Cookie policy

1. THE SHORT VERSION This site sets two cookies of its own. Your browser holds one more while you are signed in. There is no analytics cookie, no advertising cookie, no social media cookie and no third-party cookie of any kind. Nothing on this site tracks you across other websites. There is no cookie banner because, on our reading, nothing here is used for advertising or cross-site tracking. Section 5 flags the one cookie where that reading needs to be checked by a lawyer rather than accepted. 2. THE COOKIES WE SET nella_booking_draft What it does: lets you leave the booking request form and come back to it. It holds a token that identifies your unfinished request; the server looks the request up by that token, which is what stops one person resuming another person's form. How long: 14 days. Where it is sent: only to pages under /book. Your browser's own scripts cannot read it, and it is not sent when another website posts to ours. nella_visitor What it does: an opaque random identifier so we can tell that the same browser has visited before, and connect a campaign link to a request that arrives later. It is not built from your IP address, your device or your browser characteristics, so it is not a fingerprint, and it holds nothing about you. How long: 180 days. Where it is sent: the whole site. Your browser's own scripts cannot read it either. 3. THE COOKIE YOUR SIGN-IN NEEDS If you sign in, our authentication provider (Supabase) sets a session cookie whose name begins sb-. It is what keeps you signed in between pages. Signing out clears it. Without it there is no way to be signed in at all. 4. WHAT WE DO NOT SET No Google Analytics, no advertising or remarketing tag, no social media pixel, no session-recording script. Our error monitor is configured not to send cookies and not to record sessions, and it currently has no reporting address set, so it sends nothing at all. 5. THE OPEN QUESTION nella_booking_draft and the sign-in cookie are necessary for something you asked for: resuming your own form, and staying signed in. nella_visitor is not. It exists so we can tell which campaign brought someone to the site. It is first-party and opaque, but its purpose is marketing rather than making the site work. [NELLA TO CONFIRM: whether Ghanaian law, or the EU or UK rules if they apply to NELLA, require consent before nella_visitor is set — and therefore whether this site needs a cookie banner and a way to decline. The site sets it today without asking. This draft flags the question rather than answering it, because answering it wrongly in either direction is a real problem: a banner nobody needs annoys every visitor, and a missing one where it is required is a breach.] 6. TURNING THEM OFF You can block or delete cookies in your browser settings. If you block ours, the booking form will not remember an unfinished request and you will not be able to stay signed in. Nothing else on the site depends on them. 7. CHANGES If we add a cookie, this document gets a new version before the cookie is added, not afterwards.