This Cookie Policy explains how WhealBit, trading as QWTN ("QWTN", "we", "us", "our"), uses cookies, local storage and similar technologies on our website at qwtn.co.uk, in our free tools, in the signed-in QWTN application and in the client portal. It should be read together with our Privacy Policy and, where you are a customer, our Terms of Service and Data Processing Agreement. For personal data that customers process inside the app, the customer is the data controller and QWTN acts as its processor; for our website and for account and billing data, QWTN is the controller.
This policy describes the technologies we use, whether the law requires your consent for them, and how you can refuse, change or delete them at any time. It is governed by the Privacy and Electronic Communications (EC Directive) Regulations 2003 (as amended) ("PECR") and, where any cookie or similar technology involves personal data, by the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018.
The law in this area is changing. Cookie and consent rules may be affected by the Data (Use and Access) Act 2025, which is expected to introduce some new exceptions to the consent requirement. We do not rely on any such exception unless and until it is in force and lawfully applies; we keep this policy under review and will update it as the position is confirmed.
1. What cookies and similar technologies are
A "cookie" is a small text file that a website asks your browser to store on your device. Cookies can let a site work properly, remember your choices, keep you signed in, keep the site secure and help the operator understand how the site is used. When you return, the site can read back the cookies it set.
"Similar technologies" means other ways of storing or reading information on your device that work in a comparable way and are treated the same way under PECR. They include:
- Local storage and session storage (sometimes called "web storage"): browser-based storage used by web applications to hold information such as a draft note or interface state.
- Scripts and tags that record limited information about how a page is used, such as our product analytics (see section 3).
Cookies may be "session" cookies, which are deleted when you close your browser, or "persistent" cookies, which remain for a set period or until you delete them. They may be "first-party" (set by us) or "third-party" (set by another organisation - see section 7). PECR only applies where information is actually stored on, or read from, your device; technologies that store nothing on your device fall outside it.
2. The website, the free tools, the app and the portal
QWTN runs on one domain, qwtn.co.uk, but different parts of it store different things:
- The public website and free tools are information pages and tools anyone can use without an account. Our free waste transfer note tool keeps your draft (including anything you type or sign) in your browser's local storage so you do not lose it; it is not sent to us. The cookie notice records your analytics choice in a first-party cookie.
- The signed-in application (under qwtn.co.uk/app) sets strictly necessary storage that is essential to deliver the service you have asked for - for example, to keep you securely signed in and to remember that you have finished onboarding. It also keeps some optional interface preferences in local storage, such as whether the sidebar is open and your recent searches.
- The client portal sets a strictly necessary session cookie when a customer's client signs in through an emailed link.
Strictly necessary storage does not require consent under PECR; we still describe it here for transparency. How we handle the personal data behind these features is explained in our Privacy Policy and, for customer data, in our Data Processing Agreement.
3. Categories of cookies and similar technologies we use
The table below sets out the categories, whether consent is required, and what we currently set. If that changes, we will update this policy.
| Category | Consent required? | Status and purpose | Examples / notes |
|---|---|---|---|
| Strictly necessary | No - exempt under PECR | In use. Needed for the Service to function and to keep it secure. You can block them in your browser, but parts of the Service may then not work. | sb-[project]-auth-token (first-party cookie, sometimes split into numbered parts): your sign-in session with our authentication provider, Supabase; kept until you sign out or the session expires. qwtn_portal_session (first-party, HTTP-only cookie): client portal sign-in; ends after 30 days without use and after 90 days at most. qwn_onboarding_done (first-party cookie): records that you completed account set-up so you are not sent back to it, 1 year. qwtn_cc (first-party cookie): records whether you accepted or rejected analytics, 180 days. Cloudflare Turnstile, our bot check at sign-up, may store or read information needed to tell people from automated scripts. |
| Functional / preferences | Treated as necessary to the feature you are using | In use (local storage only, on your device, not sent to us). | Free waste transfer note drafts and your saved details and branding for that tool; sidebar open/closed state (sidebar_state, sidebar:favourites-open); recently viewed search items. Clearing your browser storage removes them. |
| Analytics | Yes, under PECR, where information is stored on your device | In use. We use PostHog product analytics, hosted in PostHog's EU cloud, to understand which pages and features are used and how the Service performs. PostHog is only loaded after you click "Accept analytics"; until then no PostHog script runs and nothing is stored. | PostHog stores a randomly generated identifier in a first-party cookie (ph_[project key]_posthog, up to 1 year) and in local storage. You can block or delete it through your browser as described in section 5. Set only with your consent, given through our cookie notice; you can withdraw at any time via "Cookie settings" in the footer, which stops PostHog and deletes its cookies and storage. A Global Privacy Control signal is treated as a refusal. |
| Advertising / cross-site tracking | Yes | Not in use. We do not use advertising cookies, pixels or cross-site tracking. | If we ever introduce them, we will update this policy and ask for your consent first. |
4. Consent
Strictly necessary storage does not require consent, for the reasons given in section 3, and is used as soon as you use the relevant part of the Service. Our cookie notice asks for your consent to PostHog analytics, with equally prominent "Accept analytics" and "Reject" buttons, and links to this policy. Analytics stays off unless you accept. Your choice is remembered for 180 days, and you can change it at any time using the "Cookie settings" link in the footer. We do not use pre-ticked boxes or "cookie walls" that deny access to the Service.
If you ever believe a tool on our site does not behave as described here, please contact us at privacy@qwtn.co.uk so we can investigate and correct it.
5. How to refuse, change or delete cookies and storage
You can change your analytics choice at any time using Cookie settings in the site footer. You can also control storage through your browser: most browsers let you view, block and delete cookies and clear local storage ("site data") through their settings or privacy menu. You can usually set your browser to warn you before a cookie is stored, or to refuse cookies altogether, and to use a private or incognito mode. Many browsers and extensions can also block analytics scripts. Steps differ by browser, so please check your browser's help pages.
6. Consequences of blocking or deleting storage
You are free to block, refuse or delete cookies and storage. Please be aware:
- If you block strictly necessary storage, parts of the app and client portal will not work - for example, you will be unable to stay signed in.
- If you clear local storage, any unfinished free waste transfer note draft on that device will be lost, and interface preferences will reset.
- Blocking or deleting the analytics cookie has no effect on how the website or app works for you; it only means our analytics will not count you.
7. Third-party technologies and our service providers
We keep third-party technologies to a minimum. PostHog (analytics) and Cloudflare Turnstile (bot protection at sign-up) run scripts on our pages as described in section 3. Some pages also load content from third parties, which receive your IP address and browser information when they do but which we do not use to set cookies: map tiles from OpenStreetMap and Esri, map marker images from unpkg, and fonts from Google Fonts. Links that open Google Maps take you to Google's own site, under Google's own privacy and cookie notices.
Separately, a number of service providers help us operate the QWTN service itself (for example our hosting, database and authentication, payment, and transactional email providers). These providers may set strictly necessary storage in the app or process related personal data. They are a distinct matter from website cookies: for customer data processed in the app they are engaged as our sub-processors under Article 28 UK GDPR, with the customer as controller and QWTN as processor. Their identities, roles and regions are listed in our sub-processors list and described in our Privacy Policy.
8. Cookies and personal data
Some cookies and similar technologies can involve personal data (for example an identifier in a cookie). Where they do, that processing is also governed by the UK GDPR and is described in our Privacy Policy, including the lawful basis we rely on, the recipients, any international transfers and the safeguards used, retention periods, and your individual rights (including the right to complain to the Information Commissioner's Office).
We do not use cookies, analytics or similar technologies to collect, infer or store special-category data (such as accident and injury information). Any such data is processed only within the app, by the customer as controller, under the safeguards set out in our Privacy Policy and Data Processing Agreement.
This Cookie Policy does not affect, limit or exclude your statutory rights under data protection law.
9. Changes to this policy
We may update this Cookie Policy from time to time to reflect changes in the technologies we use, our providers, or the law (including any guidance or exceptions that come into force under the Data (Use and Access) Act 2025). When we make material changes we will update the "last updated" date shown with this policy and, where a change introduces new non-essential cookies, we will obtain your consent before relying on it. Please check this page periodically.
10. Contact
If you have any questions about this Cookie Policy or our use of cookies and similar technologies, please contact us at privacy@qwtn.co.uk, or write to us at St Ives, Cornwall. You also have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority, at ico.org.uk.
Related documents: Privacy Policy, Terms of Service, Data Processing Agreement, Sub-processors, Acceptable Use Policy and Service Level Agreement.