Legal
Cookie Policy
Last updated: 19 February 2026
1. What are cookies?
Cookies are small text files placed on your device when you visit a website. They are widely used to make websites work, improve efficiency, and provide information to website owners.
We use cookies and similar technologies (such as local storage) in accordance with the Privacy and Electronic Communications Regulations 2003 (PECR) and the UK General Data Protection Regulation (UK GDPR).
2. How we use cookies
We use cookies for the following purposes. Non-essential cookies are only set with your consent, which you can manage at any time via the cookie banner or the "Manage cookie preferences" link at the bottom of any page.
2.1 Essential cookies (strictly necessary)
These cookies are necessary for the website to function and cannot be switched off. They are usually set in response to actions you take, such as logging in, setting your privacy preferences, or filling in forms.
| Cookie | Purpose | Duration |
|---|---|---|
| stepzero_cookie_consent | Records whether you have accepted or declined cookies | 1 year |
| stepzero_cookie_preferences | Stores your cookie category preferences | 1 year |
| userProfile | Stores your session and role for authenticated access | Session |
| _GRECAPTCHA | Google reCAPTCHA, provides security and bot protection on login and signup forms | 6 months |
2.2 Analytics cookies (optional)
These cookies help us understand how visitors interact with StepZero by collecting information anonymously, including which pages you view, how you navigate between them, where you came from (for example a search engine or a marketing campaign link), and your progress through our onboarding sign-up flow. This data helps us improve the Service. These cookies are only set if you give your consent.
| Cookie | Purpose | Duration |
|---|---|---|
| _ga | Google Analytics, distinguishes unique users | 2 years |
| _ga_* | Google Analytics 4, maintains session state | 2 years |
2.3 Marketing cookies
We do not currently use any marketing or advertising cookies. If we introduce marketing cookies in the future, we will update this policy and request your consent before setting them.
3. Managing your cookie preferences
You can manage your cookie preferences at any time by:
- Cookie banner: when you first visit StepZero, a banner lets you accept all, reject non-essential, or choose specific categories.
- Browser settings: most browsers allow you to block or delete cookies through their settings. Note that blocking essential cookies may affect the functionality of the Service.
- Clearing stored preferences: you can clear your browser's local storage to reset your cookie preferences, and you will see the cookie banner again on your next visit.
4. Local storage
In addition to cookies, we use your browser's local storage (a similar technology) to store:
- Your cookie consent and preference choices
- Your user session data for authentication
- Application state to improve your experience
Local storage data remains on your device until you clear it via your browser settings or until the Service removes it.
5. Third-party cookies
Some cookies may be placed by third-party services we use. These third parties have their own privacy policies governing their use of cookies:
Google reCAPTCHA
We use Google reCAPTCHA v3 on our login and signup pages to protect against automated bot attacks. reCAPTCHA works by analysing your interactions with the page (such as mouse movements and browsing patterns) to determine if you are a genuine user. This data is sent to Google for processing.
We classify reCAPTCHA as a strictly necessary security measure under PECR Regulation 6(4). reCAPTCHA is integral to the authentication service you have explicitly requested, without it, we cannot adequately protect user accounts from credential-stuffing and bot attacks. reCAPTCHA is loaded only on authentication pages (login and signup), not across the rest of the site. We have assessed this classification and are satisfied it meets the ICO's strict necessity test.
Google reCAPTCHA is subject to the Google Privacy Policy and Terms of Service. Data transferred to Google in the United States is covered by the UK-US Data Bridge, under which Google LLC is certified.
Google Sign-In
If you choose to log in using Google Sign-In, Google will set cookies to manage the authentication session. These cookies are only set when you actively choose to sign in with Google. This processing is based on your explicit action and is covered by Google's Privacy Policy.
Google Analytics (with consent)
If you consent to analytics cookies, we use Google Analytics 4 to understand how visitors use StepZero. We track page views, where visitors come from (referrer and campaign parameters present in the URL, if any), progress through the onboarding sign-up steps, and successful account sign-ups. We do not track personally identifiable information through Google Analytics. GA4 anonymises IP addresses by default. Data is processed by Google under a Data Processing Agreement and transfers to the United States are covered by the UK Extension to the EU-US Data Privacy Framework.
- Google Privacy Policy: policies.google.com/privacy
- Google Analytics opt-out: Browser add-on
6. Legal basis
Our use of cookies is governed by:
- Essential cookies: these are exempt from consent under Regulation 6(4) of PECR as they are strictly necessary for the Service you have requested.
- Non-essential cookies (analytics and marketing): these require your prior consent under Regulation 6 of PECR. We obtain this through our cookie banner with clear opt-in controls (no pre-ticked boxes).
7. Changes to this policy
We may update this Cookie Policy from time to time to reflect changes in technology, legislation, or our business practices. When we do, the "Last updated" date at the top will be revised.
8. Contact us
If you have questions about our use of cookies:
- Email: privacy@stepzero.eco
- See also our Privacy Policy