This Cookie Policy explains how Gradio Safety LTD uses cookies, localStorage, and similar technologies on our website. It covers what cookies are, which specific cookies we set, why we set them, how long they last, how our cookie banner works, and how you can control or delete cookies at any time. This policy is written to comply with the Privacy and Electronic Communications Regulations 2003 (PECR), the UK GDPR, and the EU ePrivacy Directive.
1. What are cookies and similar technologies2. Legal framework — PECR, UK GDPR, ePrivacy3. Our cookie banner — how consent works4. Cookie categories overview5. Strictly necessary cookies6. Analytics and performance cookies7. Functional and preference cookies8. Payment and security cookies9. Security cookies10. Cookies we do NOT use11. localStorage and session storage12. Third-party cookies and sub-processors13. How to manage cookies in your browser14. Do Not Track (DNT) signals15. Cookies and children16. Changes to this policy17. Contact us and complaints
Cookies are small text files (typically a few hundred bytes) that a website stores on your device when you visit it. They allow the website to recognise your device and remember information about your visit, such as your preferences, login state, or items in a shopping cart. Cookies are widely used across the web and are not inherently harmful — they are a standard part of how modern websites function.
In addition to cookies, we also use the following similar technologies:
Throughout this policy, "cookies" refers to all of these technologies unless we specify otherwise.
Our use of cookies is governed by the following legal framework:
When you first visit our website, a cookie banner appears at the bottom of the screen. The banner provides two options:
Your choice is stored in your browser's localStorage under the key gradio-cookie-consent. The stored value records your decision and the date/time it was made. On subsequent visits, the banner does not appear because we read your stored preference.
You can withdraw your consent at any time by:
When you withdraw consent, any non-essential cookies that were set are deleted from your browser. Strictly necessary cookies remain because they are required for the website to function.
Your consent is valid for 12 months from the date it was given. After 12 months, the cookie banner will reappear and you will be asked to renew your consent. This ensures your consent remains fresh and aligned with any changes to our cookie usage.
We classify all cookies on our website into five categories:
| Category | Consent required? | Purpose | Can be blocked? |
|---|---|---|---|
| Strictly necessary | No | Core website functionality and security | No — website will not work properly |
| Analytics & performance | Yes | Understanding how visitors use the site | Yes |
| Functional & preference | Yes | Remembering your settings and choices | Yes — some features may not work |
| Payment and checkout security | No (strictly necessary for checkout) | Processing payments securely | No — payment will not work |
| Security | No | Protecting against fraud and abuse | No — security will be compromised |
We do not use marketing, advertising, or tracking cookies. See Section 10 for the full list of cookies we do not use.
These cookies are essential for the website to function. They cannot be disabled because they enable core features such as page navigation, security, and access to secure areas. Under PECR Regulation 6(4)(b), these cookies do not require consent.
| Cookie / storage key | Type | Purpose | Duration | Set by |
|---|---|---|---|---|
| gradio-cookie-consent | localStorage | Stores your cookie consent preference (accept/decline) and the date it was given | 12 months | Gradio Safety LTD (first-party) |
| __Host-next-auth.csrf-token | Cookie | Cross-site request forgery (CSRF) protection for form submissions | Session | Next.js (first-party) |
| __Secure-next-auth.callback-url | Cookie | Remembers the URL to redirect to after authentication | Session | Next.js (first-party) |
| __Secure-next-auth.session-token | Cookie | Authentication session token — only set if you log in (not currently used) | 30 days | Next.js (first-party) |
These cookies help us understand how visitors interact with our website — which pages are most popular, how long visitors stay, and where they come from. This information helps us improve the website. Analytics cookies are only set if you click "Accept all" on the cookie banner.
| Cookie | Provider | Purpose | Duration | Type |
|---|---|---|---|---|
| _ga | Google Analytics (via Google) | Distinguishes unique users. Stores a random client ID per user. | 2 years | First-party (set by our domain, data sent to Google) |
| _ga_<container-id> | Google Analytics 4 | Maintains session state for GA4 event tracking | 2 years | First-party |
| _gid | Google Analytics (if enabled) | Distinguishes users for 24-hour analytics windows | 24 hours | First-party |
We use Google Analytics 4 (GA4) with IP anonymisation enabled. Google processes the data as a sub-processor on our behalf. We have configured GA4 to not share data with Google for advertising purposes. See our Privacy Policy for more information about Google as a sub-processor.
If you select "Essential only" on the cookie banner, these cookies are not set and Google Analytics does not track your visit.
These cookies remember choices you make to improve your experience. They are only set if you click "Accept all" on the cookie banner.
| Cookie / storage key | Type | Purpose | Duration | Set by |
|---|---|---|---|---|
| gradio-theme | localStorage | Remembers your theme preference (dark/light) if we add a theme toggle in the future | 12 months | Gradio Safety LTD (first-party) |
| gradio-language | localStorage | Remembers your language preference if multi-language support is added | 12 months | Gradio Safety LTD (first-party) |
Note: These cookies are defined for future use. If they are not actively set on the current version of the website, they will not appear in your browser.
When you make a payment through our website, authorized payment gateway partners set cookies that are strictly necessary for the payment process and fraud prevention to function. These cookies are classified as strictly necessary because without them, secure checkout and 3D Secure verification cannot operate. They are only set when you initiate a payment.
| Cookie category | Purpose | Duration | Classification |
|---|---|---|---|
| Fraud Prevention & Device Risk | Identifies devices to screen against fraudulent card testing and unauthorized transactions | Session to 1 year | Strictly necessary |
| Payment Session Token | Maintains checkout state and tokenises payment data securely | 30 minutes / Session | Strictly necessary |
| 3D Secure / SCA Token | Enables multi-factor authentication with the card-issuing bank under PSD2 regulations | Session | Strictly necessary |
We use cookies and similar technologies to protect our website and our users from fraud, abuse, and security threats. These are strictly necessary and do not require consent.
| Cookie / technology | Provider | Purpose | Duration |
|---|---|---|---|
| __cf_bm | Cloudflare | Bot management — distinguishes between legitimate visitors and bots. Protects against DDoS attacks and automated abuse. | 30 minutes |
| cf_clearance | Cloudflare | Clearance cookie — set after a Cloudflare challenge (e.g., CAPTCHA) is passed. Allows the user to continue browsing. | 1 year |
| _cfuvid | Cloudflare | Unique visitor ID for Cloudflare security analytics | Session |
Cloudflare acts as a sub-processor. See our Privacy Policy for the full sub-processor list and data processing agreement details.
We are committed to a minimal, privacy-respecting cookie approach. We explicitly do not use the following types of cookies or technologies:
In addition to HTTP cookies, we use the Web Storage API (localStorage and sessionStorage) for specific purposes. These are browser-based storage mechanisms that are governed by the same consent requirements as cookies under PECR.
| Storage key | Type | Purpose | Consent required? | Cleared on logout? |
|---|---|---|---|---|
| gradio-cookie-consent | localStorage | Stores your cookie consent decision and timestamp | No (strictly necessary for banner function) | No — persists for 12 months |
| gradio-theme | localStorage | Theme preference (future use) | Yes (functional) | No |
| gradio-language | localStorage | Language preference (future use) | Yes (functional) | No |
You can view and clear localStorage in your browser's developer tools (Application tab → Local Storage). Clearing localStorage does not delete HTTP cookies — you need to do that separately through your browser's cookie settings.
The following third parties set cookies on our website. Each third party has its own privacy and cookie policies that govern how they use the data collected through their cookies.
| Third party | Cookies set | Purpose | Privacy policy | Role |
|---|---|---|---|---|
| Cloudflare | __cf_bm, cf_clearance, _cfuvid | CDN, DDoS protection, bot management | cloudflare.com/privacypolicy | Sub-processor |
| Google (Analytics) | _ga, _ga_*, _gid | Website analytics (only with consent) | policies.google.com/privacy | Sub-processor |
| Payment Gateways | Session & anti-fraud verification tokens | Payment processing and fraud prevention | Authorized merchant gateways | Independent data controller |
| Vercel | Server-side only (no client cookies) | Website hosting and deployment | vercel.com/legal/privacy-policy | Sub-processor |
For the full list of sub-processors and their roles, see Section 7 of our Privacy Policy.
You can control, block, or delete cookies through your browser settings. Each browser has different instructions — below are links to the official help pages for the most common browsers:
| Browser | How to manage cookies |
|---|---|
| Google Chrome | Settings → Privacy and security → Cookies and other site data. Official guide |
| Mozilla Firefox | Settings → Privacy & Security → Cookies and Site Data. Official guide |
| Safari (macOS) | Safari → Settings → Privacy → Manage Website Data. Official guide |
| Microsoft Edge | Settings → Cookies and site permissions → Cookies and site data. Official guide |
| Brave | Settings → Shields → Cookies. Brave blocks third-party cookies by default. Official guide |
| Opera | Settings → Privacy & security → Cookies and other site data. Official guide |
| Safari (iOS) | Settings app → Safari → Block All Cookies (note: this blocks all cookies, including strictly necessary ones) |
| Chrome (Android) | Chrome app → Settings → Site settings → Cookies |
If you block strictly necessary cookies, some features of our website may not work — for example, the cookie banner may reappear on every page load, or the payment checkout may fail. If you block analytics cookies, the website will continue to function normally; we simply will not collect analytics data about your visit.
When you browse in incognito or private mode, your browser does not persist cookies or localStorage after you close the window. This means: the cookie banner will appear on every visit, your theme/language preferences will not be remembered, and payment cookies will be set only for the duration of the session.
Do Not Track (DNT) is a browser setting that sends a signal to websites indicating that you do not want to be tracked. The DNT standard was never finalised, and there is no legal requirement under UK or EU law to respond to DNT signals.
Our approach to DNT:
Our website is directed at businesses and professionals, not at children. We do not knowingly collect personal data from children under 16. Our cookies do not collect age-related data and we do not use cookies to build profiles of children's interests or behaviour. If you believe a child has provided personal data to us, please contact us and we will delete it. See Section 13 of our Privacy Policy for our children's privacy policy.
We may update this Cookie Policy when we add, remove, or change cookies on our website, or when there are changes to applicable laws. When we make material changes, we will:
We recommend reviewing this policy periodically to stay informed about how we use cookies.
For questions about this Cookie Policy, to request information about what cookies are set on your device, or to make a complaint about our cookie practices:
If you are not satisfied with our response, you have the right to complain to the Information Commissioner's Office (ICO) — the UK data protection regulator. The ICO can be contacted at https://ico.org.uk or by phone at 0303 123 1113. For EU residents, you may complain to your local Data Protection Authority. A list of EU DPAs is available at edpb.europa.eu.
v2.0 2026-08-28 Full rewrite — added PECR/ePrivacy framework, cookie banner mechanics, 5 cookie categories with per-cookie tables, payment cookies, Cloudflare security cookies, localStorage table, DNT, browser controls, cookies we do NOT usev1.0 2026-08-27 Initial Cookie Policy