Cookie Policy
Last updated 1 September 2026
Saral has no cookie banner because it needs none. We set no advertising cookies, no cross-site tracking, and our page analytics (Vercel Web Analytics) is cookieless by design — it counts page views without identifying you or storing anything on your device. Every cookie we do set is strictly functional: the service cannot work without it, which is the category UK PECR exempts from consent.
| Cookie | Purpose | Lifetime |
|---|---|---|
| sb-* (Supabase auth) | Keeps you signed in securely | Session / rolling |
| saral_active_company | Remembers which of your group's companies you are working in | 1 year |
| saral_preview_worker | Admin 'preview the worker portal' mode — read-only: while it is set, nothing can be saved | Until preview ends |
| saral_hmrc_device_id (HMRC device identifier) | Required by HMRC's fraud-prevention rules whenever Saral reads your VAT records from HMRC or verifies a CIS subcontractor. A random identifier for this browser — it holds no personal data. Saral never files returns. | 10 years (per browser) |
The app also uses your browser’s local storage for interface conveniences (a remembered tab, a saved table view). That data never leaves your browser. If we ever introduce a cookie that needs consent, we will add a consent mechanism before it ships and update this page.