What this covers
Cookies, and the things that behave like cookies: local storage and session storage. UK law (PECR) is about storing or reading information on your device, whatever it is called.
What is stored on your device
Observed in a real browser — fresh profile, first visit, no interaction beyond scrolling — across the homepage, /register and /opportunities.
| Name | Type | Set by | Purpose | Strictly necessary? | Lifetime |
|---|---|---|---|---|---|
toast_consent | localStorage | TOAST | Remembers the choice you made when we asked, so we do not ask again on every page. It holds nothing but that choice and the date you made it. | Yes — it exists only because you asked us to remember something | 1 year, after which we ask again |
toast_analytics_sid | sessionStorage | TOAST (our own analytics) | A random identifier so the pages you view in one visit count as one visit. Holds nothing about you; not shared outside our own systems. | No — analytics. Stored only if you allow analytics, and deleted the moment you withdraw | Current tab only — discarded when you close it |
__cf_bm | Cookie, httpOnly | Cloudflare, on HubSpot's behalf | Bot management for the enquiry form — distinguishes a person from an automated script so the form can be submitted. | Yes — the form does not work without it | About 30 minutes |
The two __cf_bm cookies — one on .hsforms.net, one on .hsforms.com — appear only on /register, and only when the enquiry form loads.
What this site does not set
No Google Analytics. No Meta Pixel. No advertising cookies. No cross-site tracking. TOAST’s own code sets no cookies at all — the __cf_bm cookies above come from HubSpot’s own infrastructure.
No reCAPTCHA, Maps or Fonts cookies were observed, although those Google hosts are contacted — see below.
The enquiry form reads cookies it did not set
If you have visited a HubSpot-hosted page elsewhere, the embedded form on /register will read hubspotutk, __hstc and __hssc if your browser already has them, and includes them when the form is submitted. We do not set those cookies. If your browser has them, they came from HubSpot or from another site using HubSpot.
We describe this because “we set no tracking cookies” and “the embedded form reads a HubSpot tracking cookie if you already have one” are different statements, and only the first was ever published.
Third parties your browser contacts
These store nothing, but loading a page reveals your IP address and browser to whoever serves it:
| Host | Where | What for |
|---|---|---|
js-eu1.hsforms.net, hsforms.com | /register | The enquiry form itself |
google.com/recaptcha, gstatic.com | /register, inside the form frame | Bot protection on the form |
maps.googleapis.com, maps.gstatic.com | /opportunities | The territory map |
fonts.googleapis.com, fonts.gstatic.com | /opportunities | Fonts |
api.postcodes.io | /opportunities | Turns the postcode or town you type into a location, so we can show nearby territories. What you typed is sent from your browser to this service. |
| Vercel, Supabase | Every page | Hosting and site content |
What our analytics records
The identifier above is only the storage. If you allow analytics, what is recorded is the pages you view, how far down them you scroll, the clicks on links and buttons we have tagged for measurement, any campaign tags in the link you followed, the territories you view, and the country and city our hosting provider derives from your IP address. Your IP address itself is not stored.
If you allow diagnostics, our error tracking records — when a page breaks — the error and its technical detail, the full address of the page you were on including anything after the ?, your browser’s full user-agent string, the session identifier above, and a trail of your last 20 actions: the buttons and links you clicked, the pages you moved between, and the network requests the page made. It does not record what you type into forms.
Your choices
On this site. The first time you visit, a bar at the bottom of the page asks before anything non-essential runs. Nothing is measured until you say yes — the analytics component is not loaded at all without your permission.
You can Accept, Reject, or Choose and set two things separately:
| Category | What it covers | Default |
|---|---|---|
| Strictly necessary | The toast_consent record above, and nothing else | Always on. Not a choice we can offer |
| Analytics | The session identifier, page views, tagged clicks, scroll depth, territory views and session duration | Off unless you turn it on |
| Diagnostics | Our error tracking — the breadcrumb trail, page addresses and browser details recorded when a page breaks | Off unless you turn it on |
Changing your mind. “Cookie preferences” in the footer of every page reopens the panel. Withdraw & forget there deletes the stored choice and the analytics session identifier, so a later change of mind starts a fresh session rather than resuming the old one. Withdrawal takes effect immediately, without a page reload. We ask again after a year, or sooner if what we are asking about changes.
The __cf_bm cookies are separate: they are set by HubSpot’s infrastructure so the enquiry form can tell a person from a script, are required for that form to work, and expire in about half an hour.
In your browser. You can clear site data at any time, or block storage for this site — the site still works.
Who we are, and how to reach us
This site is operated by Love Toast Franchising Limited, a company registered in England and Wales under company number 17252678, with its registered office at Unit 6, Cherrytree Farm, Blackmore End Road, Sible Hedingham, Halstead, Essex, CO9 3LZ.
Questions about this notice, or about your information, go to hello@lovetoast.co.uk. How we handle personal information more generally is in our privacy policy.
- You can also complain to the Information Commissioner’s Office at ico.org.uk, though we would rather you came to us first.