Cookie notice
What Abide.Rent stores on your device, why, for how long, and how to change it. Written for PECR, the UK GDPR and the Data Protection Act 2018. Not legal advice.
Last updated 22 October 2026
Cookies we set
Name, host, who sets it, purpose, life, technology, the PECR basis, and the UK GDPR Article 6 basis. This is the list. If a row is missing, the row is wrong — write and we will add it.
| Name | Host | Category | Purpose | Life | Technology | PECR | UK GDPR |
|---|---|---|---|---|---|---|---|
| rb_cookie_prefsAbide.Rent (first party) | Marketing site | Strictly necessary | Remembers your answer to this notice: that you saw it, and whether you accepted or rejected analytics.When you answer the notice or save settings | 12 months | HTTP cookie (SameSite=Lax; Secure on HTTPS) and first-party localStorage | Strictly necessary to store a preference you were asked for | Art 6(1)(f) legitimate interests — running a PECR-compliant notice |
| rb_accessAbide.Rent (first party) | Signed-in product | Strictly necessary | Keeps you signed in. Holds a short-lived access token. HttpOnly — your scripts cannot read it.Only after you sign in, create an account, or accept an invite | 15 minutes | HTTP cookie, HttpOnly, SameSite=Lax, Secure in production | Strictly necessary for the account service you asked for | Art 6(1)(b) contract |
| rb_refreshAbide.Rent (first party) | Signed-in product | Strictly necessary | Lets the product issue a new access token without asking for the password on every click.Only after you sign in, create an account, or accept an invite | 30 days | HTTP cookie, HttpOnly, SameSite=Lax, Secure in production | Strictly necessary for the account service you asked for | Art 6(1)(b) contract |
| rb_contextAbide.Rent (first party) | Signed-in product | Strictly necessary | Which capacity you are acting in (agent, landlord or tenant).Only after you sign in and a capacity is selected | 30 days | HTTP cookie, HttpOnly, SameSite=Lax, Secure in production | Strictly necessary so dual roles do not join — that is the service | Art 6(1)(b) contract and Art 6(1)(f) legitimate interests — isolation |
| rb_context_idAbide.Rent (first party) | Signed-in product | Strictly necessary | Which organisation or record that capacity is scoped to.Only after you sign in and a capacity is selected | 30 days | HTTP cookie, HttpOnly, SameSite=Lax, Secure in production | Strictly necessary so dual roles do not join — that is the service | Art 6(1)(b) contract and Art 6(1)(f) legitimate interests — isolation |
| cms_sessionAbide.Rent (first party) | Marketing site — /admin only | Strictly necessary | Keeps an Abide.Rent editor signed in to the content editor. Readers never get it.Only when an editor signs in at /admin. Not set for ordinary readers | 14 days | HTTP cookie, HttpOnly, SameSite=Lax, Secure in production | Strictly necessary for the editor sign-in the editor asked for | Art 6(1)(f) legitimate interests — publishing the site securely |
| Host / TLS sessionInfrastructure host | Either host | Strictly necessary | May be set by the host or CDN solely to deliver the page or keep the connection.When the host serves the page. Not used for advertising | Session, or as the host documents | HTTP cookie controlled by the host | Transmission / communication — PECR regulation 6(4)(a) | Art 6(1)(f) legitimate interests — security and delivery |
| _gaGoogle Analytics | Marketing site | Analytics | Distinguishes one browser from another so visits can be counted and grouped.Only after you accept analytics | 2 years | HTTP cookie set by Google's gtag.js | Consent — regulation 6(1) | Art 6(1)(a) consent |
| _ga_<container>Google Analytics | Marketing site | Analytics | Keeps the state of the current visit for this Google Analytics property.Only after you accept analytics | 2 years | HTTP cookie set by Google's gtag.js | Consent — regulation 6(1) | Art 6(1)(a) consent |
Analytics tools
Each tool, what it is for, what it stores, how long it keeps data, who processes it and where. Reject analytics in Cookie settings stops the marketing-site tools; product analytics is chosen in the product, under Your account.
| Tool | Purpose | On your device | Kept | Who processes it | Where | Basis |
|---|---|---|---|---|---|---|
| Google AnalyticsMarketing site | Measures visits and how people move through the site — pages viewed, where visitors came from, and which links and forms are used — so we can improve it. | Cookies _ga and _ga_<container> on this site (2 years). No advertising cookies: advertising storage and personalisation are always refused. | Event data 14 months (the shortest GA4 setting), then deleted; reports keep aggregate totals. | Google Ireland Limited, which acts as a controller of Google Analytics data for its own purposes as well as ours. Google signals and advertising features are off. | Google data centres; may be processed in the United States under Google's standard contractual clauses and the UK Extension to the EU–US Data Privacy Framework | PECR regulation 6(1) consent, given with Accept analytics; UK GDPR Article 6(1)(a) consent. Not loaded until you accept. |
Strictly necessary
Required to show this notice, keep you signed in, and isolate agent, landlord and tenant views. PECR does not require consent for these. They stay on.
Analytics
Google Analytics measures visits and sets cookies, only after you accept analytics; advertising use is always refused. Reject is as easy as accept.
Advertising and marketing
Not in use. We do not set advertising, social or cross-site marketing cookies.
This is the clear and comprehensive information we must give you before storing or accessing information on your device. It is not legal advice.
The law is the Privacy and Electronic Communications (EC Directive) Regulations 2003 (SI 2003/2426) (“PECR”), as amended — including by the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 — and, where a cookie is personal data, the UK GDPR and the Data Protection Act 2018. The Information Commissioner’s Office enforces both. See the ICO’s guide: Cookies and similar technologies.
The privacy notice is the Article 13 notice for personal data. The terms of use are the contract. Cookie settings are in the footer and at the bottom of this page.
1. Who the controller is
Abide.Rent is operated by the company named under “Who we are” on this page (“we”, “us”, “our”). We are the controller for the cookies on this website and the product. Email us at the address under “Who we are” on this page.
2. What we do today
We use strictly necessary cookies and similar storage. We do not set advertising or marketing cookies. We do not embed YouTube, social posts or advertising tags that would set someone else’s cookie. We may also use the analytics tools in section 8. The analytics table on this page is generated from the site’s own settings: a tool is listed there only while it is switched on, and the table says “None in use” when none is.
PECR regulation 6 requires consent unless an exception applies. For strictly necessary storage we rely on regulation 6(4): storage that is strictly necessary to provide a service you asked for, or that is only for transmitting a communication. Helpful-for-us is not enough. A preference cookie that only remembers your answer to this notice falls within that exception. For visit counting only, we rely on the statistical-purposes exception added to regulation 6 by the Data (Use and Access) Act 2025, in force since 5 February 2026: storage or access used only to produce aggregate statistics about how the site is used, so that we can improve it.
Anything that needs consent is named on this page — the cookie, the purpose, the life, and who else can read it — before it is set. The banner offers accept and reject with equal prominence. Optional cookies stay off until you accept. Continued browsing is not consent. We do not treat a privacy policy you never opened as consent. We do not pre-tick a box.
3. How to read the inventory
The table on this page is the inventory. Each row states the name, the host, who sets it, the category, the purpose, how long it lasts, the technology, the PECR basis, the UK GDPR Article 6 basis, and when it is set. Product cookies are not set on the public marketing homepage. They are set only after you ask to sign in, create an account, or accept an invite.
4. What personal data cookies carry
A cookie is personal data under the UK GDPR when it can identify you, alone or with other data we hold. Session tokens identify your account. Context cookies identify the capacity and record you are acting in. The preference record is a device-level choice; we do not join it to your name unless you are signed in on the same browser and we have a reason to. Server logs may still record an IP address when a cookie is sent — see the privacy notice.
rb_access and rb_refresh are HttpOnly. Page scripts cannot read them. They are SameSite=Lax. In production they are marked Secure and travel only over HTTPS. We do not put a password in a cookie.
5. Lawful bases
Two regimes apply at once. PECR decides whether we may set the cookie. The UK GDPR decides whether we may process the personal data it carries.
- Strictly necessary product cookies — PECR regulation 6(4)(b); UK GDPR Article 6(1)(b) contract.
- Isolation cookies (rb_context, rb_context_id) — PECR regulation 6(4)(b), because isolation is the service; UK GDPR Article 6(1)(b) and 6(1)(f) (preventing a dual-role leak).
- Preference cookie — PECR regulation 6(4)(b) for a choice we asked you to record; UK GDPR Article 6(1)(f).
- Host / TLS cookies — PECR regulation 6(4)(a) transmission; UK GDPR Article 6(1)(f).
- Any future optional cookie — PECR consent (regulation 6(1)) and UK GDPR Article 6(1)(a) consent. Withdrawal will be as easy as giving it and will not affect processing before you withdrew.
You have the right to object to legitimate-interest processing. Email us at the address under “Who we are” on this page. We will stop unless we have compelling legitimate grounds that override, or the processing is for a legal claim.
6. Two hosts
The marketing site and the signed-in product are different hosts. A cookie set on one is first-party on that host only. We do not use it as a cross-site advertising identifier. The content editor on the marketing host sets its own sign-in cookie for our editors only; it is not a public page and is not indexed.
7. International transfers
Cookies are sent only to the host that set them. Some of our people work in India and can access account and log data; section 7 of the privacy notice explains how those transfers are protected.
8. Analytics
Visit counting (Plausible), if listed in the analytics table. Plausible counts visits without setting a cookie or storing anything on your device. It works out a daily visitor count from a hash of your IP address and browser with a salt that is deleted every 24 hours, and keeps neither. It gives us totals only — pages, where visitors came from, country and device type — never a profile of you. Plausible is our processor and keeps the data in the EU. Because this is aggregate statistics to improve the site, we rely on the statistical-purposes exception and do not ask for consent. You can object, simply and free of charge: choose Reject analytics in Cookie settings, or send a Global Privacy Control or Do Not Track signal from your browser.
Usage recordings (Microsoft Clarity), if listed. Clarity records how pages are used — clicks, scrolling and the layout of the page — to show us heatmaps and recordings of visits, so we can find pages that are hard to use. Form fields are always hidden. Clarity sets cookies, records individual visits, and Microsoft says it acts as a controller of Clarity data, so Clarity loads only after you choose Accept analytics. We tell Clarity that advertising use is refused. If you later reject analytics, we tell Clarity, and it deletes its cookies from this site.
Product analytics (PostHog), if listed. The signed-in product asks people in agency and landlord accounts whether it may record which pages they open and which steps they finish, and separately whether it may record sessions with every word, typed value and picture hidden. Nothing is recorded until they allow it, the answer can be changed under Your account › Usage analytics, and nothing is recorded in the tenant portal, the platform console or on pages opened from a private link. It identifies people by their internal account numbers, never by name or email. PostHog is our processor and keeps the data in the EU.
A/B testing, advertising, social pixels, fingerprinting for advertising, and cross-site trackers are off. Cookie settings shows each category and whether it is in use.
9. What we do not do
- No pre-ticked boxes.
- No “by using this site you agree to all cookies”.
- No cookie wall that blocks the public legal pages, this notice, or the privacy notice.
- No selling of device identifiers or cookie data.
- No third-party advertising network on these hosts.
- No Google Analytics, Meta pixel, LinkedIn Insight or advertising tags.
- No use of a Global Privacy Control or Do Not Track signal as consent. We honour either signal as a refusal of analytics, on this site and in the product.
10. How to change your choice
Use Cookie settings in the footer or on this page. The panel lists each category, whether it is in use, and whether it is required. Strictly necessary stays on; PECR does not let us offer a site that cannot keep a session. Withdrawing an optional choice will be as easy as giving it. If you rejected optional cookies, we will not ask again for at least six months unless the cookies we use change — that is the ICO’s working guideline, not a lock-in. The preference record lasts up to 12 months. If we add a tool that needs consent, we ask again.
You can also delete cookies in your browser. That will sign you out of the product and forget this notice, so we may show the notice again. “Block all cookies” will break sign-in, because the product cannot keep a session without a strictly necessary cookie. The ICO’s public guide to browser controls is here: ico.org.uk/for-the-public/online/cookies/.
11. Other technologies
PECR covers more than HTTP cookies: local storage, pixels, fingerprinting, SDKs, device identifiers. We do not fingerprint devices for advertising. The marketing site uses first-party localStorage for the same preference record as rb_cookie_prefs, and, if you reject analytics while Plausible is in use, for plausible_ignore, so that Plausible counts nothing from this browser. The signed-in product uses first-party local storage for strictly necessary session purposes, for your answer about usage analytics, and — only if you allow it — for PostHog. The same rules apply. We do not set a tracking pixel on the public pages.
Emails the product sends — invitations, notifications and notices sent by email — contain a small image and tracked links that report whether the email was delivered, opened or clicked. That is how the sender sees whether an email was reported as opened. Section 3 of the privacy notice explains it.
12. Children
The product is not for anyone under 18. We do not set product cookies in order to create an account for a child. If you believe we have, contact us as the privacy notice says.
13. Your rights
Where a cookie is personal data, the UK GDPR rights in the privacy notice apply — including access, rectification, erasure (except a legal hold or a legal obligation), restriction, objection, and the right to complain to the ICO. You can ask for a copy of the preference record we hold for this browser. You are not required to acknowledge the notice to read this page or the privacy notice.
14. Changes
The published version of this page is the current one. The date at the top will change when the substance changes. If we add, rename or extend a cookie, we will update the inventory before we set it — and, for an optional cookie, we will ask again.
15. Complaints
Privacy questions follow the privacy notice. You can complain to us first. You also have the right to complain to the Information Commissioner’s Office about cookies and PECR as well as about the UK GDPR: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. https://ico.org.uk/make-a-complaint/ Telephone 0303 123 1113. You do not have to complain to us before you go to the ICO.