How long we keep it
On our servers: raw browser data 2 days, analytics data made anonymous after 730 days and deleted after 1,095. In Google Analytics, event data is kept for 14 months.
What's always on
Necessary cookies. They can't be switched off, because without them pages don't route, forms don't submit, and we've no way to remember your cookie choice.
| Cookie | Set by | Purpose | Expires |
|---|---|---|---|
| gc_cookie_preferences | growcreate.co.uk | Stores your consent choice so you're not asked again | 365 |
| sticky_session | Hosting platform | Keeps you on the same server during a visit | End of session |
| .AspNetCore.Antiforgery.* | growcreate.co.uk | Protects forms against cross-site request forgery | End of session |
Statistics - off until you allow it
Two things measure how the site is used.
Umbraco Engage runs on our own servers. It records pages viewed, time on a page, how far you scroll, what you search for, links you click to other sites, and form and video use. It also stores where you came from, your browser type, and a shortened IP address. That data stays in our own database. We don't share it or sell it.
Google Analytics 4 runs through Google Tag Manager. It measures much the same thing, but the data goes to Google, who process it for us.
Neither is anonymous - an ID tells one visit apart from another. Neither builds a profile of you. That's the separate choice below.
| Cookie | Set by | Purpose | Expires |
|---|---|---|---|
| umbracoEngageAnalyticsVisitorId | Umbraco Engage (first-party) | Tells one visitor apart from another | End of session. 365 days if you also allow Personalisation |
| _ga | Google Analytics | Tells one visitor apart from another | 2 years |
| _ga_3THTV2JX4T | Google Analytics | Keeps a visit together as one session | 2 years |
| engageExternalLinks | Umbraco Engage (first-party) | Records links you click to other sites | Until cleared. Removed when you turn Statistics off |
| umbraco-engage-form-* | Umbraco Engage (first-party) | Remembers form progress if you cancel part-way | End of session. Removed when you turn Statistics off |
Personalisation - off until you allow it
This lets the site remember you between visits, so it can tailor what you see and keep you in the same test group. That means building a profile of your visits, so we ask separately.
It needs Statistics on too - the same ID does both jobs. Turn Statistics off and this turns off with it.
It sets no cookie of its own. It changes how long the Statistics cookie lasts: from end of session to 365 days.
Marketing - off until you allow it
This covers the advertising tags in Google Tag Manager:
Google Ads - tells us which ads led to an enquiry, and lets us show ads to people who've already been here.
LinkedIn Insight - the same for our LinkedIn campaigns.
Ad-blocker measurement - one Umbraco Engage script that fetches a small image from Google to count how many visitors block trackers. It needs Statistics on as well.
Leave Marketing off and Consent Mode keeps advertising storage, user data and ad personalisation denied, so none of these tags can store anything or recognise you.
| Cookie | Set by | Purpose | Expires |
|---|---|---|---|
| _gcl_au | Google Ads | Links an ad click to an enquiry | 90 days |
| Cookies on google.com, doubleclick.net and linkedin.com | Google, LinkedIn | Recognise your browser so ads can be measured and audiences built | Typically up to 13 months |
How your choice is enforced
Three layers, so a rejected cookie stays rejected:
Consent Mode v2 defaults. Before anything loads, analytics_storage, ad_storage, ad_user_data and ad_personalization are set to denied. Only functionality_storage and security_storage start granted. Google Tag Manager loads in that denied state and is updated the moment you choose.
Server-side stripping. Every response passes through middleware that reads your preference cookie and removes Set-Cookie headers for any category you haven't allowed. This catches cookies written outside the standard ASP.NET pipeline — Umbraco Engage's visitor cookie among them.
Client-side clean-up. On each page load, cookies belonging to a category you've turned off are deleted, across the domain and its subdomains — including any set before you made a choice.
Your preference is stored as a versioned string (v=1&stats=0|1&marketing=0|1) in a first-party cookie, SameSite=Lax and Secure over HTTPS. It's never sent to a third party. If we change what a category covers we bump the version, which invalidates the old preference and asks you again rather than assuming the previous answer still stands.
Changing your mind
Click Cookie preferences in the footer. Reject-all is one click, same as accept-all.
You can also clear or block cookies in your browser settings. Block the necessary ones and parts of the site will stop working — including our ability to remember that you declined.
Questions
Email support@growcreate.co.uk. How we handle personal data more broadly is covered in our Privacy policy.
Last updated: 19 August 2026.