Cookie Policy

1. What a cookie is, and what else counts

A cookie is a small file a website asks your browser to keep and send back on your next visit. The law that governs them in the UK — the Privacy and Electronic Communications Regulations 2003, "PECR" — is not actually about cookies specifically. It covers anything stored on or read from your device, which includes local storage, session storage, and the token an app keeps on your phone.

So this page covers all of it, not just the things technically called cookies.

2. This website

Until you answer the banner, this site stores nothing on your device. Not a "we'll ask but load it anyway" banner — if you say no, or close the page without answering, your browser never contacts Microsoft at all.

One third-party script does load before you answer, and it is named here rather than glossed over: Ahrefs Web Analytics. It counts page views and where they came from. It sets no cookie, writes nothing to local storage, and reads nothing back — so there is nothing on your device for the banner to ask about. PECR governs storing on and reading from a device; a script that does neither is outside it, which is why it is not gated. It resolves an approximate country from your IP address at the point of collection and does not retain the address.

If you accept, we load Microsoft Clarity. It records how pages are used — where you scroll, what you click, where you give up — and plays it back to us as anonymous session recordings and heatmaps. We use it to find the parts of this site that do not work, particularly the pricing page.

Clarity does not record what you type. Text in every input box is masked inside your browser before anything is sent, in all of Clarity's modes, and Microsoft does not let that be switched off. Masked content is never uploaded.

The cookies it sets, if you accept:

How long Clarity keeps it, per Microsoft's published figures: session recordings for 30 days, except favourited recordings and a random sample which are kept up to 9 months; heatmap data up to 9 months.

Where it goes: Microsoft Corporation, which processes outside the UK and EU. We flagged in the previous version of this page that we would prefer a provider that did neither. Clarity is not that provider, and we chose it anyway because it is free, it masks input by default, and the alternative was continuing to guess about a pricing page we could not see anyone using. You are entitled to weigh that differently, which is what the "No thanks" button is for.

Why two analytics tools. They answer different questions and only one of them costs you anything. Ahrefs tells us how many people arrived and from which search; Clarity shows us what they then did with the page. Decline and we keep the first and lose the second — that is the trade the banner is actually offering.

Our server also keeps ordinary web logs — the IP address a request came from, the page requested, the time, the browser type. Those are held for 90 days to run and secure the site, and they are covered by the Privacy Policy rather than by this one, because they are not stored on your device.

3. The CRM, the operator portal and the apps

The parts of the platform you sign in to do store things on your device, because otherwise you would be signed out every time you moved between screens.

All of these are strictly necessary for a service you have asked for, which is the exemption in PECR regulation 6(4). We do not need your consent for them and there is nothing to opt out of — switching them off means switching off the ability to log in.

4. Third parties

Some services we use may set their own cookies when you interact with them directly:

• Microsoft Clarity — only on this website, only after you accept, and only the two first-party cookies in section 2. Covered by Microsoft's privacy statement as well as this page.
• Ahrefs Web Analytics — on this website, on every visit, and it sets no cookies at all. Ahrefs Pte. Ltd., Singapore. Listed for completeness rather than because there is anything on your device to remove.
• Stripe — sets cookies on its own payment pages and in its embedded card fields, for fraud prevention. Strictly necessary to take a payment safely. Governed by Stripe's privacy policy.
• Google Maps — where a map is embedded, Google may store data on your device under its own terms.

We do not control the Stripe or Google cookies and cannot switch them off on your behalf. We use no advertising, remarketing or social-media tracking service anywhere, and we refuse Microsoft's advertising cookies even from visitors who accept the banner.

5. Your consent, and taking it back

Until 13 August 2026 this page said there were no cookies here at all, and promised four things about the day that changed. Analytics arrived on that date, so here is that promise measured against what shipped, rather than quietly rewritten:

• *"A consent banner will appear before anything non-essential is set — not after, and not with the tracker already loaded behind it."* — Kept. The Clarity script is not requested until you accept. Declining means your browser never contacts Microsoft.
• *"Refusing will be as easy as accepting, in one click, with equal prominence."* — Kept. Two buttons, same size, same row, neither pre-selected. Closing the banner without choosing is not consent and leaves nothing stored.
• *"This page will be updated with the specific provider, what it collects and how long it keeps it — before the code ships."* — Kept. Section 2 above, in the same commit as the code.
• *"We will prefer a provider that does not use cookies at all and does not send data outside the UK or EU."* — Half kept, as of 30 August 2026. Clarity uses cookies and Microsoft processes outside the UK and EU, and that has not changed. What did change is that the measurement we actually run on every visit — Ahrefs Web Analytics — is a provider that sets no cookies at all, so the visitor who declines is now measured cookielessly rather than not at all. Ahrefs is in Singapore, so the "not outside the UK or EU" half is still unkept. Denying Microsoft's advertising cookies is the rest of what we could keep.

To change your mind: the "Cookie settings" link at the bottom of any page reopens the banner. Choosing "No thanks" after having accepted tells Clarity to delete the cookies it set, end the session, and stop.

Under PECR, consent for non-essential storage must be freely given, specific, informed and unambiguous. A pre-ticked box is not consent, and neither is "by continuing to browse you agree". We use neither.

6. Controlling what is stored

Your browser lets you block and delete cookies and site data — usually under Settings, then Privacy. Every browser can also clear everything for one site.

For this website the simpler route is the "Cookie settings" link in the footer, which reopens the banner and, if you decline, tells Clarity to delete what it set. Blocking cookies in the browser works too: Microsoft's documentation states that Clarity does not set cookies at all when a browser has them disabled.

Blocking storage for the CRM or the apps will stop you being able to stay signed in — the session token is what keeps you logged in, and there is no way to have one without the other.

On a phone, signing out of the app clears its stored session and its cached data. Uninstalling removes everything.

Questions about any of this: privacy@cabica.co.uk.

7. Operator websites

Each operator has their own booking website, under their own name. We supply the software; they decide what goes on it. If they add analytics or a chat widget, that is their choice and their cookie policy applies, not this one.

Operators: the booking site we ship sets no cookies beyond a theme preference. If you add anything, you need a consent banner and you need to update your own cookie policy. We can point you at how.