Last updated: 2026-05-19

Cookies Notice

We use cookies and similar storage technologies to make Vupiy work. We use as few as we can, we don't run advertising trackers, and we ask for your consent before setting anything that isn't strictly necessary.

This Cookies Notice is published in line with the Privacy and Electronic Communications Regulations 2003 (PECR), the UK GDPR, and the Data (Use and Access) Act 2025 (whose cookie provisions are in force from 5 February 2026). It is reviewed periodically. For questions, email [email protected].

Contents

  1. About this notice
  2. What cookies are
  3. The law (PECR + UK GDPR + DUAA)
  4. How to control cookies on Vupiy
  5. Categories we use
  6. Detailed list of cookies
  7. Third parties and international transfers
  8. What we never do
  9. Changes to this notice
  10. Contact

1. About this notice

Octillionsoft LIMITED (trading as Vupiy) uses cookies and similar storage technologies on the marketing website at vupiy.co.uk and inside the Vupiy product. This notice explains which cookies we set, why, how long they last, and how you can control them. It sits alongside our Privacy Policy, which covers the broader question of how we handle your personal data.

2. What cookies are

A cookie is a small text file that a website stores on your device when you visit it. Similar technologies include local storage, session storage, IndexedDB, and pixels — we use cookies as a shorthand for all of these. Cookies have two key properties:

  • Who sets them — "first-party" cookies are set by Vupiy directly; "third-party" cookies are set by another company (for example, Google Analytics) while you're on a Vupiy page.
  • How long they last — a "session" cookie disappears when you close the browser; a "persistent" cookie stays until it expires or you delete it.

3. The law (PECR + UK GDPR + DUAA)

In the UK, the law on cookies sits in three places:

  • PECR 2003 — the core rule: with limited exceptions, we need your consent before setting any cookie on your device.
  • UK GDPR — applies to any personal data the cookies generate.
  • DUAA 2025 — introduces a small number of narrow new exemptions to the consent rule, in force from 5 February 2026 (aggregate-statistics analytics with opt-out, functionality, security & fraud prevention, accessibility, emergency assistance). Marketing and advertising cookies still need consent — no exemption.

The UK Information Commissioner's Office (ICO) is the supervisory authority and finalised its Storage and Access Technologies guidance on 29 April 2026.

4. How to control cookies on Vupiy

You can control cookies in three ways:

  • Cookie banner — on your first visit (and after a material change), we show a banner with three equal-prominence buttons: Accept All, Reject All, Manage Preferences. Reject All disables every non-essential cookie in one click; we don't make rejecting harder than accepting.
  • Cookie Preferences link in the website footer (visible on every page) — opens the per-category controls at any time. Changing your selection takes effect immediately.
  • Your browser settings — you can block or delete cookies in any modern browser. For general guidance, see allaboutcookies.org. Note that blocking strictly-necessary cookies will break parts of Vupiy.
You will not see different content if you reject cookies. The Vupiy website and product work the same way with or without analytics; we do not operate a cookie wall.

5. Categories we use

We group cookies into four categories:

5.1 Strictly necessary

Required for the site or product to work — for example, to keep you logged in, protect against cross-site request forgery, balance load between servers, and remember your cookie choices. These are set automatically and cannot be switched off — without them Vupiy wouldn't function. No consent required under PECR Regulation 6(4).

5.2 Functional

Remember your language, theme, layout preferences. These are off by default and are set only when you choose them or give consent.

5.3 Analytics / performance

Help us understand how visitors use the website so we can improve it. We use these only with your consent. Where we use third-party analytics (Google Analytics 4), IP addresses are anonymised and we do not enable Google's advertising signals or cross-site profiling. We do not rely on the DUAA aggregate-analytics exemption at this time — analytics remain consent-gated by default.

5.4 Marketing / advertising

Track conversions on our marketing pages (for example, when a sign-up form is completed after clicking an ad). Off by default. Only set if you consent. We do not allow third-party advertising networks to set cookies inside the Vupiy product (app.vupiy.co.uk and similar) — marketing cookies are limited to the marketing website at vupiy.co.uk.

6. Detailed list of cookies

The list below covers the cookies we set as of the "Last updated" date at the top of this page. We keep it accurate; if you find something missing, please email [email protected].

Name Provider Category Purpose Type Duration
vupiy_session Vupiy (1st) Strict Maintains your authenticated session in the product HTTP-only, Secure, SameSite=Lax Session
vupiy_csrf Vupiy (1st) Strict Cross-site request forgery protection on forms HTTP-only, Secure Session
vupiy_cookie_pref Vupiy (1st) Strict Remembers your cookie consent choices Persistent 12 months
vupiy-theme Vupiy (1st, localStorage) Functional Remembers your light / dark mode choice Local storage Until cleared
vupiy_lang Vupiy (1st) Functional Remembers your interface language (EN / TR) Persistent 12 months
_ga Google Ireland Ltd (3rd) Analytics Google Analytics 4 client identifier (IP-anonymised) Persistent 13 months
_ga_<container> Google Ireland Ltd (3rd) Analytics Google Analytics 4 session state Persistent 13 months
intercom-id-*, intercom-session-* Intercom Inc. (3rd) Functional In-app chat session and chat history continuity Persistent up to 9 months
_fbp Meta Platforms Inc. (3rd) Marketing Conversion tracking on the marketing site (sign-up funnel) Persistent 90 days
__hssc, __hssrc, __hstc HubSpot Ireland Ltd (3rd) Marketing Marketing website analytics & lead attribution Persistent up to 13 months

Some cookies in the table above are only set if (a) you give consent for the relevant category and (b) we have actually deployed the tool. We update this list whenever we add or remove a tool; check the "Last updated" date for the current state.

7. Third parties and international transfers

Some of our cookie providers process data outside the United Kingdom (mainly in the United States). In every case, the transfer is covered by one of the safeguards described in our Privacy Policy, Section 6 — UK adequacy regulations, the UK Extension to the EU-US Data Privacy Framework (UK-US Data Bridge), or the UK International Data Transfer Agreement (IDTA) / UK Addendum to the EU SCCs. A list of our sub-processors is published at vupiy.co.uk/legal/subprocessors.

8. What we never do

  • We do not run advertising cookies inside the Vupiy product.
  • We do not allow third-party tracking companies to set cookies via our application — only on consented categories on the marketing website.
  • We do not operate an ad revenue model on either the marketing website or the product.
  • We do not condition access to Vupiy on accepting cookies — there is no cookie wall.
  • We do not pre-tick consent boxes.

9. Changes to this notice

We may update this notice. If we add a new cookie category or a new third party that processes personal data via cookies, we will re-display the banner so you can review and confirm your choices. Smaller changes (e.g., a new strictly-necessary cookie name, formatting fixes) take effect on publication. The "Last updated" date at the top is authoritative.

10. Contact

Questions about cookies: [email protected]. You also have the right to lodge a complaint with the UK Information Commissioner's Office at ico.org.uk/make-a-complaint/.