1. What are cookies
Cookies are small text files stored on your device when you visit a website. They are widely used to make websites work efficiently, to remember preferences, and to provide information to the site owners. The same techniques include localStorage, sessionStorage, pixel tags and similar device identifiers — we refer to all of these collectively as “cookies” in this policy.
This Cookie Policy is part of, and should be read together with, our Privacy Policy.
2. How we use cookies
We use cookies for three main purposes:
- Essential — to authenticate you, secure your session, prevent fraud and remember basic preferences. These cannot be turned off because the Services would not function without them.
- Analytics — to understand aggregate usage of our website and product, so we can improve features and fix bugs. We use privacy-respecting analytics and only set these cookies if you opt in.
- Marketing — on our public marketing site only, and only with your consent, to measure the effectiveness of advertising campaigns. We never set targeting cookies inside the Huup product.
3. Cookie categories
The table below summarises the categories of cookies we use, with representative examples, retention periods and whether consent is required.
| Category | Purpose | Examples | Retention | Party | Consent |
|---|---|---|---|---|---|
| Strictly necessary | Authentication, security, load balancing, fraud prevention. Cannot be disabled. | huup_session, huup_csrf, __cf_bm | Session cookies (cleared on browser close) or persistent authentication tokens of up to 30 days | 1st / 3rd | Not required (essential) |
| Performance | Aggregated, privacy-respecting analytics so we can understand how the Services are used and fix issues. | _ga, _ga_* | Up to 12 months | 1st / 3rd | Opt-in |
| Functional | Remember your preferences (language, theme, dismissed banners) and improve usability. | huup_locale, huup_theme, huup_dismiss_* | Up to 12 months | 1st party | Opt-in |
| Targeting | Used by limited advertising partners to measure campaign effectiveness on our marketing site only. Never used inside the product. | _fbp, _gcl_au | Up to 13 months | 3rd party | Opt-in |
4. Third-party cookies
Some cookies are set by third parties that help us run our Services. The current providers include:
- Cloudflare — edge security, DDoS protection and bot mitigation. Sets cookies such as
__cf_bm. - Google Analytics 4 (Google) — measures how visitors use our public marketing site so we can improve it. Loaded through Google Tag Manager and set only with your consent; we use Google Consent Mode so no analytics cookies or identifiers (such as
_ga) are set until you opt in. - Stripe — payment processing on our billing pages, used for fraud detection during checkout.
- Meta Pixel and Google Ads (marketing site only, with consent) — measure the effectiveness of our advertising and build remarketing audiences. Where Meta's Advanced Matching is enabled, hashed contact details you submit on our site (such as your email address) may be shared with Meta to match conversions to people on Facebook and Instagram. These tags fire only after you accept marketing cookies.
- Lifecycle messaging — Customer.io (or the provider listed in our current sub-processor list) may set a browser-side tracking pixel or cookie on our public marketing site (with your consent) to measure lifecycle campaign effectiveness. This provider is not active inside the authenticated Huup product.
We do not control third-party cookies. Please review each provider’s own privacy policy for details.
5. Managing your cookie preferences
You can change your preferences at any time:
- Preference centre — use the “Cookie settings” link in our website footer to enable or disable analytics and marketing cookies. Your preference is stored as a first-party cookie for up to 12 months, after which you will be prompted to review your preferences again.
- Browser controls — all major browsers let you delete cookies, block them, or be notified when one is set. Disabling essential cookies will prevent you from signing in to Huup.
- Opt-out tools — the Your Online Choices tool lets you opt out of many advertising cookies in one place.
6. Do Not Track signals
We respect a Global Privacy Control (GPC) signal where one is detected, and treat it as a withdrawal of consent for non-essential cookies. The GPC signal is recognised as a valid opt-out mechanism under UK data protection guidance. We do not currently honour the older “Do Not Track” (DNT) header because the standard was not widely adopted and may not reliably reflect user intent; we will revisit this if industry guidance changes.
7. Updates to this policy
We may update this Cookie Policy from time to time. We will post the new version at this URL and update the “Last updated” date. Where the changes are material — such as the introduction of a new cookie category or a new third-party provider — we will re-prompt for your consent through the preference centre before those changes take effect.
9. Legal framework (PECR & UK GDPR)
Our use of cookies is regulated by the Privacy and Electronic Communications Regulations 2003 (as amended) (PECR) and the UK GDPR. Where cookies involve the processing of personal data, the lawful basis for that processing is set out in our Privacy Policy. PECR requires us to obtain your prior consent before setting any cookie that is not strictly necessary for a service you have requested — this is why we present a preference centre on your first visit.
10. IAB Transparency and Consent Framework
Huup does not participate in the IAB Transparency and Consent Framework (IAB TCF) and does not use an IAB-registered consent management platform. If you encounter a TCF-style consent string or consent pop-up that appears to originate from Huup, please report it to [email protected].
11. Contact
Questions about this policy or our use of cookies can be sent to: