Cookie Policy

Last updated: 23 October 2026

Gevu is a trading name of Seawolf Facilities Services Ltd (“Seawolf”, “we”, “us”, or “our”), a company registered in England & Wales (no. 15028189). Gevu uses cookies and similar browser storage technologies to provide a secure and functional service. This policy explains what we use and why.

In short: essential storage keeps you signed in and the Service working, and needs no consent. Optional analytics and functional storage each have their own switch in our cookie settings and stay off until you switch them on or choose “Accept all”. You can change any of it at any time with the button below or “Cookie settings” at the bottom of every public page. We do not use advertising or social media tracking. If your browser sends a Global Privacy Control signal, everything optional starts switched off.

Change cookie settings

1. Essential cookies

These are required for the platform to function. Without them, you cannot sign in or use the Service. They include:

• Authentication tokens: session and refresh tokens stored under the key custodia-auth-token, used to keep you signed in securely across page loads.
• MFA and device verification state: short-lived storage used during the multi-factor authentication flow, plus a trusted-device cookie (custodia_mfa_device, kept for 1 year) and a random device identifier in local storage, so a device you have already verified is not asked for a code every time and you can see and remove your trusted devices in your settings.
• Services Directory sign-in: partner_manage (14 days) keeps a business signed in to its listing’s manage page after it opens an emailed sign-in link. It is only set when someone signs in.
• Introducer sign-in: introducer_session (30 days) keeps an approved introducer signed in to their account page after they open an emailed sign-in link. It is only set when someone signs in.
• Your cookie choice: custodia-cookie-consent in local storage remembers which optional companies you allowed and when, so we don’t ask on every visit. We ask again after 12 months, or sooner if we add a company you haven’t answered about.
• Website live chat: if you start a chat on our website, local storage keeps the chat’s private key (glenz_site_chat_v1) so the conversation stays open as you move between pages. It is replaced when you start a new chat, and is useless once the chat is deleted (90 days after its last message).
• Blog answers: if you answer “Was this useful?” on a blog post, local storage keeps your answer (blog-answer:<post>) so the post shows your answer when you come back. Nothing else about you is stored on your device for blog views.
• User preferences: local storage entries for UI state such as sidebar position, selected dashboard, and theme preference.

Essential cookies are set automatically when you use the Service. They do not require your consent under the Privacy and Electronic Communications Regulations 2003 (PECR) because they are strictly necessary for a service you have requested.

2. Functional storage

We use browser storage (localStorage / sessionStorage) to cache your profile, shift data, and offline fallback content. This improves performance and enables the app to work in low-connectivity environments. No third-party tracking is involved.

3. Analytics (only with your consent)

We use analytics to understand how the Service and our public website are used and to improve them. Nothing in this section runs until you allow it: each item below has its own switch in cookie settings, and “Accept all” switches them all on. If you choose “Reject all”, or later switch an item off, it stops. No analytics tool we use is an advertising network, and none is used to build cross-site advertising profiles.

• Product analytics (PostHog): when you are signed in, PostHog records in-app usage events (pages viewed, features used) to help us understand product engagement. It sets a small amount of local/session storage to group your events together. For signed-in users this is linked to your account; for signed-out visitors it is anonymous and not linked to an identified person. Data is hosted in the EU. See Privacy Policy for PostHog as a subprocessor.
• Website traffic analytics (first-party): on our public marketing pages (home, pricing, Gevu Connect, Job Exchange, policies, sign-up) we record page visited, referring site, approximate location (country/city, derived from your IP address at the moment of the request), device type, and browser. This uses a random session identifier stored in your browser’s session storage, which is cleared automatically when you close the tab, plus a one-way cryptographic hash derived from your IP address so we can recognise a returning visit. We never store your IP address itself — only this irreversible hash. This data is first-party (Gevu only), is never shared with advertisers, and is used solely for internal traffic reporting and to alert our team to new or high-intent visitors. Our team views these reports in Gevu and in our internal website-reporting app, hosted by Cloudflare, which reads them from Gevu over an authenticated connection each time the team opens a report and does not keep a copy; no IP address is ever passed to it.
• Earlier Services Directory contact cookie: a previous review process could set a first-party cookie named dir_engaged for up to one year after you chose the review shortcut. We no longer set or use it to verify reviews. Any existing cookie expires automatically, and the related server records are removed by routine retention within one year. New reviews always require email confirmation. Listing view and tap counts use no cookie.
• Error tracking and session replay (Sentry): if you encounter an error, technical details about your session (page, actions taken, browser/device info) are sent to Sentry to help us diagnose and fix it. Error reports are sent whatever you choose, because we need them to keep the Service working. Session replay (a recording of the steps leading up to an error) has its own switch and only starts once you allow it; recordings mask all text fields and block media. This is not linked to advertising.

3A. Email tracking pixels and links

Emails a Customer sends to its sales contacts from the Gevu CRM can contain a 1×1 invisible image and links that pass through Gevu, so the Customer can see when the email was opened and which links were clicked. Nothing is stored on the recipient’s device, but under the Privacy and Electronic Communications Regulations 2003 this counts as accessing information from it. The Customer that sent the email decides whether to use tracking (it can be switched off for the whole workspace or for any single email) and is responsible for telling its recipients. We record only the time, the link clicked, and a short email-app label; never the IP address. Recipients can stop it by blocking remote images in their email app. See the “CRM email engagement data” entry in our Privacy Policy.

4. Third-party services

Some embedded or connected third-party services — such as Stripe’s payment widget, an accounting integration (FreeAgent, Xero, or Sage), a calendar integration (Google or Microsoft 365), or an address-lookup provider — may set their own cookies or make their own network requests during certain flows. These are governed by the respective provider’s own policy. We do not control these cookies.

Some screens also load content straight from another service, which means your browser’s IP address reaches that service as part of the request, even though no cookie is set: map images come from OpenStreetMap, and the weather on the dashboard and client portal comes from ipapi.co (an approximate location from your IP address) and Open-Meteo.

Our mobile app does not use cookies. It keeps your sign-in in the phone’s secure storage and has no analytics or advertising tracking.

4A. Every company, at a glance

This is the same list you see in cookie settings, so the two always match.

5. Managing cookies

To change or withdraw your choice at any time, use Change cookie settings at the top of this page or Cookie settings at the bottom of any public page. Switch off any single company, or choose “Reject all”; your new choice takes effect straight away. You can also block or delete cookies via your browser settings. However, blocking essential cookies will prevent you from signing in or using core platform features. To sign out and clear all session data, use the “Sign out” option within the app, which removes stored tokens and cached data.

6. Contact

For questions about our use of cookies, contact support@seawolfservices.co.uk.

← Back to policies