1. About This Policy 1
This policy explains the cookies and similar technologies used by Subcontext Ltd ("Subcontext", "we", "us"), and by the third parties whose content appears in the Service. It covers:
- our website, subcontext.com, including the Learn pages and our own website assistant;
- the Subcontext dashboard (subcontext.com/dashboard) and the pages of it shown inside our apps;
- hosted mini-sites (
<name>.sites.subcontext.com) and Customers' own domains that we host for them; - pages we serve for Customers, such as hosted checkout, policy and document pages, and the policyholder area;
- our web chat, quote form, form guide and Nurture widgets ("embeds") when a Customer adds them to its own website; and
- the Subcontext apps for iPhone, iPad, Mac and Android.
"Cookies" are small text files a website stores in your browser. "Similar technologies" include browser storage (local storage and session storage), which works in the same way for the purposes of the Privacy and Electronic Communications Regulations 2003 (PECR). This policy uses "cookies" for both where the difference does not matter.
Under PECR, a cookie that is strictly necessary to provide a service you have asked for does not need your consent. Other cookies do. This policy says which category each item falls into. It is an information notice, not part of any contract. Our Privacy Policy explains how we handle personal data more generally.
2. Summary
- We do not use advertising cookies, and we do not use analytics cookies or tracking scripts. We count visits to our website and to hosted pages on our own servers, without cookies (see our Privacy Policy).
- The cookies Subcontext sets are needed to sign you in, keep the Service secure and remember choices you make.
- Some pages load content from other companies (Stripe, Google Fonts, YouTube, Vimeo, Meta, Google and Persona). Those companies may set or read their own cookies or receive your IP address. Section 5 lists where and why.
3. Cookies Set by Subcontext
| Name | Where | Purpose | Lifetime | Category |
|---|---|---|---|---|
__Host-subcontext_session |
Every page we serve, including the dashboard, our website, hosted mini-sites, Customers' own domains we host, hosted checkout and the policyholder area | An encrypted session cookie. It keeps you signed in during a visit, carries the security token that protects forms against cross-site request forgery, carries one-off messages between pages, keeps a policyholder signed in (for up to 30 minutes of inactivity), and remembers that you have entered the password for a password-protected site | Until you close your browser. Signed-in dashboard sessions also end on our servers after 30 days of inactivity | Strictly necessary |
remember_user_token |
Dashboard | Keeps you signed in after you close your browser, only if you tick "Remember me" when signing in | 2 weeks, or until you sign out | Strictly necessary (you asked for it) |
dismissed_<tip>, for example dismissed_contacts_intro |
Dashboard | Remembers that you closed a tip or introduction panel, so it is not shown again | 1 year | Strictly necessary (remembers a choice you made) |
Cookies set by a host apply only to that host. A Customer's own domain therefore has its own __Host-subcontext_session cookie, separate from subcontext.com. The __Host- prefix means a browser accepts the cookie only from that exact host, over HTTPS.
4. Browser Storage Used by Subcontext
4.1 Dashboard
The dashboard uses your browser's local storage to remember how you like it laid out. Nothing here is sent to us, and it stays until you clear your browser's site data.
| Key | Purpose | Category |
|---|---|---|
sidebar-group:<name> |
Whether each group in the sidebar is open or closed | Strictly necessary (remembers a choice you made) |
help-pane:open |
Whether the help pane is open | Strictly necessary (remembers a choice you made) |
emoji-picker:recent |
Your recently used emoji | Strictly necessary (remembers a choice you made) |
assistant:<organisation>:<setting> |
The dashboard assistant's panel: whether it is open or expanded, its height, the conversation you were in, and whether you dismissed its banner | Strictly necessary (remembers a choice you made) |
4.2 Embeds on Customers' Websites and Hosted Mini-Sites
When a Customer adds our widgets to its website or mini-site, they store the following in the visitor's browser, on that website's domain:
| Widget | Key | Storage | Purpose | Lifetime |
|---|---|---|---|---|
| Web chat | subcontext_webchat |
Local storage | A random visitor identifier, and for each chat agent, the conversation identifier and its access token, so a chat continues as you move between pages | Conversation details are dropped after 24 hours. The visitor identifier stays until browser data is cleared |
| Web chat | subcontext_webchat_dismissed:<agent> |
Session storage | Remembers that you closed the chat window, so it stays closed as you move between pages | Until the tab is closed |
| Form guide | subcontext_formguide |
Local storage | A random visitor identifier used when you ask the form guide for help with a field | Until browser data is cleared |
| Quote form | sx.quote.appHandle.<product>.<journey> |
Session storage | The identifier and access code of the quote or application you have started, so it survives moving between pages | Until the tab is closed |
These items are created only when you start a chat, ask the form guide for help or start a quote. They are not used for advertising or to follow you across other websites. The conversation and quote items are strictly necessary for the service you asked for. The visitor identifier lets the business recognise that a new chat comes from the same browser as an earlier one.
The Nurture widget, used by financial advisers inside partner software, does not use cookies or browser storage.
5. Third-Party Content and Cookies
| Provider | Where | What happens | Category |
|---|---|---|---|
| Stripe | Only on pages where you make or set up a payment: dashboard billing (card and Direct Debit), hosted checkout pages, payment and Direct Debit forms shown in web chat, and the policyholder bank details page | Stripe's script sets __stripe_mid (1 year) and __stripe_sid (30 minutes) to detect fraud, and its payment frames may use cookies on Stripe's own domains. See Stripe's cookie policy |
Strictly necessary for the payment you asked to make |
| Google Fonts | Our website (including Learn pages), the dashboard, and some hosted document and quote comparison pages | Fonts are loaded from Google's servers. Google Fonts does not set cookies, but your browser sends your IP address and browser details to Google when it fetches them. See Google's privacy policy | Not a cookie; disclosed so you know your IP address reaches Google |
| YouTube and Vimeo | Where a chat message or other content contains a YouTube or Vimeo video, for example a video an AI agent shares in web chat, or one shown in the dashboard | The video player loads from youtube.com or player.vimeo.com when the message is displayed. YouTube (Google) and Vimeo may set or read their own cookies and receive your IP address. See Google's privacy policy and Vimeo's cookie policy | Not strictly necessary |
| Meta (Facebook) | Dashboard only: the WhatsApp setup page, when a Customer connects a WhatsApp Business account | Meta's sign-in script loads from connect.facebook.net so you can connect your WhatsApp account. We turn off its event logging. Meta may use cookies on its own domains for the sign-in. See Meta's cookie policy | Strictly necessary for the connection you asked to make |
| Dashboard only: choosing a spreadsheet when connecting Google Sheets | Google's file picker loads from apis.google.com and docs.google.com and uses your Google sign-in cookies on Google's domains | Strictly necessary for the connection you asked to make | |
| Persona (through Twilio) | Dashboard only: phone number compliance registration | The identity verification window loads from withpersona.com and may use its own cookies to complete the check | Strictly necessary for the verification you asked to start |
These providers decide how they use their own cookies, under their own policies.
6. Hosted Mini-Sites, Customers' Domains and Embeds
Hosted mini-sites, pages on Customers' own domains, and websites that use our embeds belong to our Customers. The cookies and storage described in Sections 3 to 5 are the only ones Subcontext's own code sets there. A Customer can also add its own content and scripts to its mini-site or website (for example a site design that loads Google Fonts or embeds YouTube videos), which may set other cookies or send visitors' IP addresses to third parties. The Customer is responsible for those, for telling visitors about all the cookies on its website, and for getting consent where PECR requires it. Please read that business's own cookie and privacy information, or contact it directly.
Where a Customer connects its own Google Ads or Meta advertising account, conversions (such as a completed purchase) are reported to that account on the Customer's instructions. Subcontext does not set advertising cookies or load advertising scripts to do this. See our Consumer Notice for more.
7. The Subcontext Apps
The apps do not use cookies for tracking or advertising and do not use advertising identifiers. Some screens, such as signing in and account pages, show pages of the Service inside the app. Those pages use the cookies in Section 3, which the app keeps in its own storage (not your device's browser) and deletes when you sign out. The Android app sends crash reports to Google Firebase Crashlytics, as described in our Privacy Policy.
8. Your Choices
Strictly necessary cookies and storage cannot be turned off in the Service, because sign-in, security, payments and chats would not work without them.
You can block or delete cookies and site data in your browser's settings at any time. If you block cookies on subcontext.com or the dashboard, you will not be able to sign in. Clearing site data on a website that uses our web chat starts a fresh chat and a new visitor identifier.
YouTube and Vimeo videos load only when a message or page containing one is shown. You can avoid them by not opening content that contains a video, or by blocking those sites' cookies in your browser.
9. Changes to This Policy
We update this policy when the cookies or technologies we use change. The version number and publication date shown with this document identify the current version.
10. Contact
If you have questions about our use of cookies, contact us at:
Subcontext Ltd Registered in England and Wales, No. 17019645 ICO registration No. ZC098511 124 City Road, London, EC1V 2NX Email: hello@subcontext.com