Cookie policy

The short version

This website is HTML rendered on our own server. Apart from the anti-bot challenge on our forms, and Google Analytics once you have accepted it, it loads nothing from a third party. It sets three first-party cookies that keep the site working, one more to remember your answer to the cookie banner, plus one from Cloudflare where that challenge is switched on. There are no advertising cookies, and nothing here follows you to another site.

The campaign parameters that tell us where an enquiry came from are held in a first-party cookie that is discarded when you close the tab, and read only if you submit a form.

What counts as a cookie here

We use "cookie" loosely, as the regulations do, to cover anything stored on your device: cookies proper, plus localStorage and sessionStorage . The rules turn on storing or reading data on your device, not on the storage mechanism.

What this site sets

Each one is either needed for something you asked the site to do, or needed to keep our forms usable, which is why they are set without asking you first: under the ePrivacy Directive and UK PECR they are exempt.

Cookie	What it does	Lasts
fulcrum	Set by our server. Carries form validation state across a submission, so a form that comes back with an error can show you what to fix. HttpOnly , SameSite=Lax .	Until you close your browser
fulcrum_attribution	Set by our server. Records the campaign parameters and the referring site present when you first arrived, so an enquiry you submit later is attributed to the right source. First touch only, never overwritten, and read only when you submit a form. HttpOnly , SameSite=Lax .	Until you close the tab
fulcrum_csid	Set by our own tracking. An anonymous visitor identifier, carrying no name or email, read when you submit a form so the enquiry can be tied to the visit.	12 months
Cloudflare Turnstile	Set by Cloudflare, only where we have configured a site key and only on pages with a form. Tells people from bots, and may set a cookie of its own to do it.	Session
fulcrum_consent	Set by our own script in your browser when you answer the cookie banner. Records whether you accepted or declined analytics, so we do not ask again on every page. Readable by our script, SameSite=Lax .	6 months

Analytics - consent required

Set only after you accept. Declining leaves the site fully functional.

Cookie	What it does	Lasts
_ga , _ga_<id>	Set by Google Analytics 4, which we load only once you have accepted it. Counts visits and shows which pages and campaigns bring people here. We use it in aggregate; we do not use it to build a profile of you, and the advertising and personalization signals are switched off.	Up to 24 months

What we do not set

No advertising cookies. No cross-site tracking pixels. No social media trackers. We do not sell or share cookie data for targeted advertising, and we do not run remarketing from this site.

Analytics is the only thing here that asks for your consent, and nothing analytics-related loads until you give it. With JavaScript switched off, nothing analytics-related loads at all and no banner appears.

Changing your mind

Use the cookie settings link in the footer to change your choices at any time.

You can clear or block cookies in your browser at any time. Every major browser has controls under Privacy or Settings, and blocking all cookies will not stop you reading this site or contacting us. The only thing you lose is that a form which comes back with an error may arrive empty rather than showing you what you typed.

Most browsers send a Global Privacy Control signal if you enable one. We treat GPC as a valid opt-out of sale and sharing under California and Colorado law, and it applies automatically without you doing anything else.

Questions

Write to privacy@fulcrumsaas.com . Broader detail is in our privacy policy and GDPR and CCPA page .