Cookie Policy
Last updated: 9 November 2026
1. What this policy covers
This policy lists every cookie, and every similar item stored in your browser, that spotlit.uk uses. Spotlit is run by Sunrise Digital Solutions Ltd; our Privacy policy explains how we use personal data.
A cookie is a small file a website stores in your browser. Local storage and session storage do the same job in a different place, and the law treats them the same way, so they are listed here too.
2. Your choice
When you first visit, a banner asks whether you allow analytics and marketing cookies. Accept and Reject are the same size, side by side; Choose lets you allow one group and not the other. No box is ticked for you.
Until you choose, and if you reject, none of the analytics or marketing scripts below is loaded at all. Essential cookies are always on, because the site cannot work without them.
We remember your choice for 6 months in the spotlit_consent cookie. To change it at any time, use "Cookie settings" at the foot of any page, or the button below. If you take back a choice, we delete the cookies that group set on spotlit.uk and reload the page.
3. Scripts from other companies
| Script | Provider | Group | What it does |
|---|---|---|---|
| Service worker clean-up | Spotlit | Essential (always on) | Removes an old offline cache left by the previous version of the site. Stores nothing. |
| Google tag (gtag.js) | Analytics (only if you accept) | Loads Google Analytics, and Google Ads when you allow marketing. Starts with Google Consent Mode set to denied for everything. | |
| Microsoft Clarity | Microsoft | Analytics (only if you accept) | Heatmaps and session recordings of how pages are used. Never on /admin, the business dashboards, or the loyalty card pages. |
Google Analytics and Google Ads use Google Consent Mode: they start with every signal set to denied, and are told your choice when you make it. Google Analytics is switched on only with Analytics, and Google Ads only with Marketing. Microsoft Clarity is told your choice the same way, and never runs on our staff pages, the business dashboards or the loyalty card pages, whatever you choose.
4. Essential cookies
Keep you signed in, remember your cookie choice and let you pay. The site does not work without them, so they are always on.
| Name | Provider | Where it is kept | Purpose | How long |
|---|---|---|---|---|
| spotlit_consent | Spotlit | Cookie | Remembers whether you accepted or rejected analytics and marketing cookies. | 6 months |
| token, refreshToken, user | Spotlit | Local storage | Keep you signed in to your Spotlit account. | Until you sign out |
| pendingBusinessSetup | Spotlit | Local storage | Holds the business details you typed while you finish registering. | Until registration finishes |
| actAsBusinessId, actAsBusinessName | Spotlit | Session storage | Spotlit staff only: which business a staff member is helping. | Until the tab is closed |
| spotlit:cards, spotlit:lastCard | Spotlit | Local storage | Your loyalty cards on this device, so you can open them again. | Until you delete the card |
| spotlit:joinView:<shop> | Spotlit | Session storage | Counts a loyalty join page as seen once per visit, not on every refresh. | Until the tab is closed |
| Stripe Checkout cookies | Stripe | Cookie, on Stripe's own checkout pages | Payment and fraud prevention when you pay. Set by Stripe on checkout.stripe.com, not on spotlit.uk, under Stripe's own cookie policy. | Set by Stripe |
5. Analytics cookies
Google Analytics and Microsoft Clarity show us which pages people use and where they get stuck. Clarity records how the page is used (clicks, scrolls, mouse movement); it never runs on our staff or business dashboards. They are off until you say yes.
| Name | Provider | Where it is kept | Purpose | How long |
|---|---|---|---|---|
| _ga | Google Analytics | Cookie | Tells visits apart, so we can count visitors rather than page loads. | 2 years |
| _ga_<id> | Google Analytics | Cookie | Keeps the state of your current visit for Google Analytics. | 2 years |
| _clck | Microsoft Clarity | Cookie | Keeps the same Clarity user ID across pages of this site. | 1 year |
| _clsk | Microsoft Clarity | Cookie | Joins several page views into one Clarity session recording. | 1 day |
| CLID, MUID | Microsoft Clarity | Cookie, on clarity.ms | Set by Microsoft on its own domain to recognise the same browser across sites that use Clarity. | 1 year |
6. Marketing cookies
Google Ads tells us when an ad led to an order, so we only pay for ads that work. They are off until you say yes.
| Name | Provider | Where it is kept | Purpose | How long |
|---|---|---|---|---|
| _gcl_au | Google Ads | Cookie | Links an order to the Google ad that brought you here. | 90 days |
| Google advertising cookies | Cookie, on Google's own domains | Set by Google to measure ad clicks and conversions, under Google's own policy. | Set by Google | |
| conv_fired_<order> | Spotlit | Session storage | Stops one order being reported to Google twice if the thank-you page is reloaded. | Until the tab is closed |
7. Contact
Questions about cookies: support@spotlit.uk. About your personal data: our director, at info@sunrise-sds.co.uk.