Privacy & cookies

Heclr reviews websites: user experience, conversion, usability testing and user research. The public site is heclr.com.

For the personal data on this page, the controller is Go2Media (trading as Heclr).

If you ask for a free site review, the form on the homepage asks for your name, email address, website address, and optional notes. Name and email are required. Notes can be left blank and are limited to 2,000 characters. The website address is stored as a full https link.

We use those details to look at the site you named and to reply to you. The form says we aim to reply within two working days.

The form also has a hidden field that people leave blank. If that field is filled in, we show the same thank-you message and do not send the email. There is a limit on how many requests one network address can send in an hour. When a Cloudflare Turnstile key is configured, the form loads a script from challenges.cloudflare.com and will not send until that check passes. The check is there to block automated submissions. It is part of sending the form, not advertising or analytics, and it does not wait for the cookie banner.

Cloudflare’s current Turnstile documentation says a normal widget issues a one-time token and processes only the data needed to check for bots, such as the IP address, browser details and the site key. It does not set a cookie. A cf_clearance cookie is issued only if pre-clearance is switched on for the widget. This site does not use pre-clearance. Turnstile does not read the name, email, website or notes you type. Cloudflare’s Turnstile privacy addendum is at cloudflare.com/turnstile-privacy-policy.

The reason we are allowed to use the enquiry is performance of a contract, or steps taken before entering a contract.

The form is marked so PostHog does not autocapture it. Analytics, if you have accepted them, are told only that a review request was sent or failed, and whether the notes box had anything in it. Your name, email, website and notes are not sent to PostHog.

The site does not save the form in its own database. The server sends email over SMTP through Hostinger at smtp.hostinger.com, port 465.

One email goes to Heclr’s inbox with your name, email, website and notes. You can be replied to on the address you typed. A short confirmation email to you is sent only when that option is switched on, and only after the form checks have passed. When it is sent, it includes your name and the website address.

Enquiry emails are kept for 7 days. The mailbox is on Hostinger’s dedicated secure cloud mail servers, separate from web hosting storage. Mail to info@heclr.com is forwarded to Gmail, so Google also handles those enquiry emails.

If a PostHog project key is set when the site is built, a banner asks: “We use cookies to improve the site. Is that OK?” Nothing is sent to PostHog, and PostHog does not set cookies or browser storage, until you click Accept. Reject is the same size as Accept.

After Accept, the browser sends events to PostHog’s EU ingestion host, https://eu.i.posthog.com. A signed data processing agreement with PostHog Inc. is in place. Go2Media (trading as Heclr) is the controller and PostHog Inc. is the processor. Both parties signed it on 6 October 2026 via PandaDoc. Analytics are processed on PostHog’s EU cloud in Frankfurt.

International transfers are covered by the EU Standard Contractual Clauses with the UK International Data Transfer Addendum. PostHog commits not to let itself or its subprocessors use the data to train or fine-tune AI models. PostHog’s subprocessors are listed at posthog.com/subprocessors.

After Accept we record:

• The page address, including any query string, on each page.
• Clicks on links and buttons, except the review form and the cookie banner.
• Clicks on the free site review links, labelled header or hero.
• Whether the review form succeeded or failed, and whether notes were typed.
• An opt-in event when you click Accept.

We do not send your name or email to PostHog, and the form does not create an identified PostHog profile.

Session replay is used only if it is switched on in the PostHog project. It starts only after you click Accept, and it masks all inputs. The recording does not include the page’s network response bodies. PostHog surveys are switched off in the site code.

PostHog keeps events and recordings for up to 1 year. IP addresses are discarded.

The cookie banner is shown until you choose, whether or not a PostHog key is set. If the key is missing, nothing is sent to PostHog. Accept still loads Tag Manager. The rest of the site works either way.

After you click Accept, the site loads Microsoft Clarity from clarity.ms and tells Clarity that analytics storage is granted. Advertising storage stays denied. Clarity does not load before Accept. It is used for session recordings and heatmaps. Microsoft masks sensitive inputs by default. The project id is yz330xfy5g unless a different one is set for the build.

Clarity is loaded by this site’s own code, not by a Tag Manager tag. Reject, or a later withdrawal, tells Clarity that consent is withdrawn and deletes the _clck and _clsk cookies. Microsoft may also set CLID, MUID, ANONCHK, MR, and SM after Accept. Those are third-party cookies on Microsoft domains, so this site cannot delete them. Purposes follow Microsoft’s Clarity cookie list. The durations in the table are the typical lifetimes for those cookies.

Google Tag Manager, container GTM-PF2SFS7K, does not load until you click Accept. Before that, the page only sets Google Consent Mode to denied for analytics, advertising, functionality and personalisation storage. Accept calls gtag('consent','update', …) so analytics storage is granted before googletagmanager.com loads. Functionality and personalisation storage are granted at the same time. Advertising storage stays denied. That update is what lets a Google Analytics 4 tag in the container fire and set cookies.

This repository does not include a Google Analytics snippet. Google Analytics 4 is a tag inside Tag Manager, so it runs only after Accept. Reject, or a later withdrawal, sets consent back to denied and deletes _ga cookies where the browser allows. The container also loads the Pivit experiment snippet. Other published tags run after Accept, and they can change without a change to this website. The container was last checked on 17 October 2026.

Pivit (pivit.click) is still loaded through Google Tag Manager, so the experiment snippet runs only after Accept. It can change the page for a test and sends view and goal events to Pivit. People who click Reject are not included in those tests. It stores a visitor id in localStorage.

Names below are the cookies and browser storage used after Accept, including Google Analytics 4 once that tag is published in Tag Manager. Browser storage that is not a cookie is included, because the consent choice and the experiment id live there.

PostHog may also keep a tab copy of its main entry in sessionStorage while the tab is open. Reject clears PostHog keys whose names start with ph_ or __ph, Clarity cookies _clck and _clsk, Google Analytics cookies whose names are _ga or start with _ga_, and Pivit keys _ab_visitor_id, _ab_assign_ and _ab_converted_. A script that has already started on this page may write again until the next load. Later pages do not load Tag Manager or Clarity after Reject.

The footer has Cookie settings. It opens the same banner. Accept or Reject replaces the previous choice. Reject after an earlier Accept stops PostHog, does not load Tag Manager or Clarity on later pages, and clears PostHog, Clarity, Google Analytics, and Pivit storage as described above. The Heclr consent record itself stays until you clear site data.

You can also block or delete cookies in your browser.

You can ask us to:

• Tell you whether we hold personal data about you, and for a copy of it.
• Correct it.
• Delete it.
• Restrict how we use it, or object to a use that is not required to answer you.
• Receive data you gave us, in a portable form, where the law requires that.

UK GDPR usually gives an organisation one month to respond. Write to info@go2media.co.uk. That address is the data protection contact.

You can complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint.

Companies that handle this data:

• Hostinger stores the enquiry mailbox.
• Google receives enquiry emails, because info@heclr.com is forwarded to Gmail.
• Google also handles Google Analytics 4 after you click Accept, through a tag in Tag Manager. Google may transfer that analytics data internationally under its standard contractual clauses or UK adequacy.
• Cloudflare runs Turnstile, when a key is configured, to check the form for bots.
• PostHog Inc. handles analytics after you click Accept, on its EU cloud in Frankfurt, under the signed data processing agreement.
• Microsoft Clarity records sessions after you click Accept.
• Google Tag Manager loads the Pivit experiment snippet after you click Accept.
• Pivit runs experiments after Accept. The experiment service may be hosted on Railway. This site’s code does not confirm that host, so Railway is listed as a possible provider for that service.

Email info@go2media.co.uk.