Our approach
By default, this website only uses the small number of strictly necessary items listed below, needed to make the site and its admin tools work. Nothing beyond those runs until you actively give analytics consent through the cookie banner, and withdrawing consent stops analytics immediately.
Strictly necessary storage (always on)
Payload admin session cookie
Named `payload-token`, and set for two hours. Keeps a signed-in staff member logged in to the content-management admin area. It is only ever set for staff logging in to manage the site; ordinary visitors browsing the public pages never receive this cookie.
Consent-choice cookie
Named `milaco_consent`, and kept for twelve months. It records only which of the two answers you gave — accepted, or essential only — so we do not ask again on every visit. It contains no identifier of any kind. Withdrawing your consent deletes it.
Contact-form record
If you consent to analytics and then send us an enquiry, your browser records the reference of that enquiry in its own local storage, under `milaco_conversions`. It stays on your device, is never sent to us or to anyone else, and exists for one reason: so that reloading the confirmation page does not count the same enquiry twice. At most fifty references are kept, and the oldest is dropped as newer ones arrive.
Theme preference
Named `milaco-theme`. Remembers your light or dark display preference. It is stored in your browser's local storage rather than a cookie, stays on your device, and is never sent to us.
Those four — `payload-token`, `milaco_consent`, `milaco_conversions` and `milaco-theme` — are everything this website stores in your browser. Nothing else is set, by us or by anything we load.
None of the above are used for advertising or for tracking you across other websites.
Analytics — only after you consent
If you actively consent via the cookie banner, we load Umami, a self-hosted, separately operated analytics tool. Before you consent, and after you withdraw consent, no Umami script loads and no analytics request is sent — not even in the background.
Umami does not use cookies; it measures visits without setting a tracking cookie on your device, and its script stores nothing in your browser at all. Once active, it records:
- Pages viewed and the general path you took through the site.
- The source or page that referred you, and any approved marketing campaign (UTM) parameters. The approved parameters are exactly `utm_source`, `utm_medium`, `utm_campaign`, `utm_term` and `utm_content`; every other part of a web address you arrive on is removed in your browser before anything is sent.
- One event when you successfully submit the contact form, so we can see that our contact page is working. No message content is attached to that event.
Visitor totals are reported to us as estimated unique visitors — an aggregate approximation, not a record of identified individuals. Staging and production analytics data are kept in separate, isolated environments and are never mixed.
Managing your choice
You can change your analytics choice at any time, whatever you answered the first time.
The control is on this page, in the section headed Analytics choice, and every page of the site links to it: the link labelled Analytics choice in the footer, beside the policy links, goes straight to it. It shows what your current answer is and offers the other one — Accept analytics, or Withdraw analytics consent.
Withdrawing takes effect immediately. The consent cookie is deleted, the analytics script is removed from the page, and the page reloads without it; from that moment nothing is sent to the analytics server unless you accept again.
How this relates to your personal data
Our Privacy Policy explains what personal data the contact form collects, how long we keep it, who we share it with, and how to exercise your rights.
Changes to this policy
We may update this policy as our use of cookies and similar storage changes. The current version and its date will always be shown on this page.