Cookie statement

Effective 4 September 2026.

There is no advertising on compliancesme.com, and nothing here builds a profile of you for anyone to buy. The free assessment runs entirely in your browser and stores nothing unless you ask for your report or create an account.

When you sign in to your account we set a single cookie named csme_session. It keeps you signed in for 30 days, it is required for the site to work, and it carries nothing beyond your signed session. It is marked HttpOnly, Secure and SameSite=Lax, so no script can read it and it never travels over an unencrypted connection. Signing out removes it. Because it is strictly necessary to deliver a service you have asked for, that cookie needs no consent.

This site uses Netlify Analytics to count visits and see which pages are read. Netlify counts them from the server logs it already keeps when it serves a page. It sets no cookie, it stores nothing on your device, and it identifies no individual visitor. We use it to understand which pages are useful. We do not use it for advertising and we run no advertising network on this site.

Because these analytics place nothing on your device and read nothing from it, they need no consent under the Privacy and Electronic Communications Regulations. What is placed on your device by anything else is listed on this page, in full. Google Analytics 4 is no longer used, and the cookies it set, named _ga and _ga_XG53WH4WGK, are no longer set by this site. If your browser still holds one from an earlier visit, nothing on this site reads it, and section 4 tells you how to delete it.

Netlify hosts this site and may set strictly functional cookies needed to serve pages and process forms.

Cloudflare provides the verification box on the sign-in and contact forms, which tells a person apart from an automated script. It may set a cookie for that check.

Stripe sets cookies during checkout for payment processing and fraud prevention. These appear only when you go to pay. Google serves the Inter typeface used on every page from its fonts service, and every page loads Google's publisher script for the Subscribe with Google service; each request tells Google your IP address and the page you are on, and Google may set its own cookies for those services under its own policy.

One browser storage entry of our own. Google's script can show a small button for adding ComplianceSME as a preferred source. When you use or dismiss that button, we set a single entry named csme_gps in your browser's local storage so the button does not reappear. It holds the word done and nothing else, it identifies nobody, and it never leaves your browser. Clearing your site data removes it, and section 4 tells you how.

Your browser lets you block or delete cookies at any time. Blocking the session cookie will sign you out and close your dashboard, and blocking the Stripe cookies may prevent checkout from completing.