These documents are being prepared for launch. Our Stairwell Ltd has not yet been incorporated. Customer subscriptions will open only after incorporation and completion of the supplier details and launch terms. This draft does not offer a subscription from an existing limited company.
We do not currently use advertising cookies, optional audience analytics, browser fingerprinting for analytics, or session replay. On the basis of the configuration described below, we do not display a general cookie-consent banner. Technology is limited to providing a requested feature, authentication, security, fraud prevention or fault prevention.
1. What this notice covers
This notice covers cookies, local and session storage, scripts, tags, pixels and other technology that stores information on, or accesses information from, a phone, computer or other device. It should be read with our Privacy Notice, which explains how we use personal information more generally.
2. Technology currently used
| Service or technology | Where and why it is used | Normal duration |
|---|---|---|
| Cloudflare edge security | Security technology may examine request, network and browser signals to protect the websites and application from malicious traffic and technical faults. Cloudflare may set a security or clearance cookie when a browser challenge is required. | For the session or the security period configured by Cloudflare; any challenge clearance is time-limited. |
| Cloudflare Turnstile | The contact, invitation and other protected forms load Cloudflare's challenge script to distinguish legitimate requests from automated misuse. The standard widget returns a single-use verification token; it does not issue a clearance cookie unless pre-clearance is separately enabled. | The verification token expires after five minutes and can be used once. Any optional clearance cookie follows the Cloudflare security setting. |
| Keycloak authentication | The authentication service uses session and identity cookies to sign users in, maintain the requested login session, complete multi-factor or identity-provider flows, and protect authentication requests. Application access tokens are held in memory by the browser application rather than deliberately persisted in local storage. | Session cookies end with the browser session; other authentication cookies expire according to the configured login and account-security policy. |
| Break-glass administration session storage | For authorised administrators only, the application stores the identifier, association and expiry of an active emergency-access session in browser session storage. This keeps the access warning and audit context attached while the administrator moves between pages. | Until the tab is closed, the access session expires, or the administrator ends it, whichever is first. |
| Requested third-party features | If an authorised user opens an enabled Google Maps or address-completion feature, the provider receives the browser request and may use device storage needed to supply and secure that feature. Calendar and payment connections open the chosen provider's service, where that provider's own notice applies. | According to the selected provider's security and service settings. The feature is not loaded for advertising by Our Stairwell. |
3. Why consent is not currently requested
We treat the technology above as strictly necessary for a service or feature the user requests, or for the security, authentication, fraud-prevention or fault-prevention purposes described. We do not rely on the consent-free statistical-purpose exception for the current product. If we introduce statistical analytics under that exception, we will first provide clear information and a simple, free way to object. If a new use does not meet an exception, it will remain off until the user gives valid consent.
4. Browser controls and questions
A browser can block or delete cookies and site data, but blocking necessary technology may prevent sign-in, protected forms or requested features from working. Questions or concerns can be sent to [email protected].