Overview
Seatly uses a minimal number of cookies. We do not use advertising cookies, tracking cookies, or social media cookies, and we set no analytics cookies. The only cookie set when you interact with a Seatly-powered booking form is a strictly necessary security cookie placed by Cloudflare Turnstile to protect the form against automated spam and abuse.
Our marketing website at seatly.uk also uses cookieless analytics that set no cookies and store nothing on your device, and — only if you agree to it — session recording, which stores a session identifier in your browser. See the sections below.
We ask for your consent to one thing, and one thing only: session recording on our marketing pages. Everything else either sets no cookie at all or relies on a strictly necessary cookie that is exempt from consent.
Cookies and Other Storage We Use
Cookies
| Cookie | Set By | Purpose | Type | Duration | Consent Required? |
|---|---|---|---|---|---|
cf_clearance (or equivalent Turnstile token) | Cloudflare Turnstile | Anti-spam and bot detection on the booking form. Verifies that a form submission originates from a human user rather than an automated script. | Strictly necessary | Session or up to 30 minutes | No — exempt under PECR Regulation 6(4) |
Local storage on our marketing website
Local storage is not a cookie, but PECR treats storing information on your device the same way whatever the mechanism, so we list it here.
| Entry | Set By | Purpose | Duration | Consent Required? |
|---|---|---|---|---|
seatly-analytics-opt-out | Seatly | Records that you asked to be excluded from our cookieless analytics, so we can honour that on later visits. Only written if you use the opt-out control. | Until you clear it | No — a preference you explicitly requested |
seatly-replay-consent | Seatly | Records your yes or no to session recording, so we do not ask again and so we can honour a refusal. Only written once you answer. | Until you clear it | No — a preference you explicitly requested |
ph_*_posthog | PostHog | Session identifier used to group a session recording. Only written if you agree to session recording. | Until you clear it, or you turn recording off | Yes |
When We Ask for Consent, and When We Don’t
The Privacy and Electronic Communications Regulations 2003 (PECR), Regulation 6, requires your consent before information is stored on, or read from, your device. Regulation 6(4) exempts storage that is:
- used solely for the purpose of carrying out or facilitating the transmission of a communication over an electronic communications network; or
- strictly necessary to provide an information society service explicitly requested by the user.
We do not ask about the Turnstile cookie. It falls within the exemption: it is strictly necessary to protect the booking form from automated abuse and to let a genuine user complete a booking request. Without it, the form could not function reliably or securely.
We do not ask about our cookieless analytics. They store nothing on your device and read nothing from it, so Regulation 6 does not apply to them at all. They also fall within the statistical-purposes exception introduced by the Data (Use and Access) Act 2025.
We do ask about session recording, because it stores a session identifier in your browser. That is storage on your device, it is not strictly necessary for anything you asked us for, and the statistical-purposes exception does not stretch to recording an individual visit. So it is off until you say yes.
Cookieless Analytics on Our Marketing Website
Our marketing website at seatly.uk uses two privacy-preserving analytics tools to understand, in aggregate, how visitors use the site:
- PostHog (EU Cloud) — measures page views, referrers, how far visitors scroll, which sections of a page are seen, interactions such as clicks, and page-load performance. It runs in cookieless mode: it sets no cookies, writes nothing to your device, and does not build a profile of you. Visitors are counted using a short-lived, daily-rotated hash that cannot identify you and is discarded within 24 hours. Data is processed in the EU (Frankfurt).
- Cloudflare Web Analytics — measures aggregate page views and page performance. It is cookieless and sets no identifiers.
Because these tools store nothing on your device and do not identify or track individuals, they do not require consent under PECR, and they fall within the statistical-purposes exception introduced by the Data (Use and Access) Act 2025. We use the data solely to improve the website.
You can still object. An analytics opt-out control is available at the bottom of this page. If you opt out, a single preference entry is stored in your browser’s local storage so we can honour your choice — that entry exists only to record the opt-out and is exempt from consent requirements as a user-requested preference.
These tools run only on the marketing website. They are never loaded on the booking or admin widgets that restaurants embed on their own websites.
Session Recording on Our Marketing Pages
If you agree to it, we record how you move through our marketing pages — scrolling, pointer movement, clicks, and the page as it appeared to you — and watch those recordings back to find the places where the site confuses people.
It is off unless you say yes. We ask once, with a clearly offered refusal that is no harder to choose than agreement. Nothing is stored on your device until you answer, and declining changes nothing about how the site works for you.
What is protected:
- Everything you type is masked. Form fields are recorded as obscured characters, never as the text you entered. That includes your name, email address, phone number and restaurant name on our enquiry form.
- We do not record the contents of network requests, so form submissions are not captured that way either.
- We do not record browser console output, and we do not record the animated graphics on the page.
- Addresses that contain a private link are stripped before they are stored.
Where it runs, and where it does not. Session recording runs only on our own marketing pages. It is never active on the pages that handle a booking, a queue place, an event ticket or a text-message unsubscribe, and it is never active on either of the widgets a restaurant embeds on its own website. Those pages carry other people’s personal data, so they are excluded outright.
Who processes it. PostHog Inc., on their EU Cloud in Frankfurt. They are already listed on our Sub-Processor List.
How long we keep it. Recordings are retained for 30 days and then deleted automatically.
How to change your mind. Use the session recording control at the bottom of this page. Turning it off stops recording immediately, not on your next visit. Opting out of analytics altogether also switches recording off, whatever you answered before. If you would like a recording of your own visit erased, email privacy@seatly.uk.
Our lawful basis for the recording itself is your consent, under Article 6(1)(a) UK GDPR. You can withdraw it at any time, as easily as you gave it.
No Analytics, Advertising, or Social Media Scripts on the Widgets
Seatly does not load any of the following on its booking or admin widgets:
- Analytics platforms (e.g. Google Analytics, Mixpanel, Hotjar)
- Advertising networks or pixel trackers (e.g. Meta Pixel, Google Ads tags)
- Social media scripts (e.g. X/Twitter, LinkedIn, TikTok)
- A/B testing or personalisation tools
- Session recording tools
Beyond the aggregate, cookieless site measurement described above, and the session recording you can agree to or refuse, no data about your browsing behaviour is collected or shared with any third party for marketing or profiling purposes. Neither applies to the widgets: both are marketing-website only.
Changes to This Policy
We may update this Cookie Policy from time to time. The version number and “Last Updated” date at the top of this page will reflect any changes.
| Version | Date | Change |
|---|---|---|
| 1.4 | 2026-09-12 | Added session recording on the marketing pages, offered behind consent, with the masking, exclusions, retention period and withdrawal route. Added a local-storage table. Replaced the “Why No Consent Banner Is Required” section, which was no longer accurate, with an explanation of what we ask about and what we do not. Added this change log. |
| 1.3 | 2026-09-11 | Earlier revisions predate this table. |
Contact
If you have any questions about this Cookie Policy, please contact us at:
Email: privacy@seatly.uk Address: Seatly Software Ltd, 27 Old Gloucester Street, London, WC1N 3AX, United Kingdom