Cookie Policy
Effective 14 July 2026 · v1.2
This policy explains how Arlo uses cookies and similar technologies on our website and app, what each one does, and how you stay in control. It covers both what we use today and the kinds of tools we expect to adopt as Arlo grows, so you know what each consent choice covers now and in future. We only use essential storage until you tell us otherwise; everything else waits for your consent, and you can review or change your choice at any time. It should be read alongside our Privacy & Cookie Notice.
1. What this policy covers
It covers the cookies and similar technologies we use across www.askarlo.co.uk and the Arlo web app, whether they are set by us or by a service we embed. It applies to anyone who visits our site or uses the service. It does not cover third-party websites you reach through links from our pages; those sites have their own cookie and privacy policies, which you should review separately.
2. What cookies and similar technologies are
A cookie is a small text file that a website asks your browser to store on your device, so it can recognise that browser on later visits or as you move between pages. "Similar technologies" do comparable things by other means. In this policy, "cookies" is shorthand for all of the following:
| Cookies | Small files stored by the browser and sent back to the site that set them. |
|---|---|
| Local & session storage | Key-value stores in your browser. Local storage persists until cleared; session storage lasts only for the current tab. Arlo uses these to keep you signed in and to remember your choices. |
| Tags & pixels | Small pieces of code (such as the Google tag) that load a service and can measure page views or events. |
| SDKs | Software libraries that run in your browser to provide a feature, for example our analytics library. |
| Session replay | A technology (Amplitude Session Replay) that records an anonymised, text-masked reconstruction of on-screen interactions to help us find usability problems. |
Cookies are described as first party when they are set by Arlo, and third party when they are set by another company whose service we load (such as our demo scheduler or analytics providers). They are session cookies if they are deleted when you close your browser, or persistent if they remain until they expire or you delete them. The tables in section 5 show which is which.
3. The four categories
We group everything into four categories. The cookie banner lets you accept all of them, reject all non-essential ones, or choose category by category. Essential storage keeps the service working and secure, so it does not need consent and cannot be turned off; the other three are off until you allow them.
| Essential (always on) | These are required for the site to work - they sign you in, keep you signed in, remember your cookie choice, and keep the service secure. Because the service cannot run without them they do not need consent and cannot be switched off. We store them in your browser, not as tracking cookies, and share none of them with third parties. |
|---|---|
| Performance and Functionality | These are not essential but improve how the site works - remembering preferences and loading optional embedded content you choose to use. Today this covers the Calendly scheduler on our 'Book a demo' section: turning this on loads Calendly, which sets its own cookies and receives the booking details you enter (name, email and chosen time). If you switch it off, some features may not be available. |
| Analytical | These help us understand how the site is used - which pages are read, where people drop off, how features are used - so we can improve it. The measurement is aggregated and used to improve the product, not to identify you. Today this covers Google Analytics and Amplitude (including Amplitude Session Replay, which records anonymised on-screen interactions with all text masked, in the EU data region). As Arlo grows we may add other analytics tools, and any of them run only when you switch this on. Google Analytics uses Google Consent Mode, so until you allow it, it sets no cookies. |
| Advertising | These would let us or partners measure marketing campaigns and show relevant ads across sites. We run no advertising cookies today, but as we grow we may work with partners such as Meta (Facebook) and Google Ads. If we do, they will load only when you switch this on - never before. |
4. Your consent and our lawful basis
Under the UK Privacy and Electronic Communications Regulations (PECR) and UK GDPR, we may store or read essential cookies without consent because they are strictly necessary to provide the service you have asked for. For every non-essential category (Performance and Functionality, Analytical, Advertising) we ask for your prior consent, and we rely on that consent as our lawful basis. Consent is:
| Opt-in | Nothing non-essential loads until you allow it. Rejecting is as easy as accepting. |
|---|---|
| Granular | You can allow some categories and refuse others from the preferences panel. |
| Withdrawable | You can change or withdraw your choice at any time (see section 8). Withdrawing does not affect anything already lawfully processed. |
| Recorded | Your choice is stored in your browser so we do not have to ask again, and re-requested if this policy changes materially. |
Google Analytics is configured with Google Consent Mode. This means the Google tag is present on every page, but by default all storage is denied: it sets no cookies and sends only limited, cookieless signals until you allow Analytical cookies, at which point full measurement begins. Amplitude is stricter still and does not initialise at all until you allow Analytical cookies. We never place content behind a "you must accept cookies to continue" wall.
5. Cookies and storage we use
The tables below list, for each category, the cookies and storage involved, who provides them, what they are for, and how long they last. Some entries describe tools we may adopt as we grow; those are marked as such and load only under the matching consent category.
Essentialalways on
| askarlo_token | Keeps you securely signed in.Provider: Askarlo (first party) · Expiry: Local storage - until you sign out |
|---|---|
| askarlo_cookie_consent | Remembers your cookie preferences so we do not ask again.Provider: Askarlo (first party) · Expiry: Local storage - until you clear it |
| arlo_session_id | A per-tab id so we can keep the app responsive.Provider: Askarlo (first party) · Expiry: Session storage - current tab only |
Performance and Functionality
| Calendly embed | Loads the demo-booking widget and lets you pick a time.Provider: Calendly LLC (USA) · Expiry: Set by Calendly - see their cookie notice |
|---|
Analytical
| _ga, _ga_* | Distinguishes visitors and sessions to measure site usage. Sets cookies only after you allow Analytical cookies (Consent Mode).Provider: Google Analytics (Google, USA) · Expiry: Up to 2 years |
|---|---|
| AMP_*, amplitude_* | Product analytics and Session Replay (anonymised, all text masked) - how features are used. Initialised only after you allow Analytical cookies.Provider: Amplitude (EU data region) · Expiry: Up to 1 year |
| Future analytics | We may adopt further analytics tools as we grow; all will sit under this category and load only with your consent.Provider: e.g. other product/marketing analytics · Expiry: Varies by provider |
Advertising
| _fbp, fr | Would measure ad campaigns and audiences. Not in use today; loads only with your consent if we adopt it.Provider: Meta / Facebook (potential, USA) · Expiry: Up to 3 months |
|---|---|
| Google Ads (potential) | Would measure ad conversions and remarketing. Not in use today; loads only with your consent if we adopt it.Provider: Google (USA) · Expiry: Varies |
6. Third parties in detail
When you consent to a category that includes a third party, that company loads on our page and may set its own cookies and receive limited data about your visit. Here is what each one does and where to read its own policy.
6.1 Calendly: demo scheduler (Performance and Functionality)
Our "Book a demo" section embeds a scheduler provided by Calendly LLC (United States). It loads only after you allow Performance and Functionality cookies or choose to load it. When it loads, Calendly sets its own cookies and receives the booking details you enter (your name, email and chosen time) so it can arrange the meeting. See the Calendly cookie notice and Calendly privacy notice.
6.2 Google Analytics 4: web analytics (Analytical)
Provided by Google (United States). It helps us understand how visitors use the site - which pages are read, where people arrive from, where they drop off - using aggregated, non-identifying measurement. It runs in Consent Mode, so it stores no cookies (such as _ga) until you allow Analytical cookies. Google Analytics 4 does not log IP addresses. Read Google's privacy policy and how Google uses data from sites that use its services.
6.3 Amplitude: product analytics & Session Replay (Analytical)
Provided by Amplitude, Inc., with data stored in the European Union data region. It initialises only after you allow Analytical cookies and tells us how features are used across a session. It also runs Session Replay, which records an anonymised reconstruction of on-screen interactions with all text masked - so it does not capture what you type or any patient, client or clinical information shown on screen. You can opt out at any time by withdrawing Analytical consent. Read the Amplitude privacy policy.
6.4 Advertising partners (Advertising), not in use today
We currently run no advertising or marketing cookies. As we grow we may work with partners such as Meta (Facebook) or Google Ads to measure campaigns and show relevant ads. If we do, they will load only after you allow Advertising cookies, and we will update this policy first.
7. International transfers
Some of the providers above are based in the United States (Calendly and Google), and Amplitude, though it stores our data in the EU region, is a US company. Where personal data leaves the UK or EEA, it is protected by appropriate safeguards - the UK International Data Transfer Agreement or Addendum, or the EU Standard Contractual Clauses - together with supplementary measures where needed. Our Privacy & Cookie Notice lists all of our providers and sub-processors.
8. Managing and withdrawing your consent
You are always in control. There are three ways to manage cookies:
| Cookie preferences | Use the button below, or the 'Cookie preferences' link in the footer of every page, to review or change each category at any time. |
|---|---|
| Browser settings | Every major browser (Chrome, Safari, Firefox, Edge and others) lets you block or delete cookies and clear site storage. Steps vary by browser and device; check your browser's help pages. Note that blocking essential storage will stop parts of the service working. |
| Device & signals | Mobile browsers offer similar controls in their privacy settings. Some browsers send a 'Do Not Track' or Global Privacy Control signal; because there is no single agreed standard for how sites must respond, we treat the cookie banner and preferences panel as the reliable way to control non-essential cookies. |
Changing your mind takes effect immediately for anything not yet loaded; where a tool is already running, withdrawing consent stops further collection (and opts you out of Amplitude), and you can clear existing cookies via your browser. If we change the categories or the tools behind them, we will ask for your consent again.
9. Changes to this policy
We may update this policy from time to time to reflect new tools, legal changes, or feedback. The effective date at the top shows when it last changed. Where a change is material - for example adding a new third party or category - we will update the policy and re-request your consent through the banner.
10. Contact
Questions about cookies or your data can go to privacy@askarlo.co.uk. Arlo is provided by Raidical Ltd, a company registered in England and Wales (company number 16694183), with its registered office at 3 Wimpole Street, London, W1G 9SQ · www.askarlo.co.uk.