Effective date: 10 September 2026
This policy explains how Orchard uses cookies and similar browser storage. A cookie is a small value stored by a browser; local and session storage are related technologies covered by the same preference approach. The controller is Synthetic Technology Ltd, registered in England and Wales, company number 17364806, registered office: 66 Paul Street, London, EC2A 4NA.
1. Current inventory
| Name or category | Technology | Purpose | Typical duration | Classification |
|---|---|---|---|---|
PHPSESSID (or the server-configured PHP session name) | First-party cookie | Authentication, session continuity, CSRF protection and account security. | Browser session; authenticated sessions also expire after 30 minutes of inactivity. | Strictly necessary |
orchard_mfa_trust | First-party HTTP-only cookie | Remembers a browser only when an MFA-enabled user requests it. The browser holds a rotating random token; Orchard stores only its hash and allows revocation from Account security. | Up to 30 days, unless revoked or MFA/password settings change first. | Strictly necessary account security |
Cloudflare Turnstile and possible cf_clearance | Third-party security service; a challenge cookie is used only if Cloudflare determines it is necessary | Protects abuse-sensitive public forms from spam, bots and replayed submissions. Turnstile pre-clearance is disabled, which minimises routine cookie use. | Challenge-dependent; any clearance cookie follows Cloudflare's security duration. | Strictly necessary security |
orchard_consent | First-party local storage | Records the consent version, selected categories, an anonymous consent identifier and the time of the choice. This is required to remember and respect the choice. | Orchard requests a fresh choice after 180 days or when the consent version changes; the browser may retain the previous value until it is replaced or cleared. | Strictly necessary preference record |
| Consent event record | First-party server record | Records the anonymous consent identifier, version, categories, event, page path and pseudonymised network/device evidence so Orchard can demonstrate and troubleshoot consent. | Normally up to 24 months. | Strictly necessary compliance record |
| Orchard interface fonts | First-party static WOFF2 files | Provides Orchard's Inter and Plus Jakarta Sans typography. The files are served directly from Orchard and do not contact Google or store an Orchard tracking identifier. The browser may use its ordinary HTTP cache. | Controlled by the browser's ordinary cache and may be cleared through browser settings. | First-party functional asset; no consent required |
| Stripe Climate badge | External embedded frame | Displays Orchard's decorative Stripe Climate contribution badge. It is separate from payments and is not required to use Orchard. | Subject to Stripe's service controls. | Optional functional |
| Orchard tour state | Session and local storage | Remembers progress through an optional product tour and whether it was completed. | Current tab for progress; completion remains until cleared. | Functional |
| Interface preferences | Local storage | Remembers display choices such as collapsed profile sections or table state on the same device. | Until cleared or replaced. | Functional |
2. Classification and consent
Strictly necessary technologies provide security, requested account functions and preference continuity and cannot be disabled through Orchard's control. First-party fonts are functional presentation assets delivered by Orchard without third-party tracking and do not require an optional consent choice. The decorative Stripe Climate badge is the only optional functional resource on the public website and is blocked until functional consent is given. Orchard currently deploys no analytics, marketing or unclassified “other” tracking technology. If that changes, Orchard will update this inventory, change the consent version and request a fresh choice before loading a non-essential technology.
3. User-requested third-party services
Logged-in property workflows may load Google Maps or Places to provide requested address and map functions. Google receives ordinary technical request data and may use storage under its own terms. When a manager deliberately starts subscription Checkout or opens the Billing Portal, Stripe hosts the requested payment service and may set storage necessary for fraud prevention, payment security and transaction continuity. Full card details are entered on Stripe, not Orchard. These transaction technologies are distinct from the optional Stripe Climate badge and are governed by Stripe's notices. Orchard does not use them for advertising.
4. Manage or withdraw a choice
Open Privacy choices from any public page to allow or reject optional functional technologies. The same control remains fixed at the lower-left of public pages. A changed choice is applied immediately; optional resources are disabled when consent is withdrawn. You can also clear cookies and site data in the browser, which signs you out and resets saved preferences. Blocking the necessary session cookie prevents authenticated Orchard features from working.
5. Contact
Questions about cookies may be sent to privacy@orchardpms.com. General information about UK cookie rules is available from the Information Commissioner's Office.