Cookie policy

Essential

Needed to run the store: your cart, sign-in, checkout hand-off, security, error monitoring and remembering these choices. Always on.

Middleton Mixology (this site)

Keeps your cart, your sign-in session, your privacy choices, whether you are visiting from the United States, your wishlist, your recently viewed products and banners you have dismissed.

Storage: Cookies cartId, mm_auth, mm_auth_refresh, mm_auth_token, mm_auth_state, mm_consent (180 days), mm_region (session), mm_wishlist, mm_recently_viewed; browser storage for dismissed banners and for the campaign attribution described below.

Shopify

Provides the product catalogue, the cart, customer accounts and the checkout at shop.middletonmixology.com.

Storage: Shopify sets its own cookies on the checkout and account pages it hosts.

Cloudflare

Network security and delivery. Tells us the country a request comes from, and runs the bot check on the contact form when that check is enabled.

Storage: Cloudflare may set security cookies.

Vercel

Hosts this site. Its cookieless measurement is described separately below.

Storage: None set by hosting.

Upstash

Rate limiting for forms and cart requests, to block abuse. Uses the IP address of the request.

Storage: None in your browser.

Sentry

Error and performance monitoring. Receives technical reports: the page address, browser details and the error.

Storage: None in your browser.

Analytics

Measures how the site is used, such as pages viewed and products added to a cart, so we can improve it.

Google Analytics 4

Measures page views and shopping actions such as viewing a product, adding to a cart and starting checkout. It recognises a browser by a random id. Our Google Analytics property is linked to our Google Ads account.

Storage: Cookies _ga and _ga_<id>.

Marketing and targeted advertising

Measures our advertising, builds advertising audiences, and recognises returning visitors, business visitors and email subscribers. Turning this off opts this browser out of targeted advertising on this site, including any sale or sharing of personal information for advertising as some US state privacy laws define those terms.

Signing up for our emails does not depend on this category. While it is off, the signup form sends Klaviyo only the email address you enter.

Google Ads

Measures results of our Google ads (for example an add to cart after an ad click) and builds advertising audiences.

Storage: Cookies starting _gcl_.

Meta (Facebook and Instagram) pixel

Records page views, product views and add-to-cart actions so Meta can measure our ads and build advertising audiences.

Storage: Cookies _fbp and _fbc.

Klaviyo

Email marketing. Its script records pages and products viewed and can link them to an email profile once a visitor is known to Klaviyo. While this category is on it also displays our email signup form; while it is off we show our own form, which sends Klaviyo only the email address you enter.

Storage: Cookie __kla_id.

HubSpot

Customer relationship management. Its tracking code records visits and links them to a contact when a form is submitted.

Storage: Cookies __hstc, hubspotutk, __hssc and __hssrc.

Apollo

Website visitor identification for business sales. Apollo matches visits against its database of companies and business contacts.

Storage: A first-party cookie set by Apollo.

OpenAI Ads

Measures results of our ads in ChatGPT from actions taken on this site.

Storage: Set by the OpenAI Ads pixel.

GoAffPro (affiliate referrals)

If you arrive from an affiliate link, the affiliate code is kept and attached to your cart so the affiliate can be credited for an order. The code identifies the affiliate, not you.

Storage: Cookie ref (30 days).

Session replay

Records how pages are used (mouse movement, clicks, scrolling and the page content shown) so we can find usability problems. Microsoft states that text typed into form fields is masked before it leaves the browser.

Microsoft Clarity

Records how pages are used (mouse movement, clicks, scrolling and the page content shown) as session replays and heatmaps. We send Clarity your marketing choice as its advertising-storage signal.

Storage: Cookies _clck and _clsk, and Microsoft cookies CLID, ANONCHK, MR, MUID and SM.

Not controlled by the categories above

These run for every visitor, whatever choices are saved. We list them so the picture is complete.

Vercel Web Analytics and Speed Insights

Counts page views and site events and measures page speed. Vercel states that it uses no cookies and recognises a visit by a hash of the request that is discarded after 24 hours. We remove query parameters other than campaign (utm) fields from the page address before it is sent.

Storage: None.

YouTube (Google)

Embedded videos. Most load only when you press play; the home page video and the videos on the "How to smoke a cocktail" and "Meet James" pages load with the page. YouTube receives your IP address and browser details when a video loads.

Storage: Set by YouTube when a video loads.

Shopper Approved

Displays customer ratings and reviews on the home, shop, product and reviews pages. Shopper Approved receives your IP address and browser details when a widget loads. After an order we also send it your name, email address and the products bought so it can ask you for a review.

Storage: Set by Shopper Approved when a widget loads.

Foursixty

Displays a gallery of customer photos on the home page when that gallery is switched on. Foursixty receives your IP address and browser details when it loads.

Storage: Set by Foursixty when the gallery loads.

How the Google tag is handled

Google Analytics and Google Ads use the same Google tag but are controlled separately: Google Analytics by the analytics category and Google Ads by the marketing category. We pass your choices to Google through Consent Mode (analytics storage follows analytics; ad storage, ad user data and ad personalization follow marketing). We do not set up the Google tag for a category that is off, and with both categories off the tag is not requested at all, so the "cookieless pings" that Consent Mode can otherwise send for a denied category are not sent. If analytics is on and marketing is off, Google Analytics runs with the three advertising signals denied.

Session replay and what is recorded

Microsoft Clarity records how a page is used, including the content shown on the page. Microsoft states that text typed into form fields and drop-down menus is masked before it leaves your browser. We additionally mark your account page, your order confirmation page and the chat assistant as masked. Payment details are entered on Shopify's checkout, where this site does not load Clarity.

Campaign attribution

When you arrive from a campaign link, we keep the campaign fields (the utm_ values), the path of the page you landed on and the address of the referring site without its query string in your browser for the tab session, and attach them to a form you submit to us. An advertising click id (for example gclid or fbclid) and an affiliate referral code are kept and passed on only while the marketing category is on, and are removed when you switch it off.

Checkout on Shopify

Checkout and customer accounts are hosted by Shopify at shop.middletonmixology.com. Shopify, and the sales channel and marketing apps connected to our Shopify store, use their own cookies and tracking there. Those follow the privacy settings of Shopify's checkout. The choices you save on this site are not passed to the Shopify checkout.

Email and text messages

Your privacy choices here never subscribe you to email or text messages, and you can sign up for our emails whatever you choose here. Email and text messages are covered by the consent you give on a signup form, and you can unsubscribe at any time.