Cookie Policy

This Cookie Policy explains how Tones & Tells (“we”, “us”, “our”) uses cookies and similar tracking technologies when you visit or use tonesandtells.com (the “Platform”), and explains the choices available to you in relation to such technologies. This Cookie Policy has been prepared having regard to the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications (EC Directive) Regulations 2003 (“PECR”), the Electronic Commerce (EC Directive) Regulations 2002, and the Information Commissioner’s Office (“ICO”) guidance on the use of cookies and similar technologies.

This Cookie Policy should be read together with our Privacy Policy, which explains how we collect, use and protect personal data more generally. Where a cookie or similar technology results in the processing of personal data, that processing is also governed by our Privacy Policy.

This Cookie Policy applies to you whenever you access or use the Platform, regardless of the device used.

Cookies are small text files placed on your device when you visit a website. They are widely used to make websites function, to improve user experience, and to provide information to website operators.

References in this Cookie Policy to “cookies” also include other similar technologies, such as local storage, session storage, pixels and tags, which operate in a comparable way and which may be used to recognise your device or store information about your visit.

Cookies may be “session cookies” (deleted when you close your browser) or “persistent cookies” (which remain on your device for a set period, or until manually deleted). Cookies may also be “first-party” (set by us) or “third-party” (set by a third party whose service is integrated into the Platform).

We use, or anticipate using, the following categories of cookies and similar technologies. Not all categories are currently active; this is indicated against each category below.

Strictly Necessary Cookies

These are cookies required for the Platform to operate and cannot be switched off. They are typically set in response to actions you take, such as logging in, maintaining a session, or submitting a form. Strictly necessary cookies do not require your consent under PECR. Regulation 22 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 sets out the general requirement to obtain consent before storing or accessing information on a user’s device, while Regulation 6(4) provides an exemption for cookies that are strictly necessary for the provision of a service explicitly requested by the user. The cookies described in this section fall within that exemption.

• Authentication and session cookies used to keep you logged in and to verify your identity (set via NextAuth).
• Security cookies used to detect and prevent fraudulent activity, protect user accounts, and support the integrity of forms and submissions.
• Load-balancing and infrastructure cookies, used by our hosting provider (Vercel) to route requests correctly and maintain Platform availability.

Functionality Cookies

These cookies allow the Platform to remember choices you make and to provide enhanced, more personalised features.

• Cookies that support account functionality, such as remembering that you are signed in or that a form has been partially completed.

Analytics and Performance Cookies

We do not currently use analytics or performance-tracking cookies on the Platform. We anticipate that, as the Platform develops, we may introduce analytics tools to help us understand how the Platform is used and to improve its performance. Any such tools and this Cookie Policy will be updated accordingly before such cookies are activated, and your consent will be obtained where required, in accordance with Regulation 22 of PECR.

Anticipated providers under consideration include Google Analytics and Meta (Facebook and Instagram) analytics. No final decision has been made and these tools are not yet in use.

Advertising and Marketing Cookies

We do not currently use advertising or marketing cookies, behavioural advertising technologies, or retargeting pixels on the Platform. Should we introduce such technologies in the future, we will update this Cookie Policy and will only deploy non-essential advertising cookies with your prior, opt-in consent, in accordance with Regulation 22 of PECR.

Affiliate and Commercial Link Verification Cookies

The Platform displays affiliate links, sponsored links and other commercial links to third-party products and services. We use Impact, an affiliate network platform, for website verification purposes connected with our affiliate arrangements (see further the Third-Party Providers section). Impact is not currently used to serve tracking cookies for affiliate link attribution on the Platform; this functionality may be introduced in the future as our affiliate arrangements develop, at which point this Cookie Policy will be updated and consent obtained where required.

Social Media and Embedded Content Cookies

The Platform does not currently embed social media content or social sharing widgets that set their own cookies. Where creator content is displayed on the Platform, this is integrated directly rather than embedded via third-party social media plug-ins. If this changes, this Cookie Policy will be updated to reflect any cookies set by such embedded content.

The table below sets out the specific cookies and similar technologies currently used on the Platform, together with those anticipated for future use.

We do not currently use Resend (our transactional email service) to set cookies on your device. Resend is used solely on the server side to deliver form notification emails and does not involve browser-based tracking technology.

Certain cookies and similar technologies referred to in this Cookie Policy are set by third-party service providers integrated into the Platform, rather than directly by us. We do not control the cookies set by third parties, and we encourage you to review the relevant third party’s own cookie or privacy policy for further information.

Active third-party providers relevant to the Platform’s infrastructure currently include Vercel (hosting), Amazon Web Services (database infrastructure), Cloudinary (media delivery), NextAuth (authentication), Resend (transactional email) and Impact (affiliate network verification).

Anticipated third-party providers under consideration for future use include Webflow, Mailchimp (or a similar email/marketing platform), Google Analytics, Meta analytics, and CookieYes. None of these tools are currently active, and this Cookie Policy will be updated before any are deployed.

Under Regulation 22 of PECR, we are required to obtain your consent before placing non-essential cookies on your device, save where a cookie is strictly necessary for a service you have requested, in which case the exemption in Regulation 6(4) applies. Strictly necessary cookies, as described above, do not require consent.

As the Platform does not currently use analytics, advertising or marketing cookies, no cookie consent banner is presently required for non-essential cookies. Should we introduce such technologies, we will implement a compliant consent mechanism (anticipated to be provided via CookieYes or a similar consent management platform) before any non-essential cookie is set, which will allow you to:

• accept or reject non-essential cookies by category;
• withdraw consent at any time with the same ease with which it was given; and
• access clear information about each cookie category before consenting.

Where consent is required in future, we will keep a record of the consent given, in accordance with the accountability requirements of the UK GDPR.

No non-essential cookie, including any analytics, advertising or affiliate tracking cookie referred to in this Cookie Policy as not currently active, will be activated on the Platform until this Cookie Policy has been updated to reflect that cookie and a compliant consent mechanism has been implemented and is operational.

You can control and manage cookies in various ways. Most browsers allow you to refuse to accept cookies, delete existing cookies, or be notified when a cookie is set, through your browser settings.

Please note that if you choose to block or delete strictly necessary cookies, certain features of the Platform, such as remaining logged in or submitting forms, may not function correctly.

Once a cookie consent management platform is implemented, you will also be able to manage your preferences for non-essential cookies directly through the consent tool available on the Platform.

Further information on how to manage cookies through common browsers is available directly from browser providers, including Google Chrome, Mozilla Firefox, Apple Safari and Microsoft Edge.

Where a cookie results in the processing of personal data, we rely on the following legal bases under Article 6 of the UK GDPR:

• Consent, for non-essential cookies such as analytics or advertising cookies, where activated;
• Legitimate interests, for strictly necessary cookies that support core security, functionality and fraud-prevention purposes, where the cookie is not otherwise exempt from consent under PECR; and
• Performance of a contract, where a cookie is necessary to provide a service you have requested, such as maintaining your login session.

Some of our third-party service providers, including Vercel and Amazon Web Services, may process data outside the United Kingdom, including in the United States.

Where this occurs, we ensure that appropriate safeguards are in place. For providers based in the United States, this may include reliance on the UK-US Data Bridge, where the relevant provider is certified under that framework. Where a provider is not so certified, we ensure that appropriate safeguards are in place, such as International Data Transfer Agreements (IDTAs) or, where applicable, that the transfer is made to a country benefiting from UK adequacy regulations, in accordance with Chapter V of the UK GDPR.

Further information on international transfers is set out in our Privacy Policy.

Where cookies result in the processing of personal data, you have rights under the UK GDPR, including the right of access, the right to erasure, the right to object to processing, and the right to withdraw consent at any time.

Given the family and parenting-related nature of the content available on the Platform, we have particular regard to the Age Appropriate Design Code (the “Children’s Code”) issued by the ICO when considering our use of cookies and similar technologies. Further information on our approach to children’s data and the Children’s Code is set out in our Privacy Policy.

Full details of these rights, and how to exercise them, are set out in our Privacy Policy.

We may update this Cookie Policy from time to time, in particular as new tools and technologies are adopted on the Platform following the testing and validation phase referred to above.

Material changes will be notified by updating the “Last Updated” date at the top of this Cookie Policy. We encourage you to review this Cookie Policy periodically.

If you have any questions about this Cookie Policy or our use of cookies, please contact us at:

Tones & Tells — Email: tonesandtells@gmail.com