Applies to: handlet.ai and related Handlet websites and applications.
This Cookie Policy explains how Handlet uses cookies, local storage, and similar technologies when you use our platform. It should be read alongside our Privacy Policy and Terms of Service.
Some cookies may store a unique identifier but do not directly identify you.
1. What are cookies?
Cookies are small text files stored on your device (computer, tablet, or mobile) when you visit a website. Local storage is another browser storage technology that can remember choices in your browser. These technologies are widely used to make websites work properly, remember your preferences, and understand how the site is used.
Handlet uses cookies and similar storage where necessary to provide the service, remember choices you make, attribute a sign-up referral, and keep you signed in. We follow UK GDPR and the Privacy and Electronic Communications Regulations (PECR) and use clear, plain language about what we do.
2. Cookies used by Handlet
We use cookies for:
Keeping you signed in — So you can use the Handlet app without logging in again on every page.
Remembering your preferences — Such as language and theme (light/dark mode), essential for your experience of the service.
Remembering interface choices — Such as whether the sidebar is open or closed, so the app behaves the way you left it.
We do use cookies for advertising or to track you across other websites. We do not sell cookie data to third parties.
AI Assistance: Handlet uses AI for intent recognition and, where enabled, drafts, summaries, quote support, social content and call assistance. AI output can be wrong and should be checked before use. Learn More
not
If analytics or other non-essential cookies are enabled, we request consent before loading them. Rejecting optional cookies does not prevent you from using the service.
Reply handling time in a memory pilot. If your workspace has agreed to take part in a pilot of Handlet's customer memory, the Inbox measures how long you actively spend on each AI-drafted reply. It notes when you type, click, scroll or move the pointer, and counts nothing while the page is hidden or you are in another window. Only totals are sent to Handlet and kept with the reply's record: no text, no keystrokes and no pointer positions. Nothing is stored on your device and nothing is sent to Google Analytics. Workspaces that are not in a pilot are not measured.
3. Strictly necessary cookies
These cookies are essential for the website and app to function. They enable core features such as signing in and staying signed in. You cannot turn these off if you want to use Handlet.
Purpose
Typical name(s) / description
Duration
Type
Authentication
Session cookies set by our authentication provider (e.g. Supabase) to keep you signed in.
Session or as needed for security
Strictly necessary
Request security
csrfSecret, an HTTP-only anti-forgery secret used to protect forms and server requests.
Session or short security period
Strictly necessary
4. Preference cookies
These cookies remember choices you make, such as theme, language, sidebar state, or layout. They support interface customisation requested by the user. Some preference cookies may not be strictly necessary for the website to load, but they help the app work in the way you asked it to work.
Purpose
Cookie name
Duration
Type
Theme preference
theme
1 year
Preference
Language preference
lang
1 year
Preference
Sidebar state
sidebar:state
7 days
Preference
Layout preference
layout-style
Session or as set
Preference
Cookie choice
cookie_consent_status in local storage and a first-party cookie, with a server-side consent audit event where available
Up to 1 year or until cleared by the user
Preference / consent record
Sign-up referral
handlet_referrer_id
30 days
Referral attribution
Details:
theme — Stores whether you prefer light, dark, or system-based appearance. Path: /. SameSite: Lax. Set when you use or are offered theme preferences.
lang — Stores your chosen language for the interface. Path: /. SameSite: Lax. Set when language preferences are available or selected.
sidebar:state — Remembers if the app sidebar is open or collapsed. Path: /. SameSite: Lax. Set when you use the app sidebar.
layout-style — Remembers layout preferences within the Handlet app. Set when layout preferences are available or selected.
cookie_consent_status — Stored in browser local storage and a first-party cookie to remember whether you accepted or rejected optional cookies and allow the server to respect that choice. Where available, Handlet also records a server-side audit event with the consent status and category state.
handlet_referrer_id — A first-party, HTTP-only cookie used to remember a valid referral identifier after optional-cookie consent when you open the sign-up page from a referral link. It is not used to track you across websites.
4a. Analytics cookies (only if you accept)
Purpose
Cookie name
Duration
Type
Tells visits from different browsers apart
_ga
2 years after your last visit
Analytics (optional)
Keeps one visit's activity together
_ga_<container-id>
2 years after your last visit
Analytics (optional)
Set by Google Analytics on handlet.ai, and only after you accept optional cookies.
Where you came from (only if you accept)
If you accept optional cookies, Handlet also keeps one item in your browser's local storage, handlet_first_touch, for up to 90 days. It records where you first arrived from: the campaign tags in the link you followed (the utm_ tags), the kind of site that sent you (for example search, social or direct) and the host name of that site, the name of the first Handlet page you saw, and the plan you chose on the pricing page. It does not record the full address, anything you typed, or the page you came from beyond its host name.
If you then join the early-access waitlist, this is saved with your waitlist entry so we can tell which sources bring us customers who go on to use Handlet. It is deleted from your browser if you withdraw consent through Cookie settings. If you do not accept optional cookies, nothing is kept in your browser and nothing about where you came from is saved with your waitlist entry.
What Google Analytics receives
When you accept, Google Analytics receives the name of the page and the part of Handlet it belongs to (for example "pricing" or "team inbox"), not the full address shown in your browser. Anything after a "?" in a page address is removed, except the campaign tags (utm_ tags) that show which campaign brought you here. The name of a business or workspace in an address is replaced with a placeholder, and the identifier of a customer, conversation or other record is never sent.
Google Analytics also receives a small set of actions, each described by a fixed label rather than anything you typed: which sign-up or pricing button you clicked (and which plan it was for), whether you started and completed the waitlist form (never the address or website you entered), whether you read most of a page, whether an account was created, that you began choosing a plan in billing, and, as you set up your workspace, which setup step you were on and whether you finished it, skipped it or hit a problem, which kind of channel you connected (for example WhatsApp or email), that you saw your first reply draft, which area of Handlet you opened (for example the inbox or reviews) once per visit, when a connection to a channel was started or did not complete (and a broad reason, never the provider's message), and when the inbox shows that no channel is connected yet.
If you are signed in and have accepted optional cookies, Handlet's servers may also send Google Analytics a few confirmed milestones about your account, linked to the same browser identifier: that your first reply was sent to a customer, that a subscription checkout was completed (with the plan name), a broad status of how your account is doing (for example "active" or "quiet"), and whether a reply written by the AI was sent as written or after editing. These carry no email address, name, customer details or message contents. This stops when you withdraw consent through Cookie settings or sign out, and nothing is sent for anyone who has not accepted.
If you are signed in, Google Analytics receives a random identifier for your Handlet user account, so visits can be linked together. It does not receive your email address, name, telephone number, your customers' details or the contents of any message. When you sign out, that identifier is cleared. Analytics are only sent from the live handlet.ai site, not from test or development versions of Handlet.
5. Third-party services
Handlet is the data controller for the cookies we set. When you use parts of our service that involve third-party providers, those providers may set their own cookies. We only use providers that are necessary for the service and that meet our data protection standards.
Examples of where third-party cookies may be used:
Authentication — Our authentication provider (for example Supabase) may set cookies to keep your session secure.
Payments — Our payment provider (for example Stripe) may set cookies when you manage your subscription or complete a payment.
Analytics — If enabled and accepted, analytics providers such as Google Analytics may set cookies or similar technologies to help us understand product usage. Product analytics instrumentation is present in various parts of the application (including the Inbox for triage workflows) to measure categorical actions such as opening conversations, switching queues, and selecting composer modes. These events only reach an analytics provider when both consent is given and the service is configured. Analytics consent is recorded separately from necessary cookies. The Google Analytics script is not loaded at all until you accept optional cookies; the cookies it then sets are listed in section 4a. If you withdraw consent through Cookie settings, Handlet stops Google Analytics for the rest of that visit, removes the Google Analytics cookies it set, and does not load it on later visits. Google's advertising features — Google signals, ad personalisation and advertising storage — are switched off. Google Analytics collects and processes data as described in How Google uses information from sites or apps that use our services.
Connected Google Analytics data — If a workspace manager connects GA4, Handlet uses OAuth and server-to-server Google APIs to retrieve the selected business reporting data for Website Intelligence (including Universal-style period windows such as 28 days and longer selectable ranges). This connection does not add Google Analytics measurement scripts or cookies to the business website or to the Handlet app. Any optional analytics cookies used by Handlet itself remain subject to the consent choice described above. Where a business connects its own Google Analytics property, that business is responsible for the cookie notice and consent on its own website; Google's own processing is described at the partners page linked above.
Marketing trackers — Handlet does not currently use marketing or advertising trackers, and does not set advertising or cross-site tracking cookies on handlet.ai, in the Handlet app, or on a customer's website. If this changes, we will add a separate marketing consent category before loading them.
Security checks — If enabled, anti-abuse providers such as Cloudflare Turnstile may use cookies or similar technologies to verify that forms are not being abused.
Reliability monitoring — Sentry may receive minimised error and performance events where configured. We treat this as strictly necessary reliability and security telemetry, not optional analytics or marketing. Handlet's current configuration disables session replay, browser and server profiling, console-log capture, Sentry log ingestion, and default personal-data collection.
Details of how we share data are in our Privacy Policy. We do not use third-party advertising or tracking cookies on Handlet.
5a. Advertising identifiers in enquiry links
Where a workspace enables lead-source measurement, Handlet records advertising click identifiers (such as Google's gclid, gbraid, and wbraid, or Meta's fbclid) and UTM parameters so a business can see which marketing channel produced an enquiry.
These are read server-side from the link the visitor followed when they submit an enquiry, start a chat from a landing page, or use a click-to-message link. Handlet does not set an advertising cookie or use browser storage to collect them, does not read them across other websites, and does not build a cross-site identity profile. Where a landing page hands a visitor to a Handlet chat, this uses a short-lived, single-use token of which only a hashed form is stored.
Handlet records the consent state it is given with each captured enquiry — granted, denied, not required, or unknown. Handlet does not collect that consent itself. If a business's own website sets advertising or analytics cookies, or reads advertising identifiers on the visitor's device, that business is responsible for obtaining and recording valid consent under PECR and UK GDPR, and for the notice it gives visitors, before those identifiers reach Handlet. Google's own advertising and consent requirements for UK, EEA, and Swiss end users apply to the business's use of Google's advertising products.
Retention of these identifiers is limited: see section 10 of the Privacy Policy.
6. How to control cookies
You can reopen the consent banner at any time using Cookie settings in the website footer. You can also control or delete cookies through your browser settings. Most browsers let you:
Block all cookies.
Block only third-party cookies.
Delete existing cookies.
If you block or delete cookies or local storage, some parts of Handlet may not work (for example, you may be signed out, your theme and language may reset, or your cookie choice may need to be given again). Instructions for managing cookies are usually found in your browser's "Help" or "Settings" section, or on sites such as allaboutcookies.org.
7. Updates
We may update this Cookie Policy from time to time to reflect changes in our use of cookies or in law. When we make changes, we will update the “Last updated” date at the top. We encourage you to review this page periodically.
8. Contact
If you have questions about our use of cookies or this policy, please contact us: