_adsId, li_giant and li_hem] | |
| li_sugr | Marketing | A browser identifier LinkedIn uses to measure adverts. Set by the LinkedIn tag on linkedin.com, not on our site, so LinkedIn’s own cookie settings control it. | 90 days | |
| _pin_unauth,_epik,_derived_epik | Marketing | A browser identifier and the Pinterest ad click, so Pinterest can measure our adverts. Cookies. | 1 year |
Vendor lifetimes are the ones each vendor publishes, checked on 1 October 2026, and the vendor can change them. A vendor's tag may also set cookies on its own website's domain, which its own cookie policy covers.
07
Global Privacy Control
If your browser sends the Global Privacy Control (GPC) signal, we treat it as a no to marketing. Marketing stays off whatever the banner says, the banner tells you why, and no advertising tags load. Analytics is still your choice.
08
Changing your mind
- Any time: use here or in the footer of every page to reopen the banner and change any category.
- Withdrawing deletes the cookies: when you switch a category off, we stop the tags straight away, and the site deletes their cookies and storage: our own visitor and click cookies, and the vendors' cookies listed above (for example
_ga,_fbpandph_<key>_posthog). Withdrawing doesn't affect what was collected while you had agreed. - Browser settings: you can also block or delete cookies in your browser. Blocking strictly necessary ones may stop sign-in, the basket or checkout working.
09
Served from our own domain
To keep your sign-in cookies away from other companies, Google's tag and PostHog are served from our own domain (glasgowgfx.com) through small relays on our server. The relays pass on only what each vendor needs and strip our other cookies. They still count as Google's and PostHog's processing, need the same consent, and are covered by the vendors' terms. The Microsoft, Meta, LinkedIn and Pinterest tags load from those companies' own websites, and only with marketing consent.
10
The companies involved
Each company's own privacy policy explains how it handles data:
- Google Google Analytics and Google Ads
- PostHog product analytics and session replay
- Microsoft Microsoft Advertising
- Meta Facebook and Instagram adverts
- LinkedIn LinkedIn adverts
- Pinterest Pinterest adverts
- Ahrefs Ahrefs Web Analytics
- Stripe payments and fraud prevention
- Supabase sign-in and database
- Sentry error monitoring
- Vercel hosting, Web Analytics and Speed Insights
11
Changes to this policy
When we change how we use cookies we update this page and the date at the top. If the change affects what you agreed to, the banner asks you again.
12
Contact us
Questions about cookies? Get in touch:
- Phone
- 0141 345 5841
- Post
- GLASGOWGFX LTD, Unit 204b The Pentagon Business Centre, 36 Washington Street, Glasgow, G3 8AZ, United Kingdom