Cookie Policy

1. What cookies are ¶

Cookies are small text files a website can store in your browser. They can remember a preference (like your cookie choice), keep a page working, or — when you allow it — help measure how a site is used. Similar technologies such as local storage are covered by this policy too, and we treat them exactly like cookies here.

2. Our approach: nothing by default ¶

We follow a consent-first model (Consent Mode v2): every non-essential category starts in a denied state. Until you give consent through our cookie banner, no analytics or marketing script is loaded at all.

In practice we go a step further: right now this site loads no third-party trackers whatsoever, not even after consent. Our fonts are self-hosted, so nothing is pulled from external content networks on page load, unless you have previously chosen to load our calendar from Google (see "Third-party services" below). And the measurement we do run was deliberately built so that it needs no cookie.

3. Cookies after login ¶

Regular visitors get no cookie from this website itself. The one exception is for people who log in: the site then sets one strictly necessary session cookie, so you stay logged in while you move between pages. We do not ask for your consent here, because logging in does not work without it. The cookie holds only a code without any data about you, and that code itself is stored nowhere on our server: we keep only an irreversible derivative of it. Scripts on the page cannot read it. It only travels over an encrypted connection and only to this website. We never use it to track you or to measure anything.

On the admin area, where only we log in, one more strictly necessary cookie is added: the device token. It is a security measure. It remembers that this device has logged in before with a password and a code, so that someone who knows our login address cannot lock us out with wrong attempts. It holds no name, address or account code, only a random code with a check value, and nothing of it is stored on our server. Scripts cannot read this cookie either, and it only travels encrypted and only to this website. Regular visitors and clients of the portal never get it.

What we keep about your account is set out in the privacy policy under "The client portal". These are the cookies, named as your browser shows them:

• __Host-dc_portaal: for clients who log in to the client portal. It expires 7 days after you last used the portal, and at the latest 30 days after you logged in; logging out removes it at once.
• __Host-dc_beheer: only for us, when we log in to the admin area of this website. It expires 7 days after we last used the admin area, and at the latest 30 days after we logged in. Logging out removes it from the browser at once and also invalidates it on our server; a restart of our server does not end it.
• __Host-dc_beheer_apparaat: only for us, after a successful login to the admin area. It remembers for 1 year that this device has logged in before with a password and a code. Simply logging out leaves it in place. "Overal uitloggen" (log out everywhere) invalidates it at once, and a new authenticator app or a new password invalidates it on every other device.

4. What does get stored in your browser ¶

We use the items below in your own browser’s storage, plus an offline copy of the site itself. Every item is listed by name, exactly as your browser calls it. The first four contain no personal data, are never sent to our server, and do not track you:

• dcraft_consent — stores your choice in the cookie banner, so we do not have to ask again on every visit. Strictly necessary; stays until you clear it.
• dcraft_theme — remembers whether you want the site in light or dark mode. Strictly necessary for that preference; stays until you clear it.
• dcraft:rex-shortlist:v1 — remembers which service areas you added to your selection on our service areas overview page. It holds only the names of those service areas, as they appear in the addresses of our pages. Clearing the selection empties it; it is only gone completely once you clear your site data.
• Small session values (session storage) — dc_booking_opened remembers that you opened the calendar during this visit; dcraft_tools_optin that you chose “No thanks” when an AI tool asked whether we may contact you; dcraft_tools_vote how you answered the “Was this useful?” question under an AI tool, a sales page or a blog article; dc_install_dismissed and dc_sw_update_dismissed that you dismissed the invitation to install the site or the notice about a new version; dcraft-motion-paused that you paused the moving parts of the site; and dc_sw_last_check when your browser last checked, during this visit, whether a new version of the site is available. They disappear as soon as you close your browser session.
• dcraft_booking_consent — remembers that you chose yourself to load our calendar from Google in the booking box, so that it loads straight away on a later visit, without a new click. Your browser then contacts Google directly; see "Third-party services" below. It holds only that choice and is never sent to our server. It stays until you click "Forget my choice" next to the calendar or clear your site data.
• dc_entry (session storage) — remembers, for the duration of your visit, which page of this site you arrived on, so that a form you submit later in that same visit can tell us where your journey started. It contains only a page path (such as /sales/...), never a full URL, and it disappears as soon as you close your browser session or clear your site data. The privacy policy describes under "The contact form" what we do with it.
• dc-cf-draft:v1 and dc-fb-draft:v1 (session storage) — as you type, they remember what you fill in on the contact form or the feedback form, so your input survives a page reload or a language switch. They stay in your own browser, are never sent anywhere, and disappear once you submit the form, close the window, or clear the saved input yourself. Your consent tick is never stored; the privacy policy describes under "The contact form" and "What data we collect" what we do with the input.
• Offline cache (service worker) — since August 2026 your browser keeps a copy of this site’s pages, stylesheets, scripts, fonts and images so the site still works when your connection drops. That copy lives only on your device, is never sent to us, and contains no identifier. It is not a cookie, but we list it here because it is storage on your device all the same. Strictly necessary for the offline feature; it refreshes on every visit and disappears when you clear site data.

You can delete all of it at any time through your browser’s privacy or security settings ("clear site data"). The site keeps working afterward; we will simply ask for your choice again and the offline copy is rebuilt.

5. Cookieless measurement, run in-house ¶

We want to know whether this site works: which pages are read, whether people call, message, try a tool, or open the calendar to book a Sales Diagnose. That measurement runs entirely on our own server environment. No external analytics vendor is involved — no Google Analytics, no Plausible, no one else.

No cookie is set for it. We build no profile and do not recognize you between visits: we count events, not people. For each event we record which event it was, on which page it happened, and at what time. We do not keep your IP address; we do keep a short, irreversible code derived from it and from your browser, using a secret that exists only in the working memory of our server and changes on every restart. That code also changes every day and cannot be reversed — it exists only so that visits within a single day are not counted twice.

For a page view we additionally store, in coarse steps, whether at least three quarters of the page came into view and how long the page stayed open (no detailed scroll profile), plus what kind of page it was. To see roughly where visitors come from, every event gets a category from a fixed list: direct, search engine, social media, AI assistant, other site, or own campaign tag. The referrer itself and the value of a campaign tag are never stored — only the category. Whether you then actually make an appointment in the calendar is not counted by this measurement: that calendar runs at Google, and a booked appointment shows up only in our own calendar, not in these counts. These are the events we count:

• a page view, with the two coarse measures above;
• a click on a phone number (call click);
• a click on a WhatsApp button;
• use of one of the free AI tools — only that a tool was used, never the content of what you entered;
• a click on an email link (mail click);
• a click on the button that loads the calendar inside our booking box;
• opening the feedback widget;
• a click on a link that opens our calendar at Google;
• contact details left behind.

Retention: individual events are kept for a maximum of twelve (12) months; after that we delete them and only an aggregated daily count (totals without visitor data) remains.

6. No retargeting, no pixels ¶

This website carries no advertising or retargeting pixel whatsoever. Concretely: no LinkedIn Insight Tag, no Meta Pixel, no Google Ads or Floodlight tag, no TikTok pixel, and no call-tracking numbers.

So we do not follow you across other websites, we build no advertising audiences based on your visit, and we neither sell nor share data with ad networks or data brokers.

7. Cookie categories in the banner ¶

Our cookie banner distinguishes three categories, and you decide on them in one go: accept or reject. We are upfront about the fact that two of the three are currently simply empty — whichever you choose, no additional script is loaded today.

• Functional (strictly necessary) — always active; no consent required. This covers the storage items above, the cookies after login, page navigation, and basic security. They do not track you and cannot be switched off; the remembered calendar choice only exists because of your own click, and one button clears it.
• Analytics — off until you consent. Right now this category is empty: our measurement is cookieless and runs in-house, so there is no analytics script and no analytics cookie to allow. If we ever do deploy such a service, it will only run after your consent, and we will update this policy first.
• Marketing — off until you consent. This category is currently empty too: no advertising or remarketing scripts run here, and that is a deliberate choice.

8. Third-party services ¶

A couple of services we link to may set their own cookies — but only after you choose to use them yourself.

• Scheduling (Google Calendar) — our calendar for a free Sales Diagnose runs at Google. If you open the booking link, you are taken to a Google booking page; if you click the "Book your free Sales Diagnose" button in our booking box, Google loads the calendar inside our page. Either way Google may set its own cookies under its own privacy and cookie policies. Until you choose to open the calendar yourself, your browser makes no contact with Google. We remember your choice for the booking box in your browser (dcraft_booking_consent), so the calendar loads straight away on a later visit; the "Forget my choice" button next to the calendar withdraws it. You can clear cookies Google has already set in your browser settings.
• WhatsApp — tapping our WhatsApp button opens WhatsApp in a new tab or in the app. From that point WhatsApp's own cookie and privacy terms apply — we set nothing on their behalf.
• The free AI tools run on our own server. Your input goes to our AI provider to generate the result, but that provider sets no cookie in your browser: your browser only ever talks to our server.

9. How to change your choice ¶

You can revisit your decision at any time. Your choice is stored in your own browser: clear the stored site data for this site through your browser settings ("clear cookies and site data"). On your next visit the banner appears again and you choose again — accept or reject.

You can also manage or delete the stored items directly in your browser. In most browsers you clear them from the privacy or security section of the settings, under "cookies and site data".

The "Forget my choice" button next to the calendar withdraws your choice to have our calendar load from Google straight away. After that the calendar only loads again once you click it yourself.

10. Language of this policy ¶

This cookie policy was drafted in Dutch and translated into English. In the event of any difference in interpretation between the two versions, the Dutch text is the only binding one.

11. Questions about cookies? ¶

If anything here is unclear, or you want to know exactly what is stored in your browser, reach out — we are happy to explain. How we handle personal data is set out in our

Privacy Policy

.

• Phone: +31 6 25538050
• WhatsApp: +31 6 25538050
• Email: info@dcraftofsales.com