Draft, not legal advice. Product-specific wording to merge into the FSB member templates before launch (see README.md). Last updated: 20 October 2026 (draft)

PaidStraight cookie notice

A cookie is a small file a website stores in your browser. This notice lists the cookies PaidStraight uses and why.

The short version

We only use cookies that are needed to make the site work and keep you signed in safely. We do not use analytics, advertising or tracking cookies. That is why you do not see a cookie banner.

The billing page loads Paddle, our payment reseller. Paddle sets its own cookies there.

Cookies we set

Cookie	What it does	How long
.AspNetCore.Identity.Application	Keeps you signed in after you log in	Until you sign out, or [14 days] if you tick "remember me" [Developer to confirm]
.AspNetCore.Antiforgery.<id>	Stops other websites submitting forms in your name (security)	Until you close your browser
.AspNetCore.Session or .AspNetCore.Mvc.CookieTempData	Carries a message or form state from one page to the next, for example "Invoice saved"	Until you close your browser
.AspNetCore.External [only if Google sign-in is enabled]	Holds your place for a few minutes while you sign in with Google	A few minutes

[Developer to confirm: the exact cookie names and lifetimes against the production build. Add any other cookie the app sets, such as a two-factor "remember this browser" cookie.]

These cookies contain no advertising IDs. They are not shared with anyone else.

Paddle on the billing page

When you open the billing page or checkout, Paddle's script (Paddle.js) loads. Paddle uses its own cookies to process your payment, prevent fraud and remember your checkout. Paddle is responsible for those cookies. See Paddle's own cookie and privacy information at paddle.com/legal.

Paddle.js only loads on the billing page, not on the rest of the site.

[OWNER TO CONFIRM: whether Paddle's cookies are all strictly necessary for checkout, and whether Paddle expects the seller to show any notice or consent prompt before Paddle.js loads.]

Why there is no cookie banner

The Privacy and Electronic Communications Regulations 2003 (PECR) say a website must get consent before storing information on your device, unless an exception applies. One exception is where the storage is strictly necessary to provide an online service you asked for. Signing you in, keeping your session secure and protecting forms are examples of this. Since 5 February 2026, these exceptions are set out in Schedule A1 to PECR.

All the cookies we set fall within that exception, so we do not need to ask for consent. We still tell you about them here.

[Solicitor to confirm: (1) that every cookie listed above is "strictly necessary" under PECR Schedule A1 para 4; (2) that loading Paddle.js only on the billing page, at the point the user chooses to pay, is also strictly necessary; (3) whether any notice is needed on the billing page before Paddle.js loads.]

Visitor counts on the public website

If switched on, the public pages (not the app you sign in to) use Umami to count visits. Umami does not set cookies, does not store IP addresses, and respects "Do Not Track". It needs no consent banner. [Solicitor to confirm: PECR position for cookie-free analytics that read the user agent.]

If we add analytics later

We do not use analytics today. If we add them, we will update this notice first. The law now allows some analytics cookies without consent, as long as we explain them clearly and give you a simple, free way to object. Any other non-essential cookie would need your consent first, and we would add a choice to the site.

Controlling cookies

You can block or delete cookies in your browser settings. If you block our cookies, you will not be able to sign in.

Contact

[OPERATOR LEGAL NAME], [CONTACT EMAIL]. See also our privacy policy (privacy.md).