Cookie Policy

1. What are cookies?

Cookies are small text files stored by your browser when you visit a website. They allow the site to remember information across page loads — for example, that you are signed in.

2. What cookies we use today

EcoDiligence currently uses only essential cookies required to operate the service. We do not set analytics cookies, marketing cookies, or third-party tracking cookies.

• Clerk authentication cookies — set by our auth provider (Clerk) to keep you signed in across pages. These expire when you sign out or after a period of inactivity.
• Vercel session cookies — set by our hosting provider for routing and security. Short-lived.

Because these cookies are strictly necessary for the service to function, they are exempt from the consent requirement in Article 5(3) of the EU ePrivacy Directive. That exemption covers the cookies listed above and nothing else — our analytics and session recording are described separately in sections 3 to 5, together with the legal basis we rely on for each of them.

3. Session recording and page analytics (PostHog)

This section describes PostHog only. The product analytics we run inside the questionnaire are different, and are described separately in section 4.

EcoDiligence uses PostHog to count page views, record anonymized session replays, and understand which parts of the service are used. This configuration:

• keeps analytics state in memory only, not in a cookie;
• records how you interact with the page (clicks, scrolling, mouse movement) to help us diagnose issues and improve the product;
• masks the contents of all form fields — what you type is never captured;
• masks the text of the page itself, so a replay shows layout and interaction but not the content you are reading or the figures in your ESG Passport;
• does not link recordings to a persistent identifier across visits; and
• does not create person profiles for anonymous visitors.

Because this processing is not strictly necessary to deliver the service, we do not rely on the exemption in section 2. We rely on our legitimate interest in diagnosing faults and improving the product, balanced against the limits above — for this PostHog processing: no cookies, no cross-visit identifier, and no page or form content in the recording. You can object to it at any time.

To opt out of the PostHog analytics and session recording described in this section, turn on the do-not-track setting in your browser — we honour it here, and it stops both before anything is sent.

Do-not-track does not currently stop the product analytics in section 4, which run on our own servers rather than through PostHog. To object to those, email privacy@ecodiligence.com and we will confirm the objection in writing.

4. Product analytics inside the questionnaire

When you fill in the ESG Passport questionnaire, we record how far you get — which step is on screen, which step you completed, and whether you were asked to create an account. This runs on our own servers, not through PostHog, and it is how we find the places where the questionnaire stops people.

• It uses an identifier that lasts across visits. A random id is stored in your browser next to your saved draft, so that resuming the questionnaire tomorrow counts as the same attempt rather than a new one. The copy in your browser expires after 30 days, and discarding your draft deletes it immediately along with your answers.
• The records already sent to us are kept for 400 days. They sit in an append-only log so that a record of what happened cannot be quietly rewritten, and a weekly sweep deletes anything past that age — so the oldest record we hold is a little over thirteen months. Clearing your browser stops that id being used again; it does not remove anything already sent. The records hold the random id, the step, the gate and the country — not your name, your email or your answers.
• If you share a browser, erasing one person can affect the other. The id in section 4 belongs to the browser, not to an account. If someone asks us to erase them and you later use the same browser, your questionnaire progress is recorded without any identifier attached — it still counts, but it is no longer linked to you. We would rather hold less than guess which of you is which.
• You can ask us to erase you from them. Email privacy@ecodiligence.com and we will remove you from these records. Progress records are stripped of every identifier and kept as a count that points at nobody — we would rather keep an anonymous tally than silently change past figures. The few records tied to a specific transaction, such as a checkout, are deleted outright instead, because those cannot be made anonymous convincingly. We will also tell you what was held, stop further collection for you, and confirm in writing.
• The id is random. It is not derived from your name, your email, your company or anything you typed, and it is not linked to the PostHog recordings in section 3.
• One answer is sent with it, and only one: the country you selected, so we can see which markets get stuck where. Everything else is about your progress, not your answers — the step number and which account gate you met. No other field you fill in is transmitted.
• If you create an account, the records stop being anonymous. From that point every progress record carries your account alongside the id — not one linking record, but each one — so that we can tell whether people who start the questionnaire finish it.

As with section 3, this is not strictly necessary to deliver the service, so we rely on our legitimate interest in understanding where the questionnaire fails people — balanced against the id being random, not reused once your browser copy is gone, and carrying no answer except the country.

Do-not-track does not currently stop this. We are telling you rather than implying otherwise. To object, email privacy@ecodiligence.com and we will confirm it in writing.

5. Where you first arrived from

When you first land on this site, your browser stores which page you arrived on, the domain of the site that linked you (if any), and any campaign tags in the link — nothing else. It tells us whether our guides and comparison pages actually bring people here, which is not something we can tell from the pages themselves.

• It is stored in your browser’s local storage, not in a cookie, and it is cleared after 30 days.
• It contains no identifier — nothing in it distinguishes you from anyone else who followed the same link, and in your browser it is stored separately from the questionnaire id in section 4.
• If you create an account, the two can be connected. This record is attached to your organisation, and the questionnaire id is also recorded against that organisation when you sign up — so we can see that an account which arrived from a particular page went on to complete the questionnaire. That connection exists only for accounts, never for visitors who do not sign up.
• If you send us an enquiry, it is attached to that enquiry. When you submit one of our contact forms, this record goes with it, so we can tell which page produced the enquiry. What we store alongside it is the date and the supplier-count band you selected — your name, email address and company name reach us by email and are not put into that record, and no identifier is added to it.
• We keep the domain that linked you, never the full address — a referring address often carries the words you searched for. We keep the page you landed on, never the rest of the address.
• If you create an account, this is attached once to your organisation so we know which page introduced it to us. It is recorded once and never updated afterwards.

As in sections 3 and 4, this is not strictly necessary to deliver the service, so we rely on our legitimate interest in understanding which of our own pages are worth writing — balanced against there being no identifier, no cookie, and no address beyond a domain and a path. Clearing your browser storage for this site removes it.

6. Managing cookies in your browser

You can clear or block cookies through your browser settings. Note that blocking the essential cookies listed above will prevent you from signing in to EcoDiligence. Each browser handles this differently:

• Chrome: Settings → Privacy and security → Cookies and other site data.
• Firefox: Settings → Privacy & Security → Cookies and Site Data.
• Safari: Preferences → Privacy → Manage Website Data.
• Edge: Settings → Cookies and site permissions → Cookies and site data.

7. Related policies

For details on how we handle personal data more broadly, see our Privacy Policy.

8. Contact

Questions about this Cookie Policy: privacy@ecodiligence.com.