Cookie policy
Cookie policy
Last updated: 6 October 2026
Casa Layer Ltd (registered name CASA LAYER LTD) is a private limited company registered in England and Wales. Company number 17491477. Registered office: Suite RA01, 195-197 Wood Street, London, E17 3NU.
Privacy policy: https://casa-layer.com/privacy
This policy explains how casa-layer.com uses cookies and other storage-and-access technologies. It is written for the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR), as amended (including by the Data (Use and Access) Act 2025), and for the UK GDPR where the information stored or accessed is also personal data.
It is not a description of cookies inside a hotel’s own systems, and it is not a description of the product API or MCP.
We do not claim ICO registration in this policy. ICO number: TBC: leave blank until issued.
Privacy contact: privacy@casa-layer.com.
1. What this policy covers
PECR regulation 6 restricts storing information, or accessing information stored, on a subscriber’s or user’s terminal equipment. The ICO describes this as the law on storage and access technologies, not only cookies. The same rules can apply to pixels, local storage, SDK identifiers and similar tools.
We must:
- tell you what we use, what it does, and why, in clear language;
- name third parties whose technologies we ask you to accept;
- obtain consent to the UK GDPR standard before any non-exempt storage or access;
- make it as easy to refuse as to accept;
- not treat continued browsing as consent.
Consent is not required where a PECR exception applies (for example, a use that is strictly necessary to provide a service you asked for). Exceptions are narrow.
2. The banner
The first-visit banner on casa-layer.com is the control.
- Accept switches on PostHog, Google Analytics 4 and Microsoft Clarity, and allows the first-party identifier cookie that is tied to Accept.
- Decline switches those tools off going forward and deletes the first-party cookies this site can delete, as described in section 3.
- PostHog does not load, and sends nothing, until you accept.
- Google Analytics 4 does not load until you accept. Accepting sets
_gaand_ga_D6CVFD9TPL. - Microsoft Clarity does not load, and sends nothing, until you accept.
- Apollo.io is no longer loaded on this site.
- Cloudflare Web Analytics is built to count visits without a cookie and without storing anything on your device. A scan of the home page, /use-cases/front-desk and /contact on 6 October 2026 did not see that beacon load. Cloudflare still processes request metadata to host the site.
- The first-party identifier is
_ph_did. It is set only after Accept. There is no separate experiment or page-version cookie. See section 4.2.
3. How to change your mind
- Use the banner on your first visit.
- After that, use Cookie settings in the footer, next to Privacy, Cookies and Terms. It is on every page that uses the main footer or the short footer, and it reopens the same banner so you can accept or decline again.
- Choosing Decline switches PostHog, Google Analytics 4 and Microsoft Clarity off going forward. It also deletes the first-party cookies this site can delete, including
_ga,_ga_D6CVFD9TPL,_clck,_clsk, and the httpOnly cookies_ph_didand_ph_flags. - Cookies set on another company’s domain (for example clarity.ms, bing.com or apollo.io) cannot be deleted by this site. Clear those in your browser settings.
- Email privacy@casa-layer.com and we will confirm what we hold about you as controller and, where we can, delete it.
Withdrawing consent does not affect the lawfulness of storage or access that already happened. It does stop those tools from collecting on later pages, and it clears the first-party cookies named above.
4. Cookies and similar technologies we use
4.1 Strictly necessary / functional
| Name | Who sets it | What it does | Lifetime | PECR position |
|---|---|---|---|---|
cookie_consent (cookie and local storage) | Casa Layer (first party) | Remembers Accept or Decline so we do not ask on every load | 1 year | Strictly necessary, or covered by the consent-mechanism exception, if used solely for that purpose |
A scan of casa-layer.com on 6 October 2026 did not find a Casa Layer or Cloudflare session, load-balancing or security cookie on this domain.
4.2 Identifier (first party)
| Name | Who sets it | What it does | Lifetime | PECR position |
|---|---|---|---|---|
_ph_did | Casa Layer (first party, httpOnly) | Recognises repeat visits as the same visitor, so feature flags and analytics can share one id. Set only after Accept | 1 year | Treat as consent required unless a solicitor stamps an exception |
There is no separate experiment or page-version cookie. A scan on 6 October 2026 did not find one, and the site does not set one. After Accept, the home page and the quiz may also set a first-party httpOnly cookie _ph_flags for about 5 minutes, to cache feature-flag values. That scan did not observe it.
4.3 Analytics (after Accept only, except as noted)
| Technology | Who | What it does | Before Accept | After Accept |
|---|---|---|---|---|
| PostHog | PostHog, Inc. | Product analytics: visitor identifier, pages and actions. A submitted email is used as the identifier only if analytics was accepted | Does not load. Sends nothing | Loads after Accept. A scan on 6 October 2026 did not see a PostHog cookie. After a choice, local storage may hold __ph_opt_in_out_. The separate first-party cookie _ph_did is described in section 4.2 |
| Google Analytics 4 | Google LLC | Pages viewed, session and referral | Does not load. Sends nothing | First-party cookies _ga and _ga_D6CVFD9TPL, about 400 days |
| Microsoft Clarity | Microsoft Ireland Operations Limited, independent controller | Session recordings and heatmaps. Form fields are masked | Does not load. Sends nothing | After Accept, as measured on 6 October 2026: first-party _clck (about 1 year) and _clsk (about 1 day); CLID on www.clarity.ms (about 1 year); MUID on .clarity.ms and .bing.com (about 13 months); MR (about 7 days); SRM_B (about 13 months); SM (session); ANONCHK (about 10 minutes); session storage _cltk |
| Apollo.io | ZenLeads, Inc. (d/b/a Apollo.io) | No longer loaded on this site | Not loaded | Not loaded |
| Cloudflare Web Analytics | Cloudflare, Inc. | Counts visits, without a cookie, when the beacon is enabled | Did not load on the pages scanned on 6 October 2026. It is not switched on by the banner | Same. It sets no cookie on this site |
Retention: PostHog analytics events are kept for 12 months. GA4 user and event data: TBC: property setting; previously described as 14 months. The property setting is not readable from this website..
4.4 Technologies we do not use on this site (as at this policy)
Unless we change this policy first, we do not use on casa-layer.com:
- advertising or retargeting pixels;
- social-media tracking pixels;
- a cookie wall that blocks the page until you accept;
- sale of a cookie identifier to a data broker.
5. Lawful basis after PECR consent
PECR covers storage and access. The UK GDPR covers personal data.
Where a cookie or similar technology produces personal data:
- PECR consent, where required, is the storage-and-access permission;
- UK GDPR still needs an Article 6 basis for the subsequent processing.
Our public position: banner Accept is consent for PECR and, for analytics personal data, Art. 6(1)(a), unless a solicitor stamps another basis.
A submitted email is not joined to PostHog analytics if the banner was declined. The browser only calls identify after Accept, and the server refuses the event unless the consent cookie is accepted.
6. Third parties you are asked to accept
If you click Accept, you are asked to accept storage and access by, or on behalf of:
- PostHog, Inc.: product and website analytics.
- Google LLC: Google Analytics 4.
- Microsoft Ireland Operations Limited: Clarity, as an independent controller.
- Casa Layer: the first-party identifier cookie
_ph_did. There is no experiment cookie.
Cloudflare Web Analytics is not presented as a cookie you accept if it sets none. Cloudflare still processes request metadata to host the site. Apollo.io is no longer loaded on this site.
Loops, Resend, Attio, Intercom and Google Workspace receive personal data you submit or that we hold as controller. They are not cookies. They are listed in the privacy policy.
7. International transfers
Tools in section 4 may process data outside the United Kingdom. Transfer mechanisms are the same as in the privacy policy: UK adequacy, the UK Extension to the EU-US Data Privacy Framework where the provider is certified, the UK IDTA, or EU standard contractual clauses plus the UK Addendum. The privacy policy section 8 table names the mechanism for each provider. A cell there that is still marked TBC is not yet verified.
8. Your rights
Cookie consent can be withdrawn at any time (section 3). Withdrawing consent does not affect the lawfulness of storage or access that already happened.
Where the information is also personal data, the privacy-policy rights apply (access, erasure, objection, complaint to the ICO). Email privacy@casa-layer.com.
9. Changes
We will update this policy when the cookies or the banner behaviour change. The date at the top will change. A material change to what Accept means should be followed by a fresh banner, not a silent edit.
This version is dated 6 October 2026.
10. English law
This policy is intended for PECR and the UK GDPR. Governing law: England and Wales. Supervisory authority: Information Commissioner’s Office.