Skip to content

Cookie policy

Under UK PECR and UK GDPR.

Last updated: 24 October 2026

What we use

We use essential cookies for the service and to remember your choices. On our public marketing website, you can also choose to allow Google Analytics. We do not load Google Analytics or set its cookies before you allow it. Rejecting analytics does not stop you using the site. We do not use Google advertising features or sell your browsing data.

Optional Google Analytics. When you allow analytics, Google receives public-page visits, trial-button clicks, browser and device information and cookie identifiers to produce reports for us. We send page addresses without query strings or fragments and reduce referring addresses to their origin. We do not send form entries, account identifiers, client records, booking details or payment data. Analytics is limited to our main marketing website, excluding sign-up, login, the dashboard, client booking pages and salon subdomains. We also keep it off when your browser sends Do Not Track or Global Privacy Control. Google may process analytics data outside the UK. See how Google uses information from sites that use its services.

Anonymous page counting. To understand which of our public pages get visited, we count page views on our marketing pages (the homepage, pricing, find-a-salon and public salon pages) using our own first-party system. It sets no cookies and stores nothing on your device. We record the page, the site you arrived from (domain only), any campaign tag in the link you followed (such as ?via=flyer: letters, numbers and hyphens only), and whether the device was a phone or a computer. On the sign-up page we also note, once, that someone has started filling in the form, never what they typed. We do not store your IP address or browser details. They are combined into an anonymous code that changes every day, so we can count visitors for a day but can never identify you or follow you over time. If your browser sends a “Do Not Track” or Global Privacy Control signal, we don’t count you at all. Nothing is counted inside the dashboard or client portal.

Bot checks. Forms that could be abused, such as sign-up, login, booking, the waiting list and the tanning portal, use Cloudflare Turnstile to check you’re a person. It runs in a small frame from Cloudflare and sets no cookies on our site.

Local storage. If you close the “Add to home screen” prompt on a phone, your browser remembers that for 30 days so we don’t ask again. It stays on your device and isn’t sent to us. If you make a price list with our free price list maker and go on to sign up from that page, your browser keeps that list so it’s ready to add once you’re in. It stays on your device and isn’t sent to us unless you add it. We only offer it for 30 days. It’s deleted when you add it or say no thanks. If you do neither, it’s deleted the next time you open the price list maker or your Treatments page after the 30 days are up.

Essential cookies do not depend on your analytics choice. The separate optional analytics cookies are off unless you accept them. “Your settings” cookies are only set when you pick a setting yourself.

Cookies in use

NameCategoryPurposeDurationSet by
cb_analytics_consentStrictly necessaryRemembers whether you allow or reject optional website analytics. An earlier cookie-notice acknowledgement is not treated as consent.12 monthsCovered Beauty (first-party)
cb_ga / cb_ga_*Analytics (optional)Google Analytics identifiers used to understand visits to our public marketing website and clicks on trial buttons. Set only after you allow analytics.Up to 12 monthsGoogle Analytics (first-party cookies on this host)
sb-…-auth-tokenStrictly necessaryKeeps you signed in to the dashboard. Without this you would have to re-enter your credentials on every page load. Long sessions can be split across several cookies ending .0, .1 and so on.Until you log out (at most 400 days)Supabase auth (first-party)
_vcrcsStrictly necessarySet by our hosting provider, Vercel, when it checks that a visitor is a person and not a bot. It lets you through without being checked again on every page.1 hourVercel (first-party, on this host)
cb_flashStrictly necessaryCarries a one-off message, such as “Saved”, to the next page in the dashboard.30 secondsCovered Beauty (first-party)
cb_price_notesStrictly necessaryCarries the notes shown on the Treatments page straight after you schedule a price change.1 minuteCovered Beauty (first-party)
cb_kiosk_lockStrictly necessaryKeeps a salon’s tablet locked to the forms kiosk until a member of staff unlocks it with the salon’s PIN.12 hoursCovered Beauty (first-party)
cb_themeYour settingsRemembers whether you chose light or dark mode in the dashboard. Only set when you choose one.12 monthsCovered Beauty (first-party)
cb_cal_viewYour settingsRemembers the calendar view you last picked in the dashboard.6 monthsCovered Beauty (first-party)
gb_cookies_ackStrictly necessaryRecords that you have seen and dismissed our cookie notice so we don’t show it on every page.12 monthsCovered Beauty (first-party)
gb_portalStrictly necessaryKeeps tanning-shop customers signed in to their wallet portal after they verify a one-time email code. The cookie holds a signed reference to the customer record but no payment or health data.30 daysCovered Beauty (first-party)
gb_portal_joinStrictly necessaryHolds your place while you enter the code we email when you join a tanning shop’s wallet portal.20 minutesCovered Beauty (first-party)

Stripe (payment pages)

When a client is paying a deposit, the booking flow temporarily redirects them to Stripe’s hosted Checkout page. Stripe sets its own cookies on that page for fraud prevention and PCI-DSS compliance. Those cookies are governed by Stripe’s cookie policy. We never see the contents of those cookies.

How to control cookies

Choose Allow analytics or Reject analytics in the cookie controls. You can change your mind at any time. Rejecting analytics stops further measurement and removes the analytics cookies we set on this website. It does not delete reports already collected. You can also clear cookies in your browser. Removing essential authentication cookies may sign you out.

You can reopen your choices at any time by clicking here, or via the “Manage cookies” link in the footer of every page.

Contact

Questions about this policy? Email hello@covered.technology.

You also have the right to lodge a complaint with the UK Information Commissioner’s Office at ico.org.uk.

Covered Beauty is a trading name of HAMR Ltd. Registered in England and Wales. Company no. 17190046

25 Lowther Street, Whitehaven, CA28 7DG

© 2026 HAMR Ltd. All rights reserved.

Questions? We’re here.

Contact the team