1. About this policy
This Cookie Policy applies to the CostrixIQ website operated by Sequoia Advisory Pty Ltd (ABN 16 662 688 048, ACN 662 688 048). It should be read with our Privacy Policy (https://www.costrixiq.com/privacy), which explains how we manage personal information.
It also explains how the rules differ depending on where you are located. If you are in the European Economic Area or the United Kingdom, clause 6 applies to you.
2. What cookies and similar technologies are
Cookies are small text files stored on a device when a website is visited. We also use, or may use, local and session storage, pixels, tags, scripts, software development kits, device and browser identification techniques and server-side tracking. In this policy, "cookies" means all of those technologies. They can recognise a browser or device, support website functions, remember choices and provide information about how the website is used.
Some technologies are set by us and others are set by service providers acting on our behalf or providing integrated services.
The rules described in this policy apply to the storing of information on, or the gaining of access to information already stored on, your device — whether or not that information is personal information, and whether the technology used is a cookie or something else.
3. The categories we use
| Category | Purpose | Consent requirement |
|---|---|---|
| Necessary | Support core website operation, form delivery, network management, fraud prevention, accessibility and security. | No consent required. These are exempt as strictly necessary for the service you have requested (Article 5(3), ePrivacy Directive 2002/58/EC; and in the United Kingdom, paragraph 4 of Schedule A1 to the Privacy and Electronic Communications (EC Directive) Regulations 2003, together with paragraph 3 of that Schedule where storage or access is needed to transmit a communication). |
| Analytics | Understand visits, page use, navigation, performance and aggregated audience patterns so we can improve the website; and, for HubSpot, link website activity to an enquiry you make so that we can respond to it with context. | Your consent, obtained before the technology is used. In the United Kingdom these may fall within the statistical purposes exception in paragraph 5 of Schedule A1 to the Privacy and Electronic Communications (EC Directive) Regulations 2003, but only where the information is used solely to produce aggregate statistics to improve this website and a simple, free means of objecting is provided. We ask for your consent in any event. |
| Advertising | Measure registrations, subscriptions and demonstration requests, understand campaign effectiveness and support relevant business communications. | Your consent, obtained before the technology is used. This category is never used without consent. |
| Hosting and security | Deliver the website and protect it from automated abuse. These operate at the hosting layer, before our cookie banner runs, and are not a choice offered in the banner. | Not subject to the banner. Cloudflare’s bot protection and challenge cookies are strictly necessary for the security of the website. The hosting platform’s own cookies and its visitor counting are outside our control and are described in clause 4 so that you know they exist. |
4. Providers and the technologies we use
The website is hosted on OpenAI Sites. Cloudflare provides bot protection and security challenges at the hosting layer, and the Turnstile anti-automation check on our forms. We use HubSpot for CRM, forms, subscriptions and website activity, Google Analytics and Google Tag Manager for analytics, and Google Ads and the LinkedIn Insight Tag for campaign measurement and audiences. These providers may place or read their own cookies or similar identifiers when their services are enabled.
The categories work as follows. Hosting and security covers the hosting platform and the Cloudflare protection that sits in front of it, which operate before you make any choice. Necessary covers the Turnstile check on our forms, our own form endpoint and the record of your cookie choices. Analytics covers Google Analytics, Google Tag Manager and HubSpot website tracking. Advertising covers Google Ads and the LinkedIn Insight Tag. Nothing in the Analytics or Advertising categories is loaded until you accept that category.
Our Google Tag Manager container is currently published as an empty container: it contains no tags and no triggers, and it does not itself add any further technology to the website. If that changes we will re-audit the website and update this table.
We review the inventory below before any material change to the website and at least every six months. Cookie names and durations can change when providers update their services, and the exact set of provider cookies can vary with your browser and region.
Two points are worth stating plainly. First, the website is hosted on a platform that records visitor numbers and page views for its own purposes, at platform level. That measurement is not controlled by the choices you make in our cookie banner, and the platform does not publish the fields it records or how long it keeps them. Second, if you submit one of our forms, the information in that form, together with the page you submitted it from and your current cookie choices, is sent to our own server and then to HubSpot regardless of those choices — because you asked us to contact you. Your cookie choices do not affect our ability to respond to you.
The technologies used on the website are:
| Name | Set by | Purpose | Category | Duration |
|---|---|---|---|---|
| __cf_bm | Cloudflare, at the hosting layer | Bot protection for the website itself. Present before you make any choice in our cookie banner, because it operates at the hosting layer rather than on our pages. Cloudflare states that it expires after 30 minutes of inactivity. Its configuration is not set by us. | Hosting and security | 30 minutes of inactivity |
| cf_clearance | Cloudflare, at the hosting layer | Records that a security challenge has been passed so that you are not challenged again. Present before you make any choice in our cookie banner. Set with a partition key for this website only. | Hosting and security | Observed at about one year |
| __Host-appgarden-visitor, __Host-chatgpt_sites_session and chatgpt_sites_siwc_session | OpenAI Sites (hosting platform) | Cookies set by the hosting platform. They were observed on our pre-launch site, which required a sign-in; the platform has not confirmed whether it sets them for ordinary public visitors or what each is used for. None of them can be read or altered by our page scripts. Separately, the platform counts unique visitors and page views for its own analytics view. That counting is not governed by the choices you make in our cookie banner and we cannot switch it off. We do not treat it as strictly necessary and we do not use it. | Hosting and security | Observed at about 90 days and about 13 months |
| cf.turnstile.u | Cloudflare (browser storage) | Browser storage on Cloudflare’s challenge domain, which we understand holds state for the Turnstile anti-automation check on our forms. Present before you make any choice in our cookie banner. Cloudflare has not published its exact function or lifetime. | Necessary | Not published by the provider |
| costrixiq_cookie_consent_v2 | CostrixIQ (browser storage) | Stores a version number for the record format, your choice for each category and the date and time you made it, in your browser only, so that your choices can be applied on later visits. We do not hold a copy of this record. | Necessary | Until you change or clear it |
| _ga and _ga_Y8WF1LWX65 | Google Analytics | Distinguishes visitors and persists session state so that we can measure visits, page use and navigation. | Analytics | Google states 2 years; observed at about 13 months, the limit current browsers apply |
| __hstc | HubSpot | Main visitor tracking cookie, recording the visitor, the session and the timestamps of the first, previous and current visit. | Analytics | 6 months |
| hubspotutk | HubSpot | Opaque visitor identifier, passed to HubSpot when a form is submitted so an enquiry can be matched to earlier activity. | Analytics | 6 months |
| __hssc | HubSpot | Tracks the current session and page views within it. | Analytics | 30 minutes |
| __hssrc | HubSpot | Records whether the browser has been restarted, so that a new session can be started. | Analytics | Browser session |
| _gcl_au | Stores advertising click and campaign attribution information used for conversion and campaign measurement. | Advertising | 90 days | |
| _gcl_ls | Google (browser storage) | Conversion Linker browser storage for advertising click information. | Advertising | No fixed expiry; removed when you withdraw Advertising |
| IDE and test_cookie | Google (doubleclick.net) | Google advertising identifiers set on Google’s own domain when the Google Ads tag loads, used for ad measurement and audiences. | Advertising | IDE about 13 months; test_cookie about 15 minutes |
| li_adsId | LinkedIn (browser storage) | First-party LinkedIn advertising identifier used for conversion tracking. | Advertising | No fixed expiry; removed when you withdraw Advertising |
| bcookie and lidc | LinkedIn (provider domains) | Browser identification for abuse detection and diagnostics, and data centre selection. | Advertising | bcookie 1 year; lidc 24 hours |
| UserMatchHistory, AnalyticsSyncHistory and li_sugr | LinkedIn (provider domains) | Identifier synchronisation for advertising and analytics, and probabilistic identity matching. | Advertising | UserMatchHistory 30 days; AnalyticsSyncHistory 30 days; li_sugr 90 days |
| __cf_bm (on LinkedIn’s and HubSpot’s own domains) | Cloudflare, for those providers | Bot-protection cookie set by LinkedIn’s and HubSpot’s own delivery networks when their scripts load. Distinct from the __cf_bm at the top of this table, which belongs to the website itself. | Advertising (LinkedIn); Analytics (HubSpot) | About 30 minutes |
The Analytics and Advertising entries appear only if you accept that category. Every cookie and storage entry in the table was observed on the pre-launch version of this website in testing completed on 8 September 2026, in which each consent choice, each withdrawal and ordinary navigation were recorded and the cookies and browser storage present in each state were catalogued. Durations are as observed in that testing, or as stated by the provider where marked. We repeat the check on the public address after launch, and whenever the website, our providers or our tag configuration change.
One further item is not stored on your device and so is not in the table. When you submit one of our forms, the Turnstile check produces a short-lived, single-use token that our server sends to Cloudflare, together with your IP address, to confirm the submission is genuine.
The providers also list further cookies that their services may set in some browsers or circumstances and that did not appear in our testing. For Google these are _gid, _gat, _gac_* and _gcl_aw. For HubSpot they are __hmpl and hublytics_events_53, and __cfruid and __cfuvid on HubSpot’s own delivery network. For LinkedIn they are bscookie, JSESSIONID, lang, sdsc, li_gc, li_mc, li_fat_id, li_giant, lms_ads, lms_analytics, _guid, ar_debug, ln_or, oribi_cookie_test, oribili_user_guid, UID (set by Scorecard Research, up to 720 days) and BizographicsOptOut (up to ten years, recording that a non-member has opted out of LinkedIn advertising). Each belongs to the same category as the provider’s cookies in the table and is loaded only if you accept that category.
The duration shown above is how long the cookie or storage entry stays on your device. It is not the same as how long the provider keeps the information it collected through it. Those separate retention periods are set out in the "How we protect and retain information" section of our Privacy Policy. Removing a cookie from your device does not recall information a provider has already received.
Where a category is set to appear, the relevant scripts are not requested at all until you accept it. Google is instructed that analytics storage, advertising storage, advertising user data and advertising personalisation are all denied before any Google tag is permitted to load. Because the Google libraries themselves are not loaded until you accept the matching category, the website does not send Google measurement signals about you before you have made a choice.
The website also records a small number of named events, such as opening or submitting a form. Those events are not recorded at all unless you have accepted Analytics or Advertising. Optional technologies are loaded only on our own website addresses; if the site is reached through any other address, none of them load.
5. Your choices
Where consent is required, we ask for it through a consent banner before any non-essential technology is used. The banner lets you accept all, reject all, or choose category by category. Rejecting is as straightforward as accepting, no category is pre-selected, and no non-essential technology is used unless and until you accept it. Continuing to browse, scrolling, or closing the banner is not treated by us as consent.
The banner offers "Accept all", "Reject optional" and "Manage preferences". You can change or withdraw your choices at any time through the "Cookie settings" link in the website footer. Withdrawing consent is as easy as giving it. We record the consent policy version, your choice for each category and the date and time you made it, and we will ask you again if the technologies we use change materially — for example if we add a new provider or a new purpose.
If you withdraw a category, the scripts in that category are not loaded again, the matching cookies we can reach are set to expire, and the page reloads without them. We cannot delete cookies that a provider has set on its own domain, and we cannot recall information a provider has already received. To remove those, use your browser controls or Google’s and LinkedIn’s own opt-out tools, which are listed in our Privacy Policy.
You can also control or delete cookies using your browser settings. Blocking some technologies may affect website functions or prevent preferences from being remembered. Browser controls vary, so consult the help information provided by your browser.
6. How the rules apply where you are located
European Economic Area: we obtain your consent before any technology that is not strictly necessary is used, in accordance with Article 5(3) of the ePrivacy Directive (2002/58/EC) as implemented in your country and the consent standard in the GDPR. Consent must be a clear affirmative act.
United Kingdom: the same approach applies. Since 5 February 2026 the exemptions sit in Schedule A1 to the Privacy and Electronic Communications (EC Directive) Regulations 2003. Paragraph 4 covers technologies that are strictly necessary for the service you have asked for, and paragraphs 5 and 6 permit certain statistical and appearance or functionality technologies to be used without consent where we give clear information and a simple, free means of objecting. Advertising and conversion technologies always require your consent.
Australia and other locations: cookies are not separately regulated, but where a cookie collects personal information we handle that information in accordance with our Privacy Policy (https://www.costrixiq.com/privacy). You can still manage your choices through the cookie settings.
United States: please also see the section on United States residents in our Privacy Policy.
7. Duration
Session cookies generally expire when the browser is closed. Persistent cookies remain for a defined period or until deleted. The duration for each technology we use is set out in the table in clause 4.
Your cookie choices are kept until you change or clear them. We do not ask again on a fixed cycle, but we will ask again if the technologies we use change materially. You can change or withdraw a choice at any time through the "Cookie settings" link in the website footer. Apart from the record of your own cookie choices, which stays until you change or clear it, the longest durations are set by the providers themselves and apply only if you accept the relevant category — except for the hosting and security cookies, which are present whether or not you accept any category. The longest we observed were about 13 months, for the Google Analytics cookies, Google’s IDE cookie and two of the hosting platform’s cookies, and about one year, for LinkedIn’s bcookie and Cloudflare’s cf_clearance. Of the further cookies the providers list, the longest are LinkedIn’s BizographicsOptOut at ten years, which exists to record that someone has opted out of LinkedIn advertising, and Scorecard Research’s UID at 720 days.
8. Overseas processing
Some technology providers operate globally and may process cookie and device information outside Australia, including in the United States and other locations where they or their sub-processors operate. See the overseas processing section of our Privacy Policy (https://www.costrixiq.com/privacy) for more information.
Where information collected through these technologies is transferred out of the European Economic Area or the United Kingdom, we rely on the safeguards described in the overseas processing section of our Privacy Policy.
9. Changes to this policy
We may update this policy when our website, providers or legal requirements change. The latest version will be published here with its updated date.
10. Contact
Questions about cookies or privacy can be sent to our Privacy Officer at privacy@costrixiq.com. Contact details for our representatives in the European Union and the United Kingdom are set out in our Privacy Policy.