Cookie Policy
Last updated: September 5, 2026
This Cookie Policy explains what cookies and similar technologies the ERP Research website at www.erpresearch.com (the "Site") uses, why we use them, and how you can control them. The tables below are generated from our own source code, so they list what the Site actually sets rather than what we remember setting.
1. What Are Cookies?
Cookies are small text files placed on your device by a website. They are widely used to make websites work, remember your preferences, and tell the site operator how the site is used. Some cookies are "first-party" (set by the site you are visiting) and others are "third-party" (set by an external service the site uses). The same rules apply to related technologies such as local storage and tracking scripts, and we cover those here too.
2. The Three Categories
Every cookie and script on the Site falls into one of three categories. You choose the two optional ones; essential is always on because the Site cannot work without it.
- Essential — Needed for the site to work — signing in, security, remembering your cookie choice and which country's rules apply. Always on.
- Analytics — How the site is used: page views, clicks, A/B tests and masked session replay. Off until you allow it.
- Marketing — Campaign measurement and identification for our email and advertising tools. Off until you allow it.
Nothing in the Analytics or Marketing categories runs before you choose. Google Analytics loads with Google Consent Mode set to denied and measures nothing; PostHog is initialised opted out, with session replay off; the lemlist visitor script is not requested at all. Choosing "Reject non-essential" keeps all of that off — it is a real refusal, not a dismissal of the banner.
3. Cookies and Similar Storage
Generated from the codebase on 2026-09-05. Third-party cookies are marked with their provider.
| Cookie | Provider | Category | Purpose | Lifetime |
|---|---|---|---|---|
erp_cookie_consent | ERP Research | Essential | Stores your cookie choices (which categories you allowed), the time you made them and the policy version, so we can honour them and evidence them. | 1 year |
erp_geo | ERP Research | Essential | Your country, derived by our hosting provider from your IP address. Drives the currency shown and which data-protection rules apply to our forms. Never stored in our database. | 24 hours |
erp_gpc | ERP Research | Essential | Records that your browser sent a Global Privacy Control signal, so any enquiry you submit is marked as opted out of sharing with partners. | Session |
prefer-locale | ERP Research | Essential | Remembers which regional version of the site you chose to read. | 30 days |
erp_benchmark_token | ERP Research | Essential | Signs you in to a benchmark report you have access to. HttpOnly; not readable by scripts. | 90 days |
signals_session | ERP Research | Essential | Signs you in to the Signals dashboard. HttpOnly. | 30 days |
sb-*-auth-token | Supabase | Essential | Signs you in to the partner portal and the requirements wizard. Set by our authentication provider on our own domain. | Session, refreshed while you stay signed in |
erp_vid | ERP Research | Essential | A random visitor ID that lets us count visits without a name attached. Until you allow analytics it is a session cookie that is deleted when you close your browser, and it is never joined to your identity or to any other visit. | Session before consent; 90 days after you allow analytics |
erp_vid_scope | ERP Research | Essential | Records which kind of visitor ID you have (session-only or 90-day), so our own systems never treat a pre-consent ID as a durable profile. | Matches erp_vid |
erp_ab | ERP Research | Analytics | Which version of an A/B test you were shown, so the page stays consistent between visits. Not set unless you allow analytics — visitors who decline always see the default version. | 30 days |
ph_*_posthog | PostHog (EU region) | Analytics | Product analytics: which pages you viewed and which buttons you used, plus session replay of your visit with all text and form inputs masked. Nothing is captured or stored until you allow analytics. | 1 year |
_ga, _ga_* | Google Analytics 4 (third party) | Analytics | Aggregate traffic measurement. Google Consent Mode starts denied for everyone; these cookies are only written once you allow analytics. Google Signals and ad personalisation are switched off. | Up to 2 years |
erp_utm | ERP Research | Marketing | The campaign that first brought you to the site, so we can tell which marketing works. Not set unless you allow analytics. | 30 days |
lemlist visitor cookies | lemlist (third party) | Marketing | Identifies return visits for our outbound email campaigns. The script is not loaded at all unless you allow marketing. | Set by lemlist; typically up to 1 year |
__stripe_mid, __stripe_sid | Stripe (third party) | Essential | Fraud prevention on the checkout page. Only set on pages where you are actually paying us. | 1 year / 30 minutes |
erp_cookie_consentEssential
Stores your cookie choices (which categories you allowed), the time you made them and the policy version, so we can honour them and evidence them.
ERP Research · 1 year
erp_geoEssential
Your country, derived by our hosting provider from your IP address. Drives the currency shown and which data-protection rules apply to our forms. Never stored in our database.
ERP Research · 24 hours
erp_gpcEssential
Records that your browser sent a Global Privacy Control signal, so any enquiry you submit is marked as opted out of sharing with partners.
ERP Research · Session
prefer-localeEssential
Remembers which regional version of the site you chose to read.
ERP Research · 30 days
erp_benchmark_tokenEssential
Signs you in to a benchmark report you have access to. HttpOnly; not readable by scripts.
ERP Research · 90 days
signals_sessionEssential
Signs you in to the Signals dashboard. HttpOnly.
ERP Research · 30 days
sb-*-auth-tokenEssential
Signs you in to the partner portal and the requirements wizard. Set by our authentication provider on our own domain.
Supabase · Session, refreshed while you stay signed in
erp_vidEssential
A random visitor ID that lets us count visits without a name attached. Until you allow analytics it is a session cookie that is deleted when you close your browser, and it is never joined to your identity or to any other visit.
ERP Research · Session before consent; 90 days after you allow analytics
erp_vid_scopeEssential
Records which kind of visitor ID you have (session-only or 90-day), so our own systems never treat a pre-consent ID as a durable profile.
ERP Research · Matches erp_vid
erp_abAnalytics
Which version of an A/B test you were shown, so the page stays consistent between visits. Not set unless you allow analytics — visitors who decline always see the default version.
ERP Research · 30 days
ph_*_posthogAnalytics
Product analytics: which pages you viewed and which buttons you used, plus session replay of your visit with all text and form inputs masked. Nothing is captured or stored until you allow analytics.
PostHog (EU region) · 1 year
_ga, _ga_*Analytics
Aggregate traffic measurement. Google Consent Mode starts denied for everyone; these cookies are only written once you allow analytics. Google Signals and ad personalisation are switched off.
Google Analytics 4 (third party) · Up to 2 years
erp_utmMarketing
The campaign that first brought you to the site, so we can tell which marketing works. Not set unless you allow analytics.
ERP Research · 30 days
lemlist visitor cookiesMarketing
Identifies return visits for our outbound email campaigns. The script is not loaded at all unless you allow marketing.
lemlist (third party) · Set by lemlist; typically up to 1 year
__stripe_mid, __stripe_sidEssential
Fraud prevention on the checkout page. Only set on pages where you are actually paying us.
Stripe (third party) · 1 year / 30 minutes
The visitor ID before you choose
erp_vid deserves a note of its own. Until you allow analytics it is a session cookie: it is deleted when you close your browser, and we never join it to your name, your email, or any other visit. Only when you allow analytics does it become a 90-day identifier. That means a visit made before you chose can never be connected to you retrospectively.
4. Scripts, Embeds and Third Parties
These load in your browser and can see your IP address and the page you are on, whether or not they set a cookie.
| Service | Host | Category | Purpose | When it loads |
|---|---|---|---|---|
| Google Analytics 4 | www.googletagmanager.com / www.google-analytics.com | Analytics | Traffic measurement. | Loads on every page with Consent Mode set to denied; measures nothing and writes no cookies until you allow analytics. |
| PostHog (EU region) | erpresearch.com/ingest (proxied to eu.i.posthog.com) | Analytics | Product analytics and masked session replay. | Initialised opted-out; captures nothing until you allow analytics. |
| lemlist | app.lemlist.com | Marketing | Visitor identification for outbound email campaigns. | Not requested at all unless you allow marketing. |
| Sentry | sentry.io | Essential | Error monitoring. IP addresses, headers and cookies are not attached to error reports. Session replay of an error is only armed if you allow analytics. | On every page, for crash reporting. |
| YouTube / Vimeo / Loom | www.youtube-nocookie.com, player.vimeo.com, www.loom.com | Marketing | Video playback on partner profiles and case studies. | Only after you click play on that specific video. |
| Cal.com | app.cal.com | Essential | Booking a consultation call. | Only after you click to load the booking calendar. |
| Google Calendar | calendar.google.com | Essential | Booking a call after a partner listing enquiry. | Only after you click to load the calendar. |
| Stripe | js.stripe.com | Essential | Payment processing and fraud prevention. | Only on partner-portal checkout pages. |
Google Analytics 4Analytics
www.googletagmanager.com / www.google-analytics.com
Traffic measurement.
Loads on every page with Consent Mode set to denied; measures nothing and writes no cookies until you allow analytics.
PostHog (EU region)Analytics
erpresearch.com/ingest (proxied to eu.i.posthog.com)
Product analytics and masked session replay.
Initialised opted-out; captures nothing until you allow analytics.
lemlistMarketing
app.lemlist.com
Visitor identification for outbound email campaigns.
Not requested at all unless you allow marketing.
SentryEssential
sentry.io
Error monitoring. IP addresses, headers and cookies are not attached to error reports. Session replay of an error is only armed if you allow analytics.
On every page, for crash reporting.
YouTube / Vimeo / LoomMarketing
www.youtube-nocookie.com, player.vimeo.com, www.loom.com
Video playback on partner profiles and case studies.
Only after you click play on that specific video.
Cal.comEssential
app.cal.com
Booking a consultation call.
Only after you click to load the booking calendar.
Google CalendarEssential
calendar.google.com
Booking a call after a partner listing enquiry.
Only after you click to load the calendar.
StripeEssential
js.stripe.com
Payment processing and fraud prevention.
Only on partner-portal checkout pages.
Session replay
PostHog can record a replay of your visit — the pages you moved between and where you clicked. All text and every form input are masked before the recording leaves your browser, so what you typed is never captured. Replay is off unless you allow analytics, and error replays in Sentry are armed on the same condition.
Video and booking embeds
Videos on partner profiles and case studies, and the booking calendars on our advisory and partner pages, are not loaded until you click them. Until you do, you see a placeholder and no request reaches YouTube, Vimeo, Loom, Cal.com or Google. YouTube embeds use youtube-nocookie.com.
Email open and click measurement
Emails we send through Resend can include a tracking pixel that tells us an email was opened, and links that record a click. We disable open tracking for recipients in the UK, EEA and Switzerland. Click measurement is used to tell which content is useful; every marketing email carries a one-click unsubscribe.
5. Local Storage
Alongside cookies we use your browser's local storage. It stays on your device and is not sent to our servers unless you submit a form:
- Your name and email — if you have submitted a form before, so a later form can pre-fill.
- Feature interaction flags — whether you have already seen an exit-intent popup, a sticky banner or a resource gate, so they are not shown repeatedly.
- Requirements wizard progress — your in-progress answers, so you can close the tab and come back.
Clearing your browser's site data removes all of it.
6. Changing Your Choices
You can change or withdraw your choices at any time — withdrawing is as easy as giving consent in the first place:
- Cookie settings — reopens the banner with your current choices, on any page. The same link sits in the Site footer.
- Global Privacy Control — if your browser sends a
Sec-GPCsignal we record it and treat any enquiry you submit as opted out of sharing with partners. See our Do Not Sell or Share My Personal Information page. - Browser settings — most browsers can block or delete cookies. Blocking essential cookies will break parts of the Site.
- Google Analytics opt-out — the Google Analytics Opt-out Browser Add-on works across all websites. Google's privacy policy is at policies.google.com/privacy.
We record your choice with a timestamp and the version of this policy it was made against. If the policy version changes we ask again rather than assuming your old answer still applies.
7. Changes to This Policy
We may update this Cookie Policy from time to time. We will post the updated policy on this page with a new "Last updated" date, and the tables above are regenerated from the code whenever the Site changes what it loads.
Contact Us
For anything about this policy, your personal data, or a request to exercise your rights:
- Privacy and data rights — privacy@erpresearch.com. We respond within 30 days.
- Everything else — support@erpresearch.com.
See also our Privacy Policy and Terms of Service.