Cookie Policy
← All legal documentsCrestwell sets only what it needs to work. There is no advertising, no cross-site tracking, no third-party analytics and no third-party marketing tag anywhere on this site or in the application. The public website is measured by us alone, without cookies — see "Website measurement" below. The one third-party script the website can load is the live chat, and it loads only if you open the chat — see "Live chat" below. Inside the application, the one third-party script is Stripe's card form, which loads only when a firm's owner opens it to change how the firm pays.
That is why we do not ask for your consent. Under the Privacy and Electronic Communications Regulations, consent is required for storage that is not strictly necessary for a service you asked for. Everything below is either strictly necessary or a preference you set yourself by using the product, so asking for consent would be asking permission we do not need — and offering a "reject" button for the cookie that keeps you logged in would not be a real choice.
What the public website shows instead is a notice, not a consent banner. On your first visit a small card in the bottom corner, "Essential cookies only", states the position above in two sentences and links to this page. Nothing waits on it and there is nothing to accept or reject. Pressing Got it (or Esc) folds it into a small cookie button in the same corner, which opens it again; your browser remembers that you closed it (see "Local storage on your device" below). The notice is not shown inside the application.
If that ever changes — if we add product analytics inside the application, for example — this page changes first, and a consent banner appears before any such storage is set.
Cookies
| Cookie | Set by | Purpose | Type |
|---|---|---|---|
sb-<project>-auth-token (and its chunked parts) |
Supabase, our authentication provider | Keeps you signed in and identifies your session on each request. Without it you cannot log in. | Strictly necessary |
| Session cookies set during payment | Stripe, on Stripe's own checkout and billing pages — and in the application's Billing settings only after a firm's owner opens the card form to change how the firm pays | Fraud prevention and completing a payment, or saving a card, that you initiated. Governed by Stripe's own cookie policy. | Strictly necessary |
crisp-client/* |
Crisp, our live-chat provider — only after you open the chat | Keeps your conversation with us together as you move between pages, so you do not have to start again. Governed by Crisp's own cookie policy. | Strictly necessary for the chat you opened |
We do not set any cookie of our own for measurement, profiling or advertising.
Live chat
The chat button on the public website is ours and loads nothing. Pressing it shows what opening the chat does; only when you choose Start chat is Crisp's script loaded and its cookie set. Until then no request is made to Crisp and nothing is stored. If you would rather not, write to us instead — the address is on the same card. The chat is not offered inside the application.
What you type in the chat is processed by Crisp on our behalf (see the privacy notice). Please do not put a client's details into it: the chat is for questions about Crestwell, and a client file belongs in the product, not in a support conversation.
Local storage on your device
The application, and in one case the public website, stores a small amount of data in your browser rather than on our servers. It never leaves your device, is not readable by us, and is not used to track you across sites. Clearing your browser data removes all of it.
| What | Why |
|---|---|
| Appearance preferences — theme, colour and font choices | So the product looks the way you left it |
| Sidebar collapsed / expanded, list view choices | Interface state between visits |
| A cached copy of your firm's name, logo and document template settings | So your branding renders immediately instead of flashing the default first |
| A note of which fact-find form your firm uses | So a saved document opens straight onto the right layout |
| Fact-find data held while you move between the review and edit screens (session only) | So work in progress is not lost mid-flow. Cleared when the tab closes. |
| A "don't count this browser" mark — set only by our own team, on the console's analytics page | So the website measurement below leaves that browser out. It holds a single flag and no identifier. |
| A note that you closed the cookie notice — public website, set only when you press Got it | So the notice stays folded into its small button instead of opening on every page. It holds a single flag and no identifier. |
Website measurement
Since 14 September 2026 the public website — the home page, the product, pricing, blog, guides, help and other public pages, and the sign-up page, and since 25 October 2026 the demo and the early-access page — records how it is used, so that we know which pages are read, for how long, what people press, and how far the demo is followed. It does this without cookies and without storing anything on your device:
- Each page view is recorded with the page, the day, the site you came from (its domain only), any campaign tag in the link you followed, your country, and whether you were on a phone, a tablet or a desktop.
- When you leave the page, how long it was actually in front of you and how far you scrolled are added to that view. Clicks on links and buttons are recorded with the words on the link and where it led.
- The demo — on the demo page, and where the early-access page plays it in place — records whether it was opened and started, which of its steps were shown, which of its workflows were followed to the end, and how long the demo was in front of you, with the clock stopped while the tab is hidden. These records are grouped by a random number made for that one pass through the demo. The number is held only in the page's memory while the demo is open, is never stored on your device and is not used again. Each record is tied to the page view it happened on, and holds no address, country or browser details of its own.
- You are counted as one visitor for one day by a keyed hash of your IP address and browser, made with a key that changes every day and is never stored. The hash cannot be turned back into your address, and yesterday's visitors cannot be matched to today's. Your IP address itself is never written down.
- Nothing is set on your device — no cookie, no local storage, no fingerprint of your screen, fonts or hardware. The only thing read is the "don't count this browser" mark above, if one was set, so that it can be honoured. No third party receives any of it.
- The application — the dashboard, the client portal and the consoles — is not measured. The demo is part of the public website: it plays back captured screens of the application, not the application itself, so what it records is website measurement.
The records are held for 400 days and then deleted. The lawful basis is our legitimate interest in knowing whether the website works (see the privacy notice). The consent rule in PECR is not engaged: nothing is stored on your device, and the one mark that may be read is a setting the person chose, read only to do what they asked; we tell you here instead.
What we do not do
- No third-party analytics or product telemetry. We do not use Google Analytics, Meta Pixel, Hotjar, Segment, PostHog, or any equivalent. The website measurement above is ours, cookieless, and does not reach the application.
- No advertising or remarketing tags, and no data shared with ad networks.
- No cross-site tracking, and no third-party cookies for profiling.
- No fingerprinting.
Controlling cookies
Because everything we set is strictly necessary or a preference you chose, there is nothing to switch off in the product. You can still block or delete cookies in your browser settings — blocking the authentication cookie will prevent you signing in.
Clearing your browser's local storage resets the preferences above; nothing is lost from your account, since your firm's data lives on our servers.
Changes
If we introduce any non-essential storage, we will update this page and ask for your consent before setting it.