Cookie Policy
What this site stores on your device, who sets it, how long it stays, and how to change your mind.
Last updated 2026-09-29. Policy version 1.
Your settings
Your browser has JavaScript turned off, so no optional tools can run. Nothing to change.
Your Privacy Choices
We do not sell personal information. Some ad tools, if we switch them on, could count as "sharing" for targeted ads under California law. You can turn them off here in one step. It also works if your browser sends Global Privacy Control (GPC): we treat GPC as a request to opt out, and marketing tools stay off.
How we decide what runs
- EU, EEA, UK, Switzerland, Brazil and Quebec (33 countries plus Quebec): nothing optional runs until you choose. Reject all is as easy as Accept all.
- US and everywhere else: you see the same choice. Until you choose, only cookieless page counting runs (Cloudflare Web Analytics, if on). Analytics cookies and ad tools wait for Accept.
- Global Privacy Control: honored everywhere. Marketing tools stay off even if you click Accept all.
- We work out your region from your connection's country. We do not store your IP address for this.
What we use
Necessary items run for everyone. Analytics and marketing tools run only as described above. This table updates when we switch a tool on or off.
| Name | Tool and company | Type | What it does | How long | Legal basis |
|---|---|---|---|---|---|
| curo_consent | Consent record CuroForm (first party) | First-party cookie | Stores your choices, the policy version, a random consent ID and the time you chose, so we do not ask on every page. Set only once you choose. | 6 months | Strictly necessary. Keeping proof of consent is a legal duty (GDPR Art. 7(1)). |
| Not on your device | Consent log (server) CuroForm on Cloudflare D1 | Our database | When you choose, we log the same random consent ID, your choices, the policy version, the time, your country and whether your browser sent GPC. No IP address. | 24 months, then deleted automatically | Legal obligation to show consent (GDPR Art. 6(1)(c), 7(1)). |
| Name | Tool and company | Type | What it does | How long | Legal basis |
|---|---|---|---|---|---|
| No cookies or storage | Cloudflare Web Analytics Cloudflare, Inc. (US) | Script and beacon from cloudflareinsights.com | Counts page views, referrers and load speed in aggregate. Sets no cookies, uses no local storage and builds no visitor ID. Query strings are not logged. | None on your device | Opt-in regions: consent. Elsewhere: legitimate interest in basic site statistics. Runs before you choose; Reject all turns it off. |
| _ga | Google Analytics 4 Google LLC (US) / Google Ireland Ltd. | First-party cookie | Tells visits apart with a random client ID so we can count returning visitors and see which pages lead to a quote request. Google signals and ad personalization are off. Google keeps the event and user data behind it for 2 months. | Up to 13 months (we set cookie_expires to 395 days; Google's default is 2 years) | Consent, everywhere. |
| _ga_5EFS6JLYBP | Google Analytics 4 Google LLC (US) / Google Ireland Ltd. | First-party cookie | Keeps session state (session count and time) for our GA4 property. | Up to 13 months (same cap) | Consent, everywhere. |
Marketing
No marketing tools are switched on right now. Nothing in this group runs.
Tools we may add later (not running now)
If we switch one on, it moves into the table above, the policy version goes up and you are asked again.
| Name | Tool and company | Type | What it does | How long | Legal basis |
|---|---|---|---|---|---|
| No cookies by default | Cloudflare Turnstile (contact page) Cloudflare, Inc. (US) | Script and frame from challenges.cloudflare.com | Spam check on the quote form, once we switch it on. Reads browser signals and your IP to tell people from bots. Loads only on the contact page. | None on your device | Strictly necessary for the form you asked to send; legitimate interest in stopping abuse. |
| _gcl_au | Google Ads conversion tracking Google LLC (US) / Google Ireland Ltd. | First-party cookie | Links an ad click to a later quote request so we can see which ads work. | 90 days | Consent in opt-in regions. US and elsewhere: off until you accept, and always off when your browser sends GPC. |
| _gcl_aw | Google Ads conversion tracking Google LLC (US) / Google Ireland Ltd. | First-party cookie | Stores the Google ad click ID when you arrive from an ad. | 90 days | Consent in opt-in regions. US and elsewhere: off until you accept, and always off when your browser sends GPC. |
| IDE, test_cookie | Google Ads conversion tracking Google LLC (US) / Google Ireland Ltd. | Third-party cookies on doubleclick.net | Set by Google for ad measurement. We cannot read or delete them; clear them in your browser. | IDE 13 months, test_cookie 15 minutes | Consent in opt-in regions. US and elsewhere: off until you accept, and always off when your browser sends GPC. |
| li_fat_id | LinkedIn Insight Tag LinkedIn Ireland Unlimited Co. / LinkedIn Corp. (US) | First-party cookie | Indirect LinkedIn member ID for conversion tracking and retargeting. | 30 days | Consent in opt-in regions. US and elsewhere: off until you accept, and always off when your browser sends GPC. |
| ln_or | LinkedIn Insight Tag LinkedIn Ireland Unlimited Co. / LinkedIn Corp. (US) | First-party cookie | Checks whether LinkedIn site analytics can run on this domain. | 1 day | Consent in opt-in regions. US and elsewhere: off until you accept, and always off when your browser sends GPC. |
| li_adsId | LinkedIn Insight Tag LinkedIn Ireland Unlimited Co. / LinkedIn Corp. (US) | Local storage | Browser ID the Insight Tag keeps for ad measurement. | Until cleared (we clear it when you turn marketing off) | Consent in opt-in regions. US and elsewhere: off until you accept, and always off when your browser sends GPC. |
| li_sugr, bcookie, lidc, UserMatchHistory, AnalyticsSyncHistory, li_gc, _guid | LinkedIn Insight Tag LinkedIn Ireland Unlimited Co. / LinkedIn Corp. (US) | Third-party cookies on linkedin.com | Set by LinkedIn for matching, ad measurement and its own consent record. We cannot read or delete them. | 24 hours to 1 year | Consent in opt-in regions. US and elsewhere: off until you accept, and always off when your browser sends GPC. |
| hubspotutk | HubSpot tracking code HubSpot, Inc. (US) | First-party cookie | Visitor ID that HubSpot links to your contact record when you send a request. | 6 months | Consent in opt-in regions. US and elsewhere: off until you accept, and always off when your browser sends GPC. |
| __hstc | HubSpot tracking code HubSpot, Inc. (US) | First-party cookie | Main HubSpot visitor cookie: first and last visit times, session count. | 6 months | Consent in opt-in regions. US and elsewhere: off until you accept, and always off when your browser sends GPC. |
| __hssc | HubSpot tracking code HubSpot, Inc. (US) | First-party cookie | Counts page views in a session. | 30 minutes | Consent in opt-in regions. US and elsewhere: off until you accept, and always off when your browser sends GPC. |
| __hssrc | HubSpot tracking code HubSpot, Inc. (US) | First-party cookie | Detects a browser restart. | Session | Consent in opt-in regions. US and elsewhere: off until you accept, and always off when your browser sends GPC. |
| __cf_bm, __cfruid | HubSpot tracking code HubSpot, Inc. (US) | Cookies from HubSpot's CDN | Bot protection and rate limiting for HubSpot scripts. | 30 minutes / session | Consent in opt-in regions. US and elsewhere: off until you accept, and always off when your browser sends GPC. |
| __hmpl, hublytics_events_53 | HubSpot tracking code HubSpot, Inc. (US) | Local or session storage | Queues tracking events before they are sent. | Until cleared | Consent in opt-in regions. US and elsewhere: off until you accept, and always off when your browser sends GPC. |
| _clck, _clsk | Microsoft Clarity (session replay) Microsoft Corp. (US) | First-party cookies | Clarity user ID and session grouping. | 1 year / 1 day | Consent, everywhere. |
| CLID, MUID, ANONCHK, MR, SM | Microsoft Clarity (session replay) Microsoft Corp. (US) | Third-party cookies on clarity.ms and bing.com | Microsoft IDs used across sites, including for advertising. | Session to 1 year | Consent, everywhere. |
| _fbp, _fbc | Meta Pixel Meta Platforms, Inc. (US) / Meta Platforms Ireland Ltd. | First-party cookies | Browser and click IDs for Meta ad measurement. | 90 days | Consent, everywhere. |
| fr | Meta Pixel Meta Platforms, Inc. (US) / Meta Platforms Ireland Ltd. | Third-party cookie on facebook.com | Meta ad delivery and measurement. | 90 days | Consent, everywhere. |
What we never do
- No session replay and no recording of what you type.
- No chat widgets that pass your messages to a third party.
- No ad pixels on the quote form's content. The form goes to our own server, not to an ad or analytics tool.
Browser controls
You can also block or delete cookies in your browser settings. Third-party cookies set by Google, LinkedIn or others on their own domains can only be cleared there. Blocking all cookies does not break this site.
Questions
Email hello@curoform.com. Our Privacy Policy explains how we handle the details you send us.