go2media

Privacy & cookies

Last updated: 17 October 2026

go2media is a UK digital consultancy in Edinburgh. This page says what go2media.co.uk collects, why, and how to change the analytics choice. This page is not legal advice.

Who we are

For the personal data described here, the controller is Go2Media. The contact address is info@go2media.co.uk.

TODO for Lyle: Add the registered company name and number, and the ICO registration number, if you want them published. They are not in the site code, so this page does not list them.

The enquiry form

The homepage has a contact form. It asks for your name, email address and a message. Name is required and is limited to 100 characters. Email is required. The message is required, at least 10 characters, and limited to 5,000 characters.

The form also has a hidden field called “website”, meant to be left blank. If that field is filled in, the server rejects the enquiry and the page shows an error instead of the thank-you message. That check is there to block automated submissions. It is part of sending the form, not advertising or analytics, and it does not wait for the cookie banner.

We use your name, email and message to read the enquiry and reply. The thank-you message says we will get back to you within 2 days.

The reason we are allowed to use the enquiry is steps toward a contract: you asked us to look at a possible piece of work and reply.

The site code does not send your name, email or message to Google or Microsoft. Analytics, if you have accepted them, are a separate choice.

TODO for Lyle: Once Tag Manager is in use, check that no tag is set up to collect the enquiry form fields. This repository cannot see tags published in the Tag Manager account.

Where the enquiry goes

The server does three things with a valid enquiry. None of them depend on the cookie banner.

It saves a row in a Supabase table called contact_submissions. The row stores a random id, your name, email and message. The table also has a created_at time. The site code does not set that time, so the database fills it in. The Supabase address comes from the server setting SUPABASE_URL. On Lovable (Cloudflare) the insert can use a service-role key when SUPABASE_SERVICE_ROLE_KEY is set. On the Node host it uses SUPABASE_PUBLISHABLE_KEY.
It emails info@go2media.co.uk with your name, email and message, and sets reply-to to the address you typed. Mail is sent over SMTP with TLS. The host, port, username and password come from SMTP_HOST, SMTP_PORT, SMTP_USER and SMTP_PASSWORD. The visible from-name is “go2media”, and the from address is the SMTP username. Cloudflare Workers use the worker-mailer library. The Node app (Hostinger) uses Nodemailer.
It sends you a short thank-you at the address you typed. That email includes your name and says we will reply within 2 days.

If both the database save and the email to info@go2media.co.uk fail, the form asks you to try again. If either one succeeds, you see the thank-you. A failed thank-you email does not by itself show an error. Failures are written to the server log with the enquiry id.

One network address can send 5 enquiries in 15 minutes. The address is taken from cf-connecting-ip, or the first x-forwarded-for value, or x-real-ip. That count lives in the server’s memory only. It is not saved on the enquiry row, and it is forgotten when the server process restarts.

TODO for Lyle: Confirm how long enquiry rows in Supabase are kept, and how long the emails are kept. The code does not delete them.

TODO for Lyle: Confirm the live SMTP host. A September 2026 plan names Hostinger on port 465, with the from address notify@go2media.co.uk. The running code uses whatever SMTP_HOST, SMTP_PORT and SMTP_USER are set to, and does not hard-code those values.

TODO for Lyle: Say whether mail to info@go2media.co.uk is forwarded to another inbox, such as Gmail. The site code only shows the send to that address.

TODO for Lyle: Confirm which Supabase region stores contact_submissions, and link the Supabase terms you rely on.

Cookies and analytics

A banner asks: “We use cookies to improve the site. Is that OK?” Nothing is loaded from Google or Microsoft, and those services do not get a chance to set cookies, until you click Accept. Reject is the same size as Accept. The banner is shown until you choose, whether or not a Tag Manager or Clarity id is set. If an id is missing, Accept still remembers your choice and that tool simply does not load. The rest of the site works either way.

Before any Google script runs, the page sets Google Consent Mode v2 to denied for analytics storage and for advertising storage (ad_storage, ad_user_data and ad_personalization). Functionality and personalisation storage are denied as well. Security storage is granted. That signal is the usual way to allow a cookie that protects the connection. This site’s own code does not set one.

Accept calls gtag('consent', 'update', …) with analytics_storage set to granted. Advertising storage stays denied. Reject sets analytics storage back to denied.

Google Tag Manager and Google Analytics 4

Google Tag Manager loads only after Accept, and only when the site was built with VITE_GTM_ID set to a container id such as GTM-XXXXXXX. The script comes from googletagmanager.com. This site does not hard-code a Google Analytics 4 measurement id. GA4, if you add it, is a tag inside that container. Tags in the container can change without a change to this website.

When a GA4 tag runs it can set _ga and _ga_* cookies. Reject, or a later withdrawal, does not load Tag Manager on later pages. Where the browser lets us, we delete _ga and _ga_* cookies for this site. A tag that has already started on the open page may write them again until the next load.

TODO for Lyle: Add the live GTM container id here once it is set, and note the date you last checked which tags are published. This repository does not contain a container id.

TODO for Lyle: Confirm that GA4 is the analytics tag you want, the property’s data retention, whether Google signals are off, and that Google’s data processing terms are accepted.

Microsoft Clarity

After Accept, and only when the build has VITE_CLARITY_ID set, the site loads Microsoft Clarity from clarity.ms. Clarity is loaded by this site’s own code, not by a Tag Manager tag, so a withdrawal can tell Clarity to stop. Before the script loads, the site tells Clarity that analytics storage is granted and advertising storage is denied. Clarity is used for session recordings and heatmaps. Microsoft says it masks sensitive inputs by default.

Reject, or a later withdrawal, calls clarity('consent', false) and deletes the _clck and _clsk cookies on this site. CLID, MUID, ANONCHK, MR and SM are set on Microsoft domains. This site cannot delete those. You can clear them in the browser.

TODO for Lyle: Confirm the Clarity project id, the masking settings, where recordings are stored, and that Microsoft’s data processing terms are accepted. The id is not written here because it comes from the build setting.

What is stored

Names below are what this site’s code can set, plus the GA4 and Clarity cookies those products document. GA4 cookies appear only after a GA4 tag is actually published.

Name	Provider	Purpose	Duration
go2media_analytics_consent	go2media	Remembers Accept or Reject. This is localStorage, not a cookie. It is written only after a click. Values are granted or denied.	No expiry is set in the code. It stays until site data for this browser is cleared.
_ga	Google Analytics 4, via Tag Manager	After Accept only, and only if a GA4 tag is published in the Tag Manager container. Distinguishes browsers so visits can be counted.	Google’s published default is 2 years. The GA4 property can use a shorter time. TODO for Lyle: confirm the retention setting once the property exists.
_ga_*	Google Analytics 4, via Tag Manager	After Accept only, if a GA4 tag is published. The * stands for the measurement id. Used to keep session state.	Google’s published default is 2 years. TODO for Lyle: confirm the property setting once GA4 is added.
_clck	Microsoft Clarity	After Accept only, if a Clarity project id is set for the build. First-party cookie. Stores a Clarity user id for this site. Microsoft’s list: learn.microsoft.com/en-us/clarity/setup-and-installation/clarity-cookies.	TODO for Lyle: Microsoft’s public cookie table no longer lists durations. Their older list said about a year. Reject deletes this cookie on this site.
_clsk	Microsoft Clarity	After Accept only. First-party cookie. Connects page views into one Clarity recording.	TODO for Lyle: confirm the current lifetime. Microsoft’s older list said about a day. Reject deletes this cookie on this site.
CLID	Microsoft Clarity	After Accept only. Third-party cookie. Identifies the first time Clarity saw this browser on any site using Clarity.	TODO for Lyle: confirm the current lifetime. Set on a Microsoft domain, so this site cannot delete it.
MUID	Microsoft	After Accept only. Third-party cookie. Identifies the browser across Microsoft sites. Microsoft uses it for advertising, analytics and operations.	TODO for Lyle: confirm the current lifetime. This site cannot delete a cookie on Microsoft’s domain.
ANONCHK	Microsoft	After Accept only. Third-party cookie. Indicates whether MUID is transferred to ANID, a cookie used for advertising. Clarity’s own note says it does not use ANID, so this flag is 0.	TODO for Lyle: confirm the current lifetime. This site cannot delete it.
MR	Microsoft	After Accept only. Third-party cookie. Indicates whether to refresh MUID.	TODO for Lyle: confirm the current lifetime. This site cannot delete it.
SM	Microsoft	After Accept only. Third-party cookie. Used to synchronise MUID across Microsoft domains.	TODO for Lyle: confirm the current lifetime. This site cannot delete it.

Changing your choice

The footer has Cookie settings. It opens the same banner. Accept or Reject replaces the previous choice. Reject after an earlier Accept sets analytics storage back to denied, does not load Tag Manager or Clarity on later pages, tells Clarity that consent is withdrawn, and clears the Clarity and _ga cookies this site can see. The go2media consent record itself stays in localStorage until you clear site data.

You can also block or delete cookies in your browser.

Your UK GDPR rights

You can ask us to:

Tell you whether we hold personal data about you, and for a copy of it.
Correct it.
Delete it.
Restrict how we use it, or object to a use that is not required to answer you.
Receive data you gave us, in a portable form, where the law requires that.

UK GDPR usually gives an organisation one month to respond. Write to info@go2media.co.uk. That address is the data protection contact. You can complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint. No ICO registration number is listed here.

Who else handles this data

Supabase stores the enquiry rows.
The SMTP provider sends the enquiry emails and the thank-you.
Google receives analytics after you click Accept, if Tag Manager and a GA4 tag are configured.
Microsoft Clarity records sessions after you click Accept, if a Clarity id is configured.

TODO for Lyle: Name the Supabase region and the SMTP provider in this list once you have confirmed them. Do not assume Gmail forwarding unless you have checked the mailbox.

Contact

Email info@go2media.co.uk.