Policies
Cookie Policy
Last updated: the 15th of October 2026
This policy lists the cookies and similar technologies demandflow.co uses, what each one is for, and how long it lasts. The site is run by WISESTUDIO VENTURES LTD, trading as Demandflow ("we"). How we handle personal data more generally is in our Privacy Policy.
What cookies are
A cookie is a small file a website saves in your browser, so it can remember something between pages or visits. Websites can also store information in your browser in other ways, such as local storage, and read information from your device. The law treats all of these the same way, so this policy covers them all and calls them cookies.
Some are set by us ("first-party"). Others are set by a service we use, on its own domain ("third-party").
Your choices
When you first visit, a banner asks which optional cookies you accept. Until you choose, and if you reject them, we use only the cookies the site needs to work and the ones Vimeo’s video player sets (see Embedded videos, below). Accepting and rejecting are equally easy, and the site works either way.
You can change your choice at any time from "Cookie settings", at the foot of every page. If you withdraw consent, we stop future analytics collection and remove the analytics cookies and storage we control in your browser. This doesn’t automatically delete data already collected, which follows the retention periods in part 8 of our Privacy Policy.
You can also block or delete cookies in your browser’s settings. If you block the strictly necessary ones, the enquiry form or the booking calendar may not work.
Strictly necessary
These make something you’ve asked for work: remembering your cookie choice, sending your enquiry, keeping the form free of bots, and showing the booking calendar. The law allows them without consent, so they can’t be switched off in the banner. The Turnstile and Cal.com items only load when you start filling in the form or reach the booking step.
| Name | Set by | What it does | How long it lasts |
|---|---|---|---|
| df_consent | Demandflow (first-party cookie) | Remembers your cookie choice, so we don’t ask again on every page | 6 months (182 days) |
| df-enquiry-pending | Demandflow (first-party, local storage) | Only if your enquiry fails to send: keeps a copy in your browser so it can be sent again on your next visit to the Get started page | Until it’s sent. We stop trying after 7 days, and the copy is deleted the next time you open the Get started page |
| cf.turnstile.u | Cloudflare Turnstile (third-party, local storage in Turnstile’s own frame on challenges.cloudflare.com) | Part of Turnstile’s check that a person, not a bot, is sending the enquiry form (part 6 of our Privacy Policy). Turnstile sets no cookie, because we don’t use its "pre-clearance" option. Each check’s token works once, for one form submission | Until you clear it |
| __cf_bm | Cal.com, through Cloudflare (third-party, on cal.com) | Cloudflare’s bot protection for the booking calendar | 30 minutes |
| embed-theme-demandflow:stephenwise:light | Cal.com (third-party, local storage inside the booking calendar) | Remembers how the calendar is shown, such as light or dark mode, to match your device. You can stop it by clearing your browser’s storage for cal.com | Until you clear it |
| timeOption.is24hClock | Cal.com (the same) | Remembers whether times show on a 12 or 24 hour clock | Until you clear it |
| reserverUid | Cal.com (the same) | An ID the booking calendar creates when it loads | Until you clear it |
| A service worker for app.cal.com | Cal.com (third-party) | A background script Cal.com registers for its booking pages | Until you clear it |
The booking calendar is strictly necessary: it’s how you book the call you asked for, so it loads without asking. While it’s open, it also sends Cal.com’s own performance and error monitoring data to Sentry (Functional Software, Inc.), the monitoring service Cal.com uses, in the United States. That data is for Cal.com’s monitoring of its calendar, and we don’t receive it. Cal.com lists Sentry for error monitoring and performance metrics in its subprocessors list.
Analytics
Only if you accept analytics. Analytics shows us how the site is used, which pages work and where people get stuck, so we can improve it. Until you accept, no analytics loads at all: nothing is sent for analytics and nothing is stored on your device for it. Once you accept, the items below are set.
Google Analytics measures visits, where visitors came from and actions such as enquiries and bookings. Google Tag Manager loads it only after you accept analytics. Tag Manager doesn’t set its own cookies. We don’t use these tools for advertising or send your form answers or booking details to Google.
We use PostHog. On larger screens it may record your visit as a replay of the screen, with everything you type into a form hidden. Our PostHog data is held in the EU. In the names below, "<project key>" stands for our PostHog project’s public key.
| Name | Set by | What it does | How long it lasts |
|---|---|---|---|
| _ga | Google Analytics, on demandflow.co (first-party cookie) | Gives your browser an identifier to distinguish visitors | Up to 2 years from your last activity with analytics on. Removed if you withdraw consent. Your browser may shorten this period |
| _ga_TGTGB3645H | Google Analytics, on demandflow.co (first-party cookie) | Keeps track of a visit for our Google Analytics property | Up to 2 years from your last activity with analytics on. Removed if you withdraw consent. Your browser may shorten this period |
| ph_<project key>_posthog | PostHog, on demandflow.co (first-party cookie, local storage and session storage) | Gives your browser a random ID, so PostHog can count visits and tell a new visitor from a returning one | Cookie: 6 months (182 days) from your last visit with analytics on. Local storage copy: until you withdraw consent or clear it. Session storage copy: until you close the tab |
| ph_<project key>_posthog_cpm | PostHog, on demandflow.co (first-party cookie) | Records which of PostHog’s details are kept in its cookie and which in local storage, so the two stay in step | 6 months (182 days) from your last visit with analytics on |
| ph_<project key>_posthog__flags | PostHog, on demandflow.co (first-party, local storage) | Keeps the settings PostHog sends for our site when it loads, so it doesn’t have to ask again on every page | Until you withdraw consent or clear it |
| ph_<project key>_window_id, ph_<project key>_primary_window_exists, ph_<project key>_session_registered_properties | PostHog, on demandflow.co (first-party, session storage) | Tell one browser tab from another and keep the details of the current visit, so pages viewed together count as one visit | Until you close the tab |
| df_internal | Demandflow (first-party, local storage) | Set only when a browser opens the site through a link our team uses to mark its own visits, and analytics is on: marks the visit as ours, so we can leave it out of the figures | Until we turn it off, or analytics is withdrawn |
If you withdraw consent, we remove the analytics cookies and storage listed above. PostHog briefly writes a note of your withdrawal as it stops, and we remove that too. Without the browser identifiers, we may be unable to associate earlier analytics data with you. You can still contact us about that data and your rights.
The analytics cookies’ lifetime is separate from your consent choice. We ask again after six months even if an analytics cookie would otherwise last longer. Analytics stays off until you accept again.
Embedded videos
Our case studies include videos hosted on Vimeo. On larger screens, Vimeo’s player loads by itself once the page has loaded and a video is close to coming into view, and plays it without sound; it doesn’t wait for a choice in the banner. On phones, or if your device is set to reduce motion or save data, it loads only if you press play on a video. We ask Vimeo not to track you (its "do not track" setting), which stops its player collecting viewing analytics. Vimeo still sets the cookies it says are essential, to protect its service from bots; most of them come from Cloudflare, the network Vimeo uses. Vimeo lists them on its player cookies page, and we’ve added the ones we saw the player set:
| Name | Set by | What it does | How long it lasts |
|---|---|---|---|
| player_clearance | Vimeo (third-party) | Vimeo’s bot prevention | 7 days |
| __cf_bm | Vimeo, through Cloudflare (third-party) | Cloudflare’s bot management | 30 minutes |
| cf_clearance | Vimeo, through Cloudflare (third-party) | Cloudflare’s bot prevention | 1 year |
| _cfuvid | Vimeo, through Cloudflare (third-party) | Cloudflare’s rate limiting | Until you close your browser |
| __cf_ob | Vimeo, through Cloudflare (third-party, on player.vimeo.com) | Part of Cloudflare’s protection of Vimeo’s player; neither Vimeo nor Cloudflare describes it in its cookie list | Until you close your browser |
| _cfPre_tabId | Vimeo, through Cloudflare (third-party, session storage on player.vimeo.com) | Part of Cloudflare’s protection of Vimeo’s player | Until you close the tab |
| cf.turnstile.u | Vimeo, through Cloudflare Turnstile (third-party, local storage on challenges.cloudflare.com, inside Vimeo’s player) | Cloudflare’s bot check for Vimeo’s player | Until you clear it |
What we don’t use
No advertising or retargeting cookies, no social media tracking pixels, and no visitor identification tools. Our fonts are served from our own site, so loading a page doesn’t contact a font service. If we add a tool that sets cookies, we’ll add it here before it goes live, and ask again where the law needs your consent.
Questions
Email privacy@demandflow.co.