Cookie Policy

3.1 Strictly necessary cookies

These cookies are essential for the website to function. They enable core features such as security, session management, and accessibility. These cookies do not require your consent under PECR.

Our lawful bases for processing personal data collected via cookies under the UK GDPR are:

You have the right to withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal.

3.2 Functional cookies

These cookies remember choices you make (such as language or region) to provide a more personalised experience.

3.3 Analytics cookies

These cookies collect aggregated, anonymised information about how visitors use our website, helping us improve its performance and content.

3.4 Marketing and advertising cookies

If you consent, these cookies may be used to track your browsing activity across websites and deliver targeted advertising.

The cookies listed above are representative. Actual cookie names and durations may change as we update our services.

3.5 Local storage and session storage

In addition to cookies, we store the following data in your browser's web storage:

Local storage data persists until you clear your browser data or we delete it (e.g. on consent withdrawal). Session storage data is automatically cleared when you close the browser tab.

5.1 Heatmaps

We record click, scroll, and mouse/touch movement data to generate heatmaps showing how visitors interact with each page. Data collected includes:

• Click coordinates and the CSS selector of the clicked element
• Scroll depth and time spent at each scroll position
• Mouse and touch movement paths (coordinates, viewport dimensions, scroll position)

Heatmap data is aggregated and does not capture text input, passwords, or personally identifiable information.

5.2 Session replay

We use session replay technology (powered by rrweb) to record and play back individual browsing sessions. A session replay captures:

• DOM structure and visual changes on the page
• Mouse movements, clicks, and scroll activity
• Form interactions (input fields are masked by default — no actual values are recorded)

Session replays help us identify usability issues and bugs. Sensitive content is masked or blocked according to our privacy configuration. Passwords and fields marked as sensitive are never recorded.

5.3 Screenshot capture

We may capture visual snapshots of pages as they appear in your browser. Screenshots are used to monitor page layout and detect visual regressions. Data collected includes:

• A rendered image of the visible page area (sensitive elements are masked or excluded)
• Viewport dimensions, device type, scroll position, and page path

Screenshots are subject to per-session rate limits and deduplication. Password fields and elements that we have configured as sensitive are excluded from captures.

5.4 Form analytics

We track how visitors interact with forms on our website to identify friction points and improve form design. Data collected includes:

• Which fields were focused, how long was spent on each field, and the order of interaction
• Hesitation events (pausing within a field beyond a threshold)
• Refill events (clearing and re-entering a field)
• Validation error counts and messages
• Whether the form was submitted or abandoned, and which field was last interacted with before abandonment

We do not capture the actual values entered into form fields. Only interaction metadata is recorded.

5.5 Rage click detection

We detect rapid repeated clicks on the same element (known as "rage clicks"), which typically indicate user frustration. Data collected includes:

• The CSS selector of the element being clicked
• Click count and coordinates
• The time window in which the clicks occurred

5.6 Scroll depth milestones

We track how far down a page visitors scroll, recording when configurable depth thresholds are reached (e.g. 25%, 50%, 75%, 100%). Data collected includes:

• The milestone percentage reached
• Page path, document height, and viewport height

5.7 Error tracking

We capture uncaught JavaScript errors and unhandled promise rejections that occur in your browser. This helps us identify and fix bugs. Data collected includes:

• Error message, type, and stack trace (truncated to 2,000 characters)
• The filename and line number where the error occurred
• Page path and session identifier
• Error data is deduplicated and rate-limited per session. Stack traces may contain file paths from our code, but do not contain user input.

5.8 Impression tracking

We track ad impression identifiers passed via URL parameters or cookies to measure advertising effectiveness. Data collected includes:

• The impression identifier
• Page path, session ID, and visitor ID
• Timestamp

5.9 Live chat tracking

Where our website uses a third-party live chat widget (such as Drift, Intercom, or LiveChat), we detect when chat conversations are started and track these as conversion events for marketing attribution. Data collected includes:

• The chat provider name and event type (e.g. conversation started)
• Conversation identifier (where provided by the chat widget)
• Session ID, visitor ID, and marketing attribution context (first touch, last touch, click IDs)
• Page path and timestamp
• We do not capture the content of chat messages. Only the fact that a conversation occurred is recorded.

5.10 eCommerce purchase tracking

We detect purchase events from eCommerce platforms (including Google Tag Manager, GA4, WooCommerce, and Shopify) to attribute transactions to marketing sources. Data collected includes:

• Transaction ID, revenue amount, and currency
• Item details (product ID, name, price, quantity)
• Session ID, visitor ID, and marketing attribution context
• Page path and timestamp

This data is used solely for marketing attribution and is deduplicated per session to prevent double-counting.

5.11 Dynamic Number Insertion (DNI)

We may replace phone numbers displayed on our website with tracking numbers so that inbound calls can be attributed to the marketing source that brought you to the site. When this feature is active:

• Phone numbers visible on the page are swapped with tracking numbers assigned to your marketing source
• A session cookie (sadang_dni) stores the assigned tracking number so it remains consistent during your visit
• A number_swap event is recorded containing the original number, tracking number, and marketing source
• The original phone numbers are restored if you withdraw consent. No call content or personal information is captured through this feature.

5.12 Web performance metrics (Core Web Vitals)

We collect browser performance metrics to monitor and improve the speed and responsiveness of our website. Metrics collected include:

• Largest Contentful Paint (LCP) — how quickly the main content loads
• Interaction to Next Paint (INP) — responsiveness to user interactions
• Cumulative Layout Shift (CLS) — visual stability of the page
• Time to First Byte (TTFB) — server response time

These metrics are collected using your browser's built-in PerformanceObserver API and contain no personally identifiable information.

5.13 Visitor identity and marketing attribution

We assign each visitor an anonymous unique identifier, stored either in a first-party cookie (sadang_vid, lasting up to 2 years) or in your browser's local storage. This identifier does not contain your name, email, or any personal details — it is a randomly generated code used to link your visits together for analytics purposes.

We also maintain a record of up to 20 marketing attribution touchpoints (such as the UTM parameters, referrer, and landing page from each visit) in your browser's local storage. This helps us understand which marketing channels are driving traffic and conversions.

Additionally, we track page engagement by measuring how long the page is visible in your browser and sending periodic heartbeat events. On page exit, a final engagement summary is sent.

5.14 Marketing tag management

If you have multiple tabs of our website open, we synchronise your consent preferences, visitor identity, and user associations across those tabs in real time. This means that if you withdraw consent in one tab, all other open tabs will immediately stop tracking. This synchronisation uses your browser's BroadcastChannel API or local storage events and does not involve any network requests.

5.15 Data minimisation

All behavioural analytics features are designed with data minimisation in mind:

• No actual form values, passwords, or free-text input are captured
• Sensitive page elements can be masked or excluded via configuration
• Data is aggregated where possible and subject to per-session rate limits

All features respect your cookie consent preferences and deactivate immediately if consent is withdrawn