Cookie policy

Last updated 18 October 2026

Crescat Insure is a brand of Crescat Digital Ltd. This policy covers crescat.insure. This page is from Crescat Digital Ltd ("we"). It lists the cookies and similar tools we know of on crescat.insure. For each one, it says who sets it, what it does and how long it lasts. It also says whether it needs your consent and how to control it. Most come from other companies' tools. They measure our marketing, work out which organisations visit, track calls to us, or show a map and our booking calendar. Some also log your phone number if you call us, and let Google read contact details you type into our forms. The advertising and tracking tools need your consent. They load only if you give it, in our cookie banner, and only if and when we switch them on for this site. The map loads only when you press Show map. Calendly's booking calendar asks for its own consent. Our own code sets one cookie, which remembers your cookie choices.

At a glance

Here is the short version. The table further down gives the detail for each item.

Advertising and tracking: Google Analytics, Google Ads, the LinkedIn Insight Tag, CallTrackingMetrics and Lead Forensics, which Google Tag Manager (a Google tool) loads for us, and OpenAI's pixel for our ChatGPT adverts, which our own code loads. They load on every page, but only if you accept Advertising and tracking in our cookie banner, and only if and when we switch them on for this site. If you reject them, or have not chosen yet, none of them loads.
What those tools do: count visits, and measure our adverts and show them to past visitors. They also match phone calls to your visit, and work out which organisation you browse from.
Google, LinkedIn, OpenAI, LiveIntent and Demandbase also use the data for their own purposes, such as advertising.
The map: a Google map on About and Contact us. It loads only when you press Show map, and a note under it says so.
Booking calendar: Calendly's calendar on Book a call. Calendly asks for your consent in its own banner inside the calendar.
From our own code: one cookie. crescat_consent remembers your choice in our cookie banner.
Our forms, menus and pop-ups store nothing in your browser. Our fonts come from our own site, not from Google Fonts. The Google map does load Google's own fonts.
You can change your mind at any time with Cookie settings, at the foot of every page. How to control or delete cookies explains this and your other options.

What cookies are

Cookies are small text files that a website stores in your browser. They let a site recognise your browser as you move between pages or come back later.

Websites also use other ways to store or read information on your device. Local storage, session storage and browser databases keep data in your browser, much like cookies. Scripts and pixels (tiny invisible images) send details of your visit to another company. Some scripts also read details of your device, such as its screen size. This page covers all of them, not just cookies.

First-party cookies are stored under our own web address, crescat.insure, even when another company's code sets them. Google Analytics' _ga cookie is an example. Third-party cookies are stored under another company's address, such as linkedin.com or doubleclick.net.

Session cookies are deleted when you close your browser. Others last for a set time, from a few minutes to two years.

Cookies can involve personal data. A random ID in a cookie, or your IP address, can single out your device. We treat the data these tools collect as personal data.

The cookies we use

The table below lists all the cookies and similar tools we know of on this site. It also lists items that the providers say their tools can set in some cases. It is grouped by the company that sets them.

Durations are the longest each item lasts. Chrome keeps no cookie for more than 400 days, so two-year cookies last 400 days there. Local storage and browser databases have no end date. They stay until the site or you clear them.

Each row has a category and says whether it needs your consent. Which of these need your consent explains what each category means.

The cookies and similar tools on crescat.insure, grouped by the company that sets them
Name	Set by	What it does	How long it lasts	Category	Needs your consent?	Where and when
Crescat Digital
crescat_consent	Crescat Digital (our own code)	Records your choice in our cookie banner: whether you allowed Advertising and tracking. It also holds the date you chose and a version number, and nothing else.	12 months	Essential	No: strictly necessary	Every page, once you make a choice in our cookie banner or in Cookie settings
Google Analytics
_ga	Google Analytics	Gives your browser a random ID so we can count visitors and see how the site is used.	2 years (400 days in Chrome). Renewed each time you view a page.	Analytics	Yes: only if you accept Advertising and tracking, and only if and when we switch it on for this site	Every page, once you accept Advertising and tracking
_ga_[id]	Google Analytics	Keeps track of your current visit (session) for our Google Analytics account.	2 years (400 days in Chrome). Renewed each time you view a page.	Analytics	Yes: only if you accept Advertising and tracking, and only if and when we switch it on for this site	Every page, once you accept Advertising and tracking
Google Ads
_gcl_au	Google Ads	A first-party ID that links visits and enquiries to our Google adverts.	90 days	Advertising	Yes: only if you accept Advertising and tracking, and only if and when we switch it on for this site	Every page, once you accept Advertising and tracking
_gcl_ls (local storage)	Google Ads	Keeps the same ad-click and linking data in your browser's local storage.	Stays until cleared. The data inside expires after 90 days.	Advertising	Yes: only if you accept Advertising and tracking, and only if and when we switch it on for this site	Every page, once you accept Advertising and tracking
_gcl_aw	Google Ads	Stores the click ID from a Google advert you clicked, so a later enquiry can be credited to that advert.	90 days	Advertising	Yes: only if you accept Advertising and tracking, and only if and when we switch it on for this site	Only if you arrive by clicking one of our Google adverts and accept Advertising and tracking
_gcl_gs, _gcl_gb, _gcl_ag, _gcl_dc, _gac_gb_[number]	Google Ads and Google Analytics	Other Google ad-click details, used in the same way as _gcl_aw.	90 days	Advertising	Yes: only if you accept Advertising and tracking, and only if and when we switch it on for this site	Only if you arrive from a Google advert link that carries these details and accept Advertising and tracking
test_cookie	Google Ads (on doubleclick.net)	Checks whether your browser accepts third-party cookies, before Google sets IDE.	15 minutes	Advertising	Yes: only if you accept Advertising and tracking, and only if and when we switch it on for this site	On your first page view after you accept Advertising and tracking
IDE	Google Ads (on doubleclick.net)	Google's advertising ID. Google uses it across many sites to show and measure adverts, including showing our adverts to people who have visited our site.	13 months	Advertising	Yes: only if you accept Advertising and tracking, and only if and when we switch it on for this site	From your second page view after you accept Advertising and tracking, in browsers that allow third-party cookies
LinkedIn
bcookie	LinkedIn	LinkedIn's ID for your browser. LinkedIn uses it to recognise your device and prevent abuse. On our site it also supports our LinkedIn advert tracking.	1 year	Advertising	Yes: only if you accept Advertising and tracking, and only if and when we switch it on for this site	Every page, once you accept Advertising and tracking
li_gc	LinkedIn	LinkedIn's record of whether you have agreed to its own optional cookies. LinkedIn does not ask on our site. Set because our LinkedIn tag loads.	6 months	Advertising	Yes: only if you accept Advertising and tracking, and only if and when we switch it on for this site	Every page, once you accept Advertising and tracking
lidc	LinkedIn	Sends your requests to the right LinkedIn data centre.	24 hours	Advertising	Yes: only if you accept Advertising and tracking, and only if and when we switch it on for this site	Every page, once you accept Advertising and tracking
__cf_bm (linkedin.com)	LinkedIn (Cloudflare)	Detects bots on LinkedIn's servers. Set because our LinkedIn tag loads.	30 minutes	Advertising	Yes: only if you accept Advertising and tracking, and only if and when we switch it on for this site	Every page, once you accept Advertising and tracking
li_fat_id, li_giant	LinkedIn	Carry an ID from a LinkedIn advert you clicked. LinkedIn uses it to credit your visit or enquiry to that advert, and to show you related adverts.	li_fat_id 30 days; li_giant 7 days	Advertising	Yes: only if you accept Advertising and tracking, and only if and when we switch it on for this site	Only if you arrive from a LinkedIn advert, accept Advertising and tracking, and LinkedIn's own checks allow it. Set on our domain.
li_adsId (cookie and local storage), li_hem (local storage)	LinkedIn	li_adsId is LinkedIn's advertising ID for your browser. li_hem holds a scrambled (hashed) email address for matching, if one is captured.	li_adsId cookie 180 days, local storage copy until cleared; li_hem until cleared	Advertising	Yes: only if you accept Advertising and tracking, and only if and when we switch it on for this site	Only if you accept Advertising and tracking, and only where LinkedIn's own checks allow it. We did not see them for a UK visitor in our tests.
UserMatchHistory, AnalyticsSyncHistory, li_sugr, lms_ads, lms_analytics, li_mc, _guid	LinkedIn	Sync LinkedIn's advertising IDs and recognise LinkedIn members on other sites, for advertising and reports. li_mc caches a member's cookie choices. _guid identifies a member for advertising through Google Ads. LinkedIn's cookie table lists a few more.	30 days each, except li_sugr and _guid (90 days) and li_mc (6 months)	Advertising	Yes: only if you accept Advertising and tracking, and only if and when we switch it on for this site	Only if you accept Advertising and tracking. LinkedIn says its tag may set these on sites like ours, for example for signed-in LinkedIn members. We did not see them in our tests.
OpenAI (ChatGPT adverts)
OpenAI pixel (from bzrcdn.openai.com)	OpenAI, loaded by our own code	Measures our adverts in ChatGPT. Each time a page loads, it tells OpenAI it has started, with the page's address, its ID for your browser and any ChatGPT advert reference. When you book a call on our Book a call page, it also tells OpenAI, with a scrambled reference to the booking. We load it only while OpenAI's automatic advanced matching is switched off, so it does not read what you type into our forms, and we do not send OpenAI your name, email address or other contact details.	Sets the cookies below	Advertising	Yes: only if you accept Advertising and tracking, and only if and when we switch it on for this site	Every page, once you accept Advertising and tracking
__oppref	OpenAI	Stores OpenAI's reference for a ChatGPT advert of ours that you clicked, so a booking can be credited to that advert.	30 days	Advertising	Yes: only if you accept Advertising and tracking, and only if and when we switch it on for this site	Only if you arrive by clicking one of our ChatGPT adverts and accept Advertising and tracking. Set for crescat.insure, so our other addresses receive it too.
__obref	OpenAI	OpenAI's random ID for your browser, used to measure our ChatGPT adverts.	365 days	Advertising	Yes: only if you accept Advertising and tracking, and only if and when we switch it on for this site	Every page, once you accept Advertising and tracking. Set for crescat.insure, so our other addresses receive it too.
__oaiq_consent	OpenAI	OpenAI's record that its pixel may run on our site.	30 days	Advertising	Yes: only if you accept Advertising and tracking, and only if and when we switch it on for this site	Every page, once you accept Advertising and tracking. Set for crescat.insure.
__cf_bm, _cfuvid (bzrcdn.openai.com and bzr.openai.com)	OpenAI (Cloudflare)	Detect bots on OpenAI's servers. Set because OpenAI's pixel loads.	__cf_bm 30 minutes; _cfuvid until you close your browser	Advertising	Yes: only if you accept Advertising and tracking, and only if and when we switch it on for this site	Every page, once you accept Advertising and tracking
CallTrackingMetrics
__ctmid	CallTrackingMetrics	Your visit ID. It keeps showing you the same tracking phone number and links your calls to the marketing that brought you.	30 days	Call tracking	Yes: only if you accept Advertising and tracking, and only if and when we switch it on for this site	Every page, once you accept Advertising and tracking
ct312798	CallTrackingMetrics (on 312798.tctm.co)	CallTrackingMetrics' copy of your visit ID on its own server. Stored for our site only.	Until you close your browser	Call tracking	Yes: only if you accept Advertising and tracking, and only if and when we switch it on for this site	Every page, once you accept Advertising and tracking
__ctm_312798, __ctm2_312798, __ctmf_312798, each with a matching _ttl entry (local storage)	CallTrackingMetrics	Record the site you came from, the first page you landed on and whether this is your first visit. Each _ttl entry holds its expiry date.	Stays until cleared. CallTrackingMetrics treats it as expired after 30 days.	Call tracking	Yes: only if you accept Advertising and tracking, and only if and when we switch it on for this site	Every page, once you accept Advertising and tracking
_ctm_312798_gid_, _ctm_312798_ttl_, _ctm_format.[number], _ctm_[id].[number] (local storage)	CallTrackingMetrics	Your CallTrackingMetrics visitor ID, and a saved copy of the tracking number shown to you.	Stays until cleared. Expires for CallTrackingMetrics after about 30 days.	Call tracking	Yes: only if you accept Advertising and tracking, and only if and when we switch it on for this site	Every page, once you accept Advertising and tracking
Lead Forensics and the services it calls
Lead Forensics script (no cookie set)	Lead Forensics, loaded from www.operation-inspirationastute.com	Looks up your IP address to work out the organisation you are browsing from. It records the page's address and title, the page you came from and your screen size. It shows us which organisations visited and what they looked at.	No cookie or storage set in our tests. It checks for a Lead Forensics cookie called lfuuid (1 year), which our set-up does not create.	Visitor identification	Yes: only if you accept Advertising and tracking, and only if and when we switch it on for this site	Every page, once you accept Advertising and tracking
Demandbase lookup (no cookie set)	Demandbase (tag.demandbase.com and api.company-target.com), called by the Lead Forensics script	Looks up your IP address. It returns your internet provider or organisation and your rough location, such as a postcode district. It also returns a visitor-type label and an ID for your device. Lead Forensics receives the result.	No cookie or storage set on our site in our tests, yet the device ID stayed the same across our pages. Demandbase's cookie policy lists tuuid and tuuid_lu, used for its analytics and advertising services.	Visitor identification	Yes: only if you accept Advertising and tracking, and only if and when we switch it on for this site	Every page, once you accept Advertising and tracking
LiveIntent lookup (no cookie set)	LiveIntent, a Zeta Global company (idx.liadm.com), called by the Lead Forensics script	Tries to match your browser to LiveIntent's identity records, which it uses for advertising. LiveIntent's ID for you is sent back to Lead Forensics.	None set on our site in our tests. The Lead Forensics script runs LiveIntent's code with browser storage switched off.	Visitor identification	Yes: only if you accept Advertising and tracking, and only if and when we switch it on for this site	Every page, once you accept Advertising and tracking
a.usbrowserspeed.com (no cookie set)	A service at a.usbrowserspeed.com, called by the Lead Forensics script	Receives Lead Forensics' ID for your visit, with your IP address and browser details, so the two services can link their records. We are asking Lead Forensics to name the company that runs it.	None set on our site in our tests.	Visitor identification	Yes: only if you accept Advertising and tracking, and only if and when we switch it on for this site	Every page, once you accept Advertising and tracking
Calendly (booking calendar)
__cf_bm (calendly.com)	Calendly (Cloudflare)	Detects bots on Calendly's servers.	30 minutes	Booking calendar: security	No: strictly necessary, on the booking calendar	Book a call, as soon as the calendar loads and before you choose in Calendly's banner
_cfuvid (calendly.com)	Calendly (Cloudflare)	Limits how many requests one visitor can send to Calendly.	Until you close your browser	Booking calendar: security	No: strictly necessary, on the booking calendar	Same page as above, as soon as the calendar loads
OptanonConsent	Calendly (OneTrust)	Records your choice in Calendly's cookie banner. Before you choose, it records that only necessary cookies are on.	1 year	Booking calendar: security	No: strictly necessary, on the booking calendar	Same page as above, as soon as the calendar loads
OptanonAlertBoxClosed	Calendly (OneTrust)	Records that you have made a choice in Calendly's banner, so the banner stops showing.	1 year	Booking calendar: security	No: strictly necessary, on the booking calendar	Same page as above, once you choose in Calendly's banner
m (m.stripe.com)	Stripe, loaded by Calendly	Stripe's fraud-prevention ID for your device.	2 years (400 days in Chrome)	Booking calendar: security	No: strictly necessary, on the booking calendar	Same page as above, as soon as the calendar loads
_cache and rc::a (local storage); 1, _ab, _mf and id (session storage)	Calendly, with Google reCAPTCHA and Stripe loaded by Calendly	Calendly's app cache (_cache), reCAPTCHA's bot checks (rc::a), and Stripe's fraud-prevention signals and device ID (the session storage items).	Local storage stays until cleared. Session storage clears when you close the tab.	Booking calendar: security	No: strictly necessary, on the booking calendar	Same page as above, as soon as the calendar loads
ajs_anonymous_id, userleap.ids, sprig.anon.env.vid.map (local storage), and cookies from Calendly's optional tools	Calendly, with Segment, Sprig, Braze, Google Analytics and Facebook	Calendly's own analytics, surveys, recordings of how the calendar is used, and marketing.	Local storage stays until cleared. Cookie lifetimes vary by tool. Calendly's privacy notice explains them.	Booking calendar: optional	Yes: only if you choose Accept all in Calendly's banner	Only if you choose Accept all in Calendly's banner. We saw these in a test with the banner switched off, not after Accept all, so this list may be incomplete.

Crescat Digital

1 item · Consent: No: strictly necessary

crescat_consent

Set by: Crescat Digital (our own code)
What it does: Records your choice in our cookie banner: whether you allowed Advertising and tracking. It also holds the date you chose and a version number, and nothing else.
How long it lasts: 12 months
Category: Essential
Needs your consent?: No: strictly necessary
Where and when: Every page, once you make a choice in our cookie banner or in Cookie settings

Google Analytics

2 items · Consent: Yes: only if you accept Advertising and tracking, and only if and when we switch it on for this site

_ga

Set by: Google Analytics
What it does: Gives your browser a random ID so we can count visitors and see how the site is used.
How long it lasts: 2 years (400 days in Chrome). Renewed each time you view a page.
Category: Analytics
Needs your consent?: Yes: only if you accept Advertising and tracking, and only if and when we switch it on for this site
Where and when: Every page, once you accept Advertising and tracking

_ga_[id]

Set by: Google Analytics
What it does: Keeps track of your current visit (session) for our Google Analytics account.
How long it lasts: 2 years (400 days in Chrome). Renewed each time you view a page.
Category: Analytics
Needs your consent?: Yes: only if you accept Advertising and tracking, and only if and when we switch it on for this site
Where and when: Every page, once you accept Advertising and tracking

Google Ads

6 items · Consent: Yes: only if you accept Advertising and tracking, and only if and when we switch it on for this site

_gcl_au

Set by: Google Ads
What it does: A first-party ID that links visits and enquiries to our Google adverts.
How long it lasts: 90 days
Category: Advertising
Needs your consent?: Yes: only if you accept Advertising and tracking, and only if and when we switch it on for this site
Where and when: Every page, once you accept Advertising and tracking

_gcl_ls (local storage)

Set by: Google Ads
What it does: Keeps the same ad-click and linking data in your browser's local storage.
How long it lasts: Stays until cleared. The data inside expires after 90 days.
Category: Advertising
Needs your consent?: Yes: only if you accept Advertising and tracking, and only if and when we switch it on for this site
Where and when: Every page, once you accept Advertising and tracking

_gcl_aw

Set by: Google Ads
What it does: Stores the click ID from a Google advert you clicked, so a later enquiry can be credited to that advert.
How long it lasts: 90 days
Category: Advertising
Needs your consent?: Yes: only if you accept Advertising and tracking, and only if and when we switch it on for this site
Where and when: Only if you arrive by clicking one of our Google adverts and accept Advertising and tracking

_gcl_gs, _gcl_gb, _gcl_ag, _gcl_dc, _gac_gb_[number]

Set by: Google Ads and Google Analytics
What it does: Other Google ad-click details, used in the same way as _gcl_aw.
How long it lasts: 90 days
Category: Advertising
Needs your consent?: Yes: only if you accept Advertising and tracking, and only if and when we switch it on for this site
Where and when: Only if you arrive from a Google advert link that carries these details and accept Advertising and tracking

test_cookie

Set by: Google Ads (on doubleclick.net)
What it does: Checks whether your browser accepts third-party cookies, before Google sets IDE.
How long it lasts: 15 minutes
Category: Advertising
Needs your consent?: Yes: only if you accept Advertising and tracking, and only if and when we switch it on for this site
Where and when: On your first page view after you accept Advertising and tracking

IDE

Set by: Google Ads (on doubleclick.net)
What it does: Google's advertising ID. Google uses it across many sites to show and measure adverts, including showing our adverts to people who have visited our site.
How long it lasts: 13 months
Category: Advertising
Needs your consent?: Yes: only if you accept Advertising and tracking, and only if and when we switch it on for this site
Where and when: From your second page view after you accept Advertising and tracking, in browsers that allow third-party cookies

7 items · Consent: Yes: only if you accept Advertising and tracking, and only if and when we switch it on for this site

bcookie

Set by: LinkedIn
What it does: LinkedIn's ID for your browser. LinkedIn uses it to recognise your device and prevent abuse. On our site it also supports our LinkedIn advert tracking.
How long it lasts: 1 year
Category: Advertising
Needs your consent?: Yes: only if you accept Advertising and tracking, and only if and when we switch it on for this site
Where and when: Every page, once you accept Advertising and tracking

li_gc

Set by: LinkedIn
What it does: LinkedIn's record of whether you have agreed to its own optional cookies. LinkedIn does not ask on our site. Set because our LinkedIn tag loads.
How long it lasts: 6 months
Category: Advertising
Needs your consent?: Yes: only if you accept Advertising and tracking, and only if and when we switch it on for this site
Where and when: Every page, once you accept Advertising and tracking

lidc

Set by: LinkedIn
What it does: Sends your requests to the right LinkedIn data centre.
How long it lasts: 24 hours
Category: Advertising
Needs your consent?: Yes: only if you accept Advertising and tracking, and only if and when we switch it on for this site
Where and when: Every page, once you accept Advertising and tracking

__cf_bm (linkedin.com)

Set by: LinkedIn (Cloudflare)
What it does: Detects bots on LinkedIn's servers. Set because our LinkedIn tag loads.
How long it lasts: 30 minutes
Category: Advertising
Needs your consent?: Yes: only if you accept Advertising and tracking, and only if and when we switch it on for this site
Where and when: Every page, once you accept Advertising and tracking

li_fat_id, li_giant

Set by: LinkedIn
What it does: Carry an ID from a LinkedIn advert you clicked. LinkedIn uses it to credit your visit or enquiry to that advert, and to show you related adverts.
How long it lasts: li_fat_id 30 days; li_giant 7 days
Category: Advertising
Needs your consent?: Yes: only if you accept Advertising and tracking, and only if and when we switch it on for this site
Where and when: Only if you arrive from a LinkedIn advert, accept Advertising and tracking, and LinkedIn's own checks allow it. Set on our domain.

li_adsId (cookie and local storage), li_hem (local storage)

Set by: LinkedIn
What it does: li_adsId is LinkedIn's advertising ID for your browser. li_hem holds a scrambled (hashed) email address for matching, if one is captured.
How long it lasts: li_adsId cookie 180 days, local storage copy until cleared; li_hem until cleared
Category: Advertising
Needs your consent?: Yes: only if you accept Advertising and tracking, and only if and when we switch it on for this site
Where and when: Only if you accept Advertising and tracking, and only where LinkedIn's own checks allow it. We did not see them for a UK visitor in our tests.

UserMatchHistory, AnalyticsSyncHistory, li_sugr, lms_ads, lms_analytics, li_mc, _guid

Set by: LinkedIn
What it does: Sync LinkedIn's advertising IDs and recognise LinkedIn members on other sites, for advertising and reports. li_mc caches a member's cookie choices. _guid identifies a member for advertising through Google Ads. LinkedIn's cookie table lists a few more.
How long it lasts: 30 days each, except li_sugr and _guid (90 days) and li_mc (6 months)
Category: Advertising
Needs your consent?: Yes: only if you accept Advertising and tracking, and only if and when we switch it on for this site
Where and when: Only if you accept Advertising and tracking. LinkedIn says its tag may set these on sites like ours, for example for signed-in LinkedIn members. We did not see them in our tests.

OpenAI (ChatGPT adverts)

5 items · Consent: Yes: only if you accept Advertising and tracking, and only if and when we switch it on for this site

OpenAI pixel (from bzrcdn.openai.com)

Set by: OpenAI, loaded by our own code
What it does: Measures our adverts in ChatGPT. Each time a page loads, it tells OpenAI it has started, with the page's address, its ID for your browser and any ChatGPT advert reference. When you book a call on our Book a call page, it also tells OpenAI, with a scrambled reference to the booking. We load it only while OpenAI's automatic advanced matching is switched off, so it does not read what you type into our forms, and we do not send OpenAI your name, email address or other contact details.
How long it lasts: Sets the cookies below
Category: Advertising
Needs your consent?: Yes: only if you accept Advertising and tracking, and only if and when we switch it on for this site
Where and when: Every page, once you accept Advertising and tracking

__oppref

Set by: OpenAI
What it does: Stores OpenAI's reference for a ChatGPT advert of ours that you clicked, so a booking can be credited to that advert.
How long it lasts: 30 days
Category: Advertising
Needs your consent?: Yes: only if you accept Advertising and tracking, and only if and when we switch it on for this site
Where and when: Only if you arrive by clicking one of our ChatGPT adverts and accept Advertising and tracking. Set for crescat.insure, so our other addresses receive it too.

__obref

Set by: OpenAI
What it does: OpenAI's random ID for your browser, used to measure our ChatGPT adverts.
How long it lasts: 365 days
Category: Advertising
Needs your consent?: Yes: only if you accept Advertising and tracking, and only if and when we switch it on for this site
Where and when: Every page, once you accept Advertising and tracking. Set for crescat.insure, so our other addresses receive it too.

__oaiq_consent

Set by: OpenAI
What it does: OpenAI's record that its pixel may run on our site.
How long it lasts: 30 days
Category: Advertising
Needs your consent?: Yes: only if you accept Advertising and tracking, and only if and when we switch it on for this site
Where and when: Every page, once you accept Advertising and tracking. Set for crescat.insure.

__cf_bm, _cfuvid (bzrcdn.openai.com and bzr.openai.com)

Set by: OpenAI (Cloudflare)
What it does: Detect bots on OpenAI's servers. Set because OpenAI's pixel loads.
How long it lasts: __cf_bm 30 minutes; _cfuvid until you close your browser
Category: Advertising
Needs your consent?: Yes: only if you accept Advertising and tracking, and only if and when we switch it on for this site
Where and when: Every page, once you accept Advertising and tracking

CallTrackingMetrics

4 items · Consent: Yes: only if you accept Advertising and tracking, and only if and when we switch it on for this site

__ctmid

Set by: CallTrackingMetrics
What it does: Your visit ID. It keeps showing you the same tracking phone number and links your calls to the marketing that brought you.
How long it lasts: 30 days
Category: Call tracking
Needs your consent?: Yes: only if you accept Advertising and tracking, and only if and when we switch it on for this site
Where and when: Every page, once you accept Advertising and tracking

ct312798

Set by: CallTrackingMetrics (on 312798.tctm.co)
What it does: CallTrackingMetrics' copy of your visit ID on its own server. Stored for our site only.
How long it lasts: Until you close your browser
Category: Call tracking
Needs your consent?: Yes: only if you accept Advertising and tracking, and only if and when we switch it on for this site
Where and when: Every page, once you accept Advertising and tracking

__ctm_312798, __ctm2_312798, __ctmf_312798, each with a matching _ttl entry (local storage)

Set by: CallTrackingMetrics
What it does: Record the site you came from, the first page you landed on and whether this is your first visit. Each _ttl entry holds its expiry date.
How long it lasts: Stays until cleared. CallTrackingMetrics treats it as expired after 30 days.
Category: Call tracking
Needs your consent?: Yes: only if you accept Advertising and tracking, and only if and when we switch it on for this site
Where and when: Every page, once you accept Advertising and tracking

_ctm_312798_gid_, _ctm_312798_ttl_, _ctm_format.[number], _ctm_[id].[number] (local storage)

Set by: CallTrackingMetrics
What it does: Your CallTrackingMetrics visitor ID, and a saved copy of the tracking number shown to you.
How long it lasts: Stays until cleared. Expires for CallTrackingMetrics after about 30 days.
Category: Call tracking
Needs your consent?: Yes: only if you accept Advertising and tracking, and only if and when we switch it on for this site
Where and when: Every page, once you accept Advertising and tracking

Lead Forensics and the services it calls

4 items · Consent: Yes: only if you accept Advertising and tracking, and only if and when we switch it on for this site

Lead Forensics script (no cookie set)

Set by: Lead Forensics, loaded from www.operation-inspirationastute.com
What it does: Looks up your IP address to work out the organisation you are browsing from. It records the page's address and title, the page you came from and your screen size. It shows us which organisations visited and what they looked at.
How long it lasts: No cookie or storage set in our tests. It checks for a Lead Forensics cookie called lfuuid (1 year), which our set-up does not create.
Category: Visitor identification
Needs your consent?: Yes: only if you accept Advertising and tracking, and only if and when we switch it on for this site
Where and when: Every page, once you accept Advertising and tracking

Demandbase lookup (no cookie set)

Set by: Demandbase (tag.demandbase.com and api.company-target.com), called by the Lead Forensics script
What it does: Looks up your IP address. It returns your internet provider or organisation and your rough location, such as a postcode district. It also returns a visitor-type label and an ID for your device. Lead Forensics receives the result.
How long it lasts: No cookie or storage set on our site in our tests, yet the device ID stayed the same across our pages. Demandbase's cookie policy lists tuuid and tuuid_lu, used for its analytics and advertising services.
Category: Visitor identification
Needs your consent?: Yes: only if you accept Advertising and tracking, and only if and when we switch it on for this site
Where and when: Every page, once you accept Advertising and tracking

LiveIntent lookup (no cookie set)

Set by: LiveIntent, a Zeta Global company (idx.liadm.com), called by the Lead Forensics script
What it does: Tries to match your browser to LiveIntent's identity records, which it uses for advertising. LiveIntent's ID for you is sent back to Lead Forensics.
How long it lasts: None set on our site in our tests. The Lead Forensics script runs LiveIntent's code with browser storage switched off.
Category: Visitor identification
Needs your consent?: Yes: only if you accept Advertising and tracking, and only if and when we switch it on for this site
Where and when: Every page, once you accept Advertising and tracking

a.usbrowserspeed.com (no cookie set)

Set by: A service at a.usbrowserspeed.com, called by the Lead Forensics script
What it does: Receives Lead Forensics' ID for your visit, with your IP address and browser details, so the two services can link their records. We are asking Lead Forensics to name the company that runs it.
How long it lasts: None set on our site in our tests.
Category: Visitor identification
Needs your consent?: Yes: only if you accept Advertising and tracking, and only if and when we switch it on for this site
Where and when: Every page, once you accept Advertising and tracking

Calendly (booking calendar)

7 items

__cf_bm (calendly.com)

Set by: Calendly (Cloudflare)
What it does: Detects bots on Calendly's servers.
How long it lasts: 30 minutes
Category: Booking calendar: security
Needs your consent?: No: strictly necessary, on the booking calendar
Where and when: Book a call, as soon as the calendar loads and before you choose in Calendly's banner

_cfuvid (calendly.com)

Set by: Calendly (Cloudflare)
What it does: Limits how many requests one visitor can send to Calendly.
How long it lasts: Until you close your browser
Category: Booking calendar: security
Needs your consent?: No: strictly necessary, on the booking calendar
Where and when: Same page as above, as soon as the calendar loads

OptanonConsent

Set by: Calendly (OneTrust)
What it does: Records your choice in Calendly's cookie banner. Before you choose, it records that only necessary cookies are on.
How long it lasts: 1 year
Category: Booking calendar: security
Needs your consent?: No: strictly necessary, on the booking calendar
Where and when: Same page as above, as soon as the calendar loads

OptanonAlertBoxClosed

Set by: Calendly (OneTrust)
What it does: Records that you have made a choice in Calendly's banner, so the banner stops showing.
How long it lasts: 1 year
Category: Booking calendar: security
Needs your consent?: No: strictly necessary, on the booking calendar
Where and when: Same page as above, once you choose in Calendly's banner

m (m.stripe.com)

Set by: Stripe, loaded by Calendly
What it does: Stripe's fraud-prevention ID for your device.
How long it lasts: 2 years (400 days in Chrome)
Category: Booking calendar: security
Needs your consent?: No: strictly necessary, on the booking calendar
Where and when: Same page as above, as soon as the calendar loads

_cache and rc::a (local storage); 1, _ab, _mf and id (session storage)

Set by: Calendly, with Google reCAPTCHA and Stripe loaded by Calendly
What it does: Calendly's app cache (_cache), reCAPTCHA's bot checks (rc::a), and Stripe's fraud-prevention signals and device ID (the session storage items).
How long it lasts: Local storage stays until cleared. Session storage clears when you close the tab.
Category: Booking calendar: security
Needs your consent?: No: strictly necessary, on the booking calendar
Where and when: Same page as above, as soon as the calendar loads

ajs_anonymous_id, userleap.ids, sprig.anon.env.vid.map (local storage), and cookies from Calendly's optional tools

Set by: Calendly, with Segment, Sprig, Braze, Google Analytics and Facebook
What it does: Calendly's own analytics, surveys, recordings of how the calendar is used, and marketing.
How long it lasts: Local storage stays until cleared. Cookie lifetimes vary by tool. Calendly's privacy notice explains them.
Category: Booking calendar: optional
Needs your consent?: Yes: only if you choose Accept all in Calendly's banner
Where and when: Only if you choose Accept all in Calendly's banner. We saw these in a test with the banner switched off, not after Accept all, so this list may be incomplete.

Cookies from other companies

Most items in the table come from other companies' tools. This is what each tool does on our site. Google Analytics, Google Ads, the LinkedIn Insight Tag, CallTrackingMetrics, Lead Forensics and OpenAI's pixel load only if you accept Advertising and tracking, and only if and when we switch them on for this site.

Google Analytics, if and when we switch it on for this site, counts visits and shows us which pages people use, how they arrived and what they do next. It gives your browser a random ID. We have switched on Google signals. This lets Google link visits to the Google accounts of signed-in people who allow ad personalisation. It gives us reports across devices and lets us build advertising audiences.

Google Ads, if and when we switch it on for this site, measures whether our adverts lead to visits and enquiries. It also adds your browser to our remarketing lists, so we can show you our adverts on other websites. For this, Google uses its advertising cookies on doubleclick.net.

If and when we switch them on for this site, our Google Analytics and Google Ads settings also let Google's tag read contact details typed into our forms. That means an email address, phone number or postal address. Google receives them in scrambled (hashed) form and uses them to measure enquiries more accurately.

The LinkedIn Insight Tag, if and when we switch it on for this site, tells LinkedIn about your visit. We use it to measure our LinkedIn adverts and to show them on LinkedIn to people who have visited our site. It also gives us reports on the kinds of professionals who visit. If you are signed in to LinkedIn, LinkedIn can link your visit to your account.

OpenAI's pixel measures our adverts in ChatGPT. Our own code loads it from bzrcdn.openai.com, if and when we switch it on for this site, only if you accept Advertising and tracking, and only while OpenAI's automatic advanced matching is switched off for it. Each time a page loads, it tells OpenAI it has started, with the page's address, a random ID for your browser (kept in a cookie called __obref for a year) and, if you arrived by clicking one of our ChatGPT adverts, OpenAI's reference for that click (kept in __oppref for 30 days). A third cookie, __oaiq_consent, records for 30 days that the pixel may run. When you book a call on our Book a call page, it tells OpenAI, with a scrambled reference to the booking. It does not read what you type into our forms, and we do not send OpenAI your name, email address or other contact details. OpenAI also uses this data for its own purposes, such as delivering and improving its advertising, as its privacy policy explains.

CallTrackingMetrics, if and when we switch it on for this site, shows you a tracking phone number in place of our usual number. It keeps showing you the same number for 30 days, and calls to it come through to us as normal. If you call, CallTrackingMetrics logs your phone number. It links the call to the page and source that brought you to our site. It also reads your Google Analytics ID, so a call can be matched to your visit.

Lead Forensics, if and when we switch it on for this site, shows us which organisations visit our site and which pages they view. Its script loads from www.operation-inspirationastute.com, a web address Lead Forensics uses. It looks up your IP address to work out the organisation you are browsing from. It also records the page's address and title, the page you came from and your screen size. If you browse from home or a small office, the result may point to you rather than to an organisation. It set no cookie in our tests.

The Lead Forensics script also calls three other services, and each receives your IP address and browser details. Demandbase looks up your IP address. It returns your internet provider or organisation and your rough location, such as a postcode district. It also returns a visitor-type label and an ID for your device. That ID stayed the same from page to page in our tests, although no cookie was set. The result goes back to Lead Forensics.

LiveIntent, a Zeta Global company, tries to match your browser to its identity records, which it uses for advertising. Its ID for you also goes back to Lead Forensics. The third service, at a.usbrowserspeed.com, receives Lead Forensics' ID for your visit so the two can link their records. We are asking Lead Forensics to name the company that runs it. None of the three set a cookie on our site in our tests.

Google, LinkedIn, OpenAI, LiveIntent and Demandbase also use the data for their own purposes, such as advertising, as their own notices explain.

Calendly provides the booking calendar on our Book a call page. It runs inside our page. Calendly shows visitors in the UK its own cookie banner in the calendar, with Decline all, Accept all and Cookie settings buttons. Calendly decides where to show the banner based on your location. Your choice there covers Calendly's cookies only. Our own cookie banner does not cover the calendar.

Before you choose, Calendly sets a few cookies and stored items for security and fraud checks, from Cloudflare, Stripe and Google reCAPTCHA. It also checks your device for signs of fraud. One more cookie records that you have not chosen yet, and a second is added once you choose. In our tests, none of Calendly's analytics or advertising tools loaded before a choice was made.

Calendly's banner says Accept all allows optional cookies for analytics and marketing. The analytics include recordings of how you use the calendar. We did not press Accept all in our tests. With Calendly's banner switched off, the calendar loaded Google Analytics, Segment, Sprig, Braze and Facebook, which stored IDs in the browser. We expect Accept all to load the same tools.

To change your Calendly choice later, use Cookie settings at the foot of the calendar. You can also delete calendly.com's cookies in your browser, and Calendly's banner will ask again. If you open Calendly in its own tab, calendly.com sets further cookies of its own, which its privacy notice covers.

Google Maps shows our office on our About and Contact us pages. The map loads only when you press Show map. It set no cookies or storage in our tests. It does load from Google's servers, so Google receives your IP address.

If you have used Google or LinkedIn before, your browser may already hold their cookies. When their tools load on our pages, including the Google map, your browser can send those cookies back to them. That is how, for example, LinkedIn can recognise a signed-in member.

Each company's own notice explains what it does with the data:

Google: privacy policy, how Google uses information from sites that use its services and Google's advertising cookies. These cover Analytics, Ads, Maps and reCAPTCHA.
LinkedIn: cookie policy and cookie table
OpenAI: privacy policy
CallTrackingMetrics: privacy policy
Lead Forensics: privacy policy
Demandbase: privacy policy and cookie policy
LiveIntent: privacy policy and ad choices
Calendly: privacy notice
Stripe: cookie policy

How to control or delete cookies

You can change your choice at any time with Cookie settings. It opens the same switch as our banner. The Cookie settings link is also at the foot of every page.

If you switch Advertising and tracking off, we delete the cookies and stored items these tools keep under our own web address, such as _ga, _gcl_au, __ctmid and OpenAI's __obref and __oaiq_consent. We also tell OpenAI's pixel that you have withdrawn. Then we reload the page, so the tools stop. We cannot delete cookies stored under other companies' addresses, such as LinkedIn's cookies on linkedin.com and Google's advertising cookies on doubleclick.net. Your browser settings can.

You can also limit or remove what is stored in these ways.

Browser settings: block or delete cookies in Chrome, Edge or Firefox (block, delete). Delete them in Safari on a Mac or Safari on iPhone and iPad. Deleting cookies and site data also clears local storage and browser databases.
Third-party cookies: blocking them stops most cookies stored under other companies' addresses, such as Google's advertising cookies and LinkedIn's. It does not stop the Lead Forensics script or Demandbase's device ID. Nor does it stop what Google Analytics, Google Ads and CallTrackingMetrics store under our own address. Safari blocks third-party cookies by default. Firefox blocks known tracking cookies by default.
Blocking all cookies may stop parts of our site working, such as the booking calendar. A private or incognito window deletes its cookies when you close it.
None of these browser settings stops the tools loading, or sending your IP address and visit details to the companies above. Switching Advertising and tracking off in Cookie settings does. So can a browser or extension that blocks trackers.
Google Analytics: install Google's opt-out browser add-on, which works in desktop browsers. It stops Google Analytics on every site you visit. It does not stop Google Ads.
Google adverts: manage ad personalisation in My Ad Center.
LinkedIn: if you have an account, go to Settings, then Advertising data. If not, use LinkedIn's guest opt-out.
LiveIntent: its ad choices page explains how to opt out of its cookie-based advertising.
Calendly: use the banner inside the calendar to choose Decline all, Accept all or Cookie settings. To change your choice later, use Cookie settings at the foot of the calendar.
Adverts based on your interests: Your Online Choices lets you turn them off for many advertising companies at once.
Ask us: you can ask what data we hold from these tools, or ask us to delete it. We will delete what we hold, such as call records. We can delete your Google Analytics data if you give us your Google Analytics ID (the value of your _ga cookie). Google, LinkedIn, OpenAI, LiveIntent and Demandbase keep their own copies, so ask them directly using the links above. Our privacy policy explains your rights.

Changes to this policy

We update this page when we add, remove or change a cookie or tool on our site. We also re-check it at least every three months, because other companies can change their tools without telling us. The date at the top shows when we last changed it.

Contact us

Questions about cookies or this page? Email hello@crescatdigital.com. For requests about your data rights, you can also email our Data Protection Officer at lee@crescatdigital.com.

Or write to us at Crescat Digital Ltd, Unit 2 The Bramley Business Centre, Station Road, Bramley, Guildford, Surrey GU5 0AZ (our registered office). Company number 09369289.

Our privacy policy explains how we handle personal data and your rights, and how to complain. You can also complain to the Information Commission, formerly the Information Commissioner's Office (ICO). It is the UK regulator for data protection. Its website is ico.org.uk and its helpline is 0303 123 1113.