Skip to content
ClientTurn

Legal

Cookie Policy

What we store in your browser, why, for how long, and how to refuse anything not strictly necessary. Nothing optional is stored until you accept.

Version
28 September 2026
In force from
28 September 2026
Governing law
England and Wales

Who you are contracting with

ClientTurn is a trading name of Blackwellen Limited, a private company limited by shares registered in England and Wales under company number 16482166.

Registered office: 61 Bridge Street, Kington, Herefordshire, HR5 3DJ, United Kingdom. This is also our address for service of formal notices.

Support: support@clientturn.com · Legal, data protection and formal notices: legal@clientturn.com. These are the only two mailboxes we operate.

Blackwellen Limited is not currently registered for VAT. No VAT is charged on our invoices, and none may be reclaimed on them. We will publish our VAT number here and begin charging VAT from the date registration takes effect.

1. What this policy covers

Cookies are small files a website asks your browser to store. This policy covers cookies and every equivalent technology we use — localStorage, sessionStorage, pixels and device fingerprinting techniques — because regulation 6 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR) applies to all of them equally.

It applies to clientturn.com and to the ClientTurn application. It is published by Blackwellen Limited (company number 16482166), which decides what is stored on your device and is therefore the controller for it.

Where a cookie also involves personal data, the Privacy Policy explains our lawful basis, how long we keep it and your rights over it.

3. Strictly necessary storage

These are always set. Blocking them will stop you signing in or paying.

NameTypeSet byPurposeDuration
sb-<project>-auth-tokenFirst-party cookieSupabase (on our behalf)Holds your signed-in session so the application knows who you are on each request. Without it you cannot stay signed in.Session, refreshed for up to 30 days
sb-<project>-auth-token-code-verifierFirst-party cookieSupabase (on our behalf)A single-use value used to complete the sign-in exchange securely (PKCE). Deleted the moment sign-in finishes.Minutes
__cf_bm and Cloudflare network cookiesFirst-party cookieCloudflareDistinguishes real visitors from automated traffic and protects the site from abuse and denial-of-service attempts.Up to 30 minutes
__stripe_mid, __stripe_sidThird-party cookie, set only on billing pagesStripeFraud prevention on the payment form. Set only when a checkout or billing page is loaded, and required to take a payment safely.Session to 12 months
lr.cookie-consentlocalStorageClientTurnRemembers whether you accepted or rejected non-essential storage, so we do not ask again on every page. Stored in your browser and never transmitted to us.Until you change it or clear site data

4. Optional storage, set only after you accept

NameTypeSet byPurposeDuration
lr.attributionsessionStorageClientTurnRecords the advert, campaign or link that brought you to the site, plus a random identifier for this browsing session, so that a sign-up can be credited to the marketing that produced it. First touch wins.Until you close the browser tab
CTA analytics eventsServer-side event, no device storage of its ownClientTurnRecords which call-to-action buttons are pressed, together with the campaign values held in lr.attribution, so we can tell which pages and adverts work. Sent only after you accept.Aggregated; underlying events kept 12 months
ct_refFirst-party cookie (httpOnly)ClientTurnPartner referral (affiliate tracking). Records which partner's link brought you here, as a signed value naming the partner and link and the time of the click, so that partner can be credited if you sign up. The last partner link you clicked wins. Set only after you accept. If you do not accept, the same value is carried in the page address (?ct_ref=) until you sign up or leave, and nothing is stored on your device.Up to the partner's referral window, at most 90 days

Attribution values may also appear in the URL as utm_source, utm_medium, utm_campaign, gclid or fbclid parameters when you arrive from an advert. Those are part of the link you clicked rather than something we store on your device, and they are only carried into your sign-up if you have accepted.

5. What we deliberately do not do

  • We do not run third-party advertising, retargeting or social media pixels on this site — no Meta pixel, no Google Ads remarketing tag, no LinkedIn Insight tag.
  • We do not sell or share information about your browsing with data brokers or advertising networks.
  • We do not track you across other websites, and we set no cross-site identifier.
  • We do not use cookie walls: rejecting optional storage does not reduce your access to any part of the site or product.
  • We do not treat scrolling, closing the banner, or continued browsing as consent.

6. Controlling storage in your browser

Every major browser lets you block or delete cookies and site data from its privacy settings, and most offer a per-site control. Blocking strictly necessary storage will prevent you from signing in.

Most browsers also send a “Do Not Track” or Global Privacy Control signal if you enable it. We do not load any tracking that those signals would need to suppress, because nothing optional runs before you accept.

Guidance for the main browsers is published by their makers: Chrome, Safari, Firefox and Edge.

7. Changes and contact

If we add or remove anything stored on your device, we update the tables above in the same release and, where the change requires consent, ask for it again.

Questions about this policy, or a complaint: legal@clientturn.com. General support: support@clientturn.com. You may also complain to the Information Commissioner’s Office, which enforces PECR.

See also our Privacy Policy and our Terms of Service.