Cookie Policy

Status: DRAFT — for review only. This document is not in force.
Version: 1.0 (draft, 14 July 2026)
Last reviewed: 14 July 2026. The cookie declaration inside the consent banner (“Manage cookie settings”) is the authoritative, current list of the cookies in use and their lifetimes.
Who we are / what this covers: This Cookie Policy is issued by Briter Bridges Ltd, trading as "Briter", a company registered in England and Wales (company number 11653314), registered office: Castle House, Castle Street, Guildford, Surrey, England, GU1 3UW, United Kingdom ("we", "us", "Briter"). It covers all three of our digital products (together, the "Services"): (1) the Briter website at briter.co (including www.briter.co); (2) the Briter Intelligence platform at intelligence.briter.co (including its subdomains); and (3) the AgBase platform at intelligence.agbase.briter.co (including its subdomains); together with all briter.co subdomains. The first-party _br_session authentication cookie, set by our authentication service on the shared .briter.co domain, is used to keep you signed in to the Services (Section 5). Briter Intelligence and AgBase are together the "Platforms".

This policy should be read together with our Privacy Policy and Terms & Conditions. The Privacy Policy explains how we use the personal data that cookies and similar technologies help us collect, and sets out your data-protection rights.

Key points

• We use cookies and similar technologies (including browser local storage, session storage and script SDKs) for sign-in and security, analytics and advertising measurement (the latter on the website only, and only after you accept the marketing category — see Sections 5 and 7).
• No cookies or device storage for analytics are used until you accept them in the consent banner. Strictly necessary technologies are always active. If you reject analytics — or before you make a choice on the Platforms — we may count page views only with a cookieless method: nothing is stored on your device, no identifier is used, and your IP address is discarded at ingestion (Section 3.3).
• All three Services use the Cookiebot (Usercentrics) consent banner. You can accept or reject each optional category independently, and change or withdraw your choice at any time — see Section 4.
• If you reject analytics, the Services work exactly the same. No cookie is set and nothing is stored on your device — at most your page views are counted anonymously, as described in Section 3.3.
• Our analytics and error-monitoring tools run on EU servers (PostHog — EU Cloud; Mixpanel — EU residency, server-side events only, see Section 5.2; error monitoring — EU data residency). Some providers (Google, Stripe) may process data in the United States — see the Privacy Policy for transfer safeguards.
• Questions: privacy@briter.co.

1. Scope of this policy

This policy explains what cookies and similar technologies are, which ones we use on each of the Services, why we use them, how we obtain your consent, and how you can change your mind. It applies to anyone visiting or using the Services, whether or not you hold an account.

Where a technology behaves differently on a specific product, we say so expressly. Each Service asks for your consent separately. If you accept statistics on more than one Service, the analytics cookie is set on the shared .briter.co domain, so the same pseudonymous identifier links your activity across the Services on which you have consented — this is how we understand journeys between the Services (Section 5). Analytics capture on each Service is consent-gated: no analytics events are captured or sent from a Service until your consent choice on that Service has been resolved.

2. What cookies and similar technologies are

Under the EU ePrivacy Directive and the UK Privacy and Electronic Communications Regulations 2003 ("PECR"), the rules cover any storing of information, or access to information already stored, on your device — not just cookies. In this policy, "cookies and similar technologies" therefore includes:

• Cookies — small text files placed on your device by a website. First-party cookies are set by the domain you are visiting; third-party cookies are set by another domain.
• Local storage and session storage — browser storage used by scripts to keep identifiers or state on your device. PostHog keeps an analytics identifier in local storage; it is pseudonymous until you sign in, at which point (if you have accepted the statistics category) your analytics profile is linked to your account, including your name and email address (see the Privacy Policy, Section 3). Our Platforms use local storage for product features and session storage for sign-in flows (see the tables in Section 5).
• Scripts and SDKs — JavaScript libraries (for example the PostHog and Stripe.js scripts, and — on the website — Google Tag Manager) that may read or write cookies/storage and send data from your browser to a provider.
• Tracking pixels / web beacons — tiny images or code in web pages or emails that record that content was viewed. Our transactional and marketing emails are sent through Mailjet; our sending code does not enable open- or click-tracking on any email (see Section 5.5).

We treat all of these the same way for consent purposes.

3. Legal framework

3.1 Consent rule and the exemptions

PECR (Regulation 6) in the UK and Article 5(3) of the ePrivacy Directive (as implemented in EU member states) require your prior consent before we store or access anything on your device, except where (a) the storage or access is for the sole purpose of carrying out the transmission of a communication over an electronic communications network, or (b) it is strictly necessary to provide an information society service you have requested (the Directive's wording: "explicitly requested") — for example, keeping you signed in, security, load balancing, or remembering your cookie choice. Consent must meet the UK GDPR / EU GDPR standard: freely given, specific, informed and unambiguous, given by clear affirmative action, and as easy to withdraw as to give (Article 7(3)).

3.2 Analytics requires consent

We treat analytics cookies and analytics storage as requiring consent in both the UK and the EU, and we do not rely on any analytics exemption, including the UK statistical/analytics exception introduced by the Data (Use and Access) Act 2025.

3.3 Cookieless audience measurement if you reject analytics, or before you make a choice

This applies if you reject analytics — or before you make a choice in the consent banner on the Platforms. In either case, our PostHog analytics may count page views only in a cookieless mode: no cookie is set, nothing is stored on your device, no identifier is stored on or read from your device, no profile is built, your IP address is discarded at ingestion, and page views are attributed to a short-lived, server-generated hash, retained only as aggregate statistics. Because nothing is stored on your device, we consider this to fall outside the PECR/ePrivacy consent requirement, and we rely on our legitimate interest in basic audience measurement under the UK/EU GDPR.

If you reject analytics, this anonymous page-view counting is the only measurement that continues — no cookies, no device storage, no identifiers, page views only. On the website, the banner appears immediately on your first visit and our analytics is decision-gated (Section 4.1), so in practice the website counts nothing before you have chosen.

4. How we ask for your consent, and how to change it

All three Services use the Cookiebot consent management platform operated by Usercentrics A/S. The banner appears on your first visit and offers separate accept/reject choices for each optional category (necessary, preferences, statistics, marketing). We do not currently use any preferences cookies on any Service, or any marketing cookies on the Platforms; the empty categories appear so that any future additions would require your fresh consent. Your choice is recorded in the strictly necessary CookieConsent cookie, and Cookiebot keeps a consent record (consent state, consent ID, date, your browser's user-agent string and an anonymised IP address), kept as evidence of your choice for up to 12 months from when the consent is given or renewed.

4.1 Website (briter.co)

The Cookiebot banner loads before any other script and automatically blocks known consent-dependent scripts (see Section 5.4 for the technologies that operate before consent). Our analytics is additionally decision-gated in our own code: until you make a choice, our analytics captures nothing; if you reject, at most the cookieless page-view counting described in Section 3.3 runs — no cookies, nothing stored on your device; if you accept statistics, analytics cookies are set. To change or withdraw your consent at any time, use the "Change your consent" / "Withdraw your consent" links in the Cookie Declaration on the website's cookie policy page.

4.2 Briter Intelligence (intelligence.briter.co)

The Cookiebot banner loads directly on the Platform (manual blocking mode); consent is enforced in our application code, per tool:

• Mixpanel — not used browser-side on the Platforms (see Section 5.2). Certain server-side events about actions you take while signed in (for example, sign-ins and downloads) are recorded on our systems without using cookies — see the Privacy Policy, Section 4.
• PostHog — initialises without setting cookies. Until you make a choice on the statistics category — and if you reject it — it captures only the cookieless page views described in Section 3.3 (no cookies, nothing stored on your device, no identifier). Cookies are set, and signed-in users are identified for analytics, only after you accept.
• Error monitoring is not consent-gated — see Section 5.4.

You can review or withdraw consent at any time via the "Manage cookie settings" button on the Platform's cookie policy page, which re-opens the banner.

4.3 AgBase

Identical mechanism to Briter Intelligence (Section 4.2): Cookiebot banner, the same code-enforced gating on the statistics category, and a "Manage cookie settings" button on the AgBase cookie policy page to change or withdraw consent.

4.4 Re-prompt cadence and banner availability

We will re-request consent when we make significant changes to the cookies or providers we use. In addition, your recorded consent expires periodically (typically after 12 months), at which point the banner re-appears so you can confirm or change your choice.

If the consent banner fails to load (for example, because it is blocked by a browser extension), no consent-dependent cookies or device storage are activated; however, the technologies described in Sections 3.3 and 5.4 (on the Platforms, cookieless counting while no choice has been recorded, and error monitoring) still operate. To clear any previously set cookies, delete cookies and site data for *.briter.co in your browser settings (Section 9), or unblock the banner and use its withdrawal controls. For questions, contact privacy@briter.co.

5. Cookies and storage we use

The tables below are based on our most recent audit; the cookie declaration inside the consent banner is the always-current list. The live, automatically updated declaration embedded on each product's cookie policy page is that always-current itemised list; if it fails to load, the tables below are the operative disclosure.

"Duration" means the on-device lifetime of the cookie or storage item. How long we keep the resulting data on our or our providers' servers (for example, PostHog analytics data is retained for up to 24 months) is set out in the Privacy Policy.

Additional cookies may be set by tags delivered through the website's Google Tag Manager container once it has loaded following your marketing consent (Sections 5.4 and 7); any such cookies appear in the live Cookiebot declaration, which remains the always-current itemised list.

5.1 Website (briter.co)

Contact-form submissions on the website are sent to HubSpot server-side — no HubSpot script runs and no HubSpot cookie is set in your browser (no HubSpot form is currently embedded on briter.co, and no HubSpot cookies appeared in our most recent audit). Demo bookings and some forms take place on HubSpot's own EU-hosted pages (meetings-eu1.hubspot.com, share-eu1.hsforms.com), where HubSpot sets cookies under its own cookie policy. No HubSpot script or tracking code loads on any live website page, and the contact form submits server-side. If an embedded HubSpot form ships in future, its cookies (__hstc, hubspotutk — 6 months; __hssc — 30 minutes) will be added to this table.

5.2 Briter Intelligence (intelligence.briter.co)

Notes to this table:

• Mixpanel: The Mixpanel browser SDK is not currently used on the Platforms; product events involving your account are recorded server-side (see the Privacy Policy, Section 4). If we enable browser-side Mixpanel in future, we will update this policy and the consent banner first.
• Error monitoring: runs on the Platforms to detect and fix faults; it stores nothing on your device and is not consent-gated (Section 5.4).
• Stripe classification and scope: we classify Stripe's fraud-prevention cookies as strictly necessary to secure payment and prevent fraud during checkout. Stripe's script loads only on the checkout route on both Platforms.
• AI Assistant threads: the Platform keeps a local copy of your AI Assistant conversation threads (which may include text you typed) on your own device so the Assistant can restore them. Thread history is not cleared when you log out: it persists in your browser's local storage until you delete the threads in the Assistant or clear site data for the Platform. On a shared device, clear site data (or use a private window) if you do not want threads to remain after logout.
• Google cookies: no Google tags are present in the current Platform code. The shared Cookiebot declaration lists Google cookies at the level of the domain group (briter.co + intelligence.briter.co), which does not distinguish which domain sets them; the tables above list only the cookies and storage the Platforms themselves use.

5.3 AgBase (intelligence.agbase.briter.co)

The notes under the Briter Intelligence table (Mixpanel, error monitoring, Stripe classification and scope, AI Assistant threads, Google cookies) apply equally to AgBase, including the Section 5.2 Mixpanel note.

5.4 Technologies that load before consent

For transparency, the following run before or regardless of your banner choice. None of these pre-consent technologies is used for advertising:

• Cookiebot itself (needed to ask for consent) — strictly necessary.
• Google Tag Manager (website only) — does not load before consent: the tag manager container is loaded only after you accept the marketing category in the consent banner; until then googletagmanager.com receives nothing from your browser (no IP address, no page URL). As an additional safeguard, Google Consent Mode v2 defaults are set to denied before the container can load, and the tags inside the container fire only in accordance with your banner choices (see Section 7). Google Tag Manager does not run on the Platforms.
• Error monitoring (Platforms only): error monitoring starts at page load on the basis of our legitimate interest in keeping the Platforms secure and working. It stores nothing on your device; error reports are processed with EU data residency.
• Stripe (Platforms, checkout pages): Stripe's script loads only on the checkout route, to secure payment and prevent fraud.
• PostHog cookieless counting as described in Section 3.3 (page views only; no device storage, no identifier, IP discarded at ingestion; runs before you make a banner choice on the Platforms and continues, as the only measurement, if you reject analytics).

5.5 Email pixels

Emails we send through Mailjet (sign-in codes, password resets, newsletters you have opted into) are sent without open- or click-tracking enabled in our sending code — no tracking flags are set on any send, so our emails should not contain tracking pixels. You can additionally prevent any pixel tracking by disabling image loading in your email client; transactional emails work regardless.

6. Third-party providers

International data transfers and safeguards (EU SCCs, UK IDTA/Addendum, EU–US Data Privacy Framework where applicable) are described in our Privacy Policy.

7. Google Consent Mode (website only)

Google measurement tags on the website are delivered through our tag manager container, and the container itself is loaded only after you accept the marketing category in the consent banner — no Google script runs, and googletagmanager.com receives nothing, before that consent. As an additional safeguard, Google Consent Mode v2 defaults are set to denied: on every page, a first-party script sets ad_storage, analytics_storage, ad_user_data and ad_personalization to "denied" (with ads data redaction enabled) before the tag manager container can load. Cookiebot signals your banner choice to Google via Consent Mode, and Google cookies — all of which sit in the marketing category (Section 5.1) — are set only after you accept marketing.

8. Do Not Track and Global Privacy Control

We currently treat your choice in the consent banner as the authoritative signal, and our analytics tools are configured to follow the banner rather than the browser Do Not Track (DNT) or Global Privacy Control (GPC) headers. No optional cookies or device storage are used without your opt-in, whether or not those signals are present; cookieless audience measurement (Section 3.3) operates independently of DNT/GPC. We do not treat DNT/GPC as a substitute for, or override of, your banner choice. For visitors from jurisdictions that give GPC legal effect, the Cookiebot widget additionally displays the controls required there (for example, a "Do not sell or share my personal information" control).

9. Managing your cookies and the consequences of refusal

• Changing your mind. You can change or withdraw your consent at any time using the controls described in Section 4: the "Change your consent" / "Withdraw your consent" links on the website's cookie policy page, and the "Manage cookie settings" button on each Platform's cookie policy page. You can also reopen the consent banner at any time using the “Cookie settings” link in the footer of each Service. Withdrawal takes effect immediately for future processing. If you cannot reach these controls for any reason, you can contact privacy@briter.co or clear cookies and site data for *.briter.co in your browser (see "Browser controls" below).
• What withdrawal does. From the moment you withdraw, the affected tools stop using their cookies and storage: PostHog stops using its ph_* cookie and local-storage entry. To remove any remaining entries from your device immediately, clear cookies and site data for *.briter.co in your browser (see "Browser controls" below).
• No detriment. If you reject optional cookies, the Services work the same. You lose nothing except that our analytics will not recognise you — if you reject analytics, no cookie is set and nothing is stored on your device; at most your page views are counted anonymously, as described in Section 3.3.
• Browser controls. You can also block or delete cookies and site data in your browser settings, use private/incognito windows, or install blocking extensions. Note that blocking strictly necessary cookies may break sign-in, checkout and security features of the Platforms.
• Strictly necessary technologies cannot be switched off in the banner because the Services cannot function without them; their legal basis and retention are covered in the Privacy Policy.

10. Changes to this policy

We review this policy at least annually and whenever we add, remove or reclassify cookies or providers. Material changes will be announced by updating the effective date and version above and, where the change requires it, by re-presenting the consent banner. Superseded versions, with the periods during which they applied, are archived at briter.co/legal and available on request from privacy@briter.co.

11. Contact

Questions about this Cookie Policy or our use of cookies: privacy@briter.co, or write to Briter Bridges Ltd, Castle House, Castle Street, Guildford, Surrey, England, GU1 3UW, United Kingdom. Your rights over the data collected via cookies (access, erasure, objection, complaint to the ICO or your EU supervisory authority) are set out in our Privacy Policy.