1. Purpose and scope
This policy says what manchesteraiguild.org stores on your device, why, and how you can control it. It covers every page of the website. That includes the join page and the Cookbook slide deck.
Defined terms
Cookie: a small text file a website stores in your browser.
Similar technologies: anything else that stores or reads information on your device. Examples are local storage, and scripts that fingerprint your browser.
Strictly necessary: storage the service you asked for cannot work without. It needs no consent.
2. Background
The Privacy and Electronic Communications Regulations 2003 (PECR) set the rules for storing information on a device. Regulation 6 says a person must not store information on your device, or read information already stored there, unless an exception applies. The exceptions are in Schedule A1.
The Guild's site is built to store nothing beyond what is strictly necessary. Where the bot check processes your IP address, the lawful basis is legitimate interests (security). The Privacy notice, section 4, sets this out.
3. Principles
Store nothing on a visitor's device unless the site cannot work without it.
Say exactly what is stored. Check it in a real browser, and record the date of the check.
Ask for consent before adding anything that is not strictly necessary.
4. Commitments
We re-check the cookie store and web storage in a real browser after every release that adds a script or embed, and record the result.
We add a consent step before we introduce any storage that is not strictly necessary.
We keep the table in section 5 accurate to the last check, and show the date of that check.
5. What this website sets
Pages on manchesteraiguild.org set no cookies and use no local or session storage. There is no analytics, advertising or social-media tracking script on any page.
We checked this on 16 September 2026. We loaded every page (home, team, resources, join, every policy page, the Cookbook deck and the 404 page) in a fresh Google Chrome profile. We then read the cookie store and web storage. We found zero cookies and zero storage keys. The same check on the live domain found no cookies set by Cloudflare's edge either. The Guild keeps a record of this check.
One mechanism can store something, and it is strictly necessary:
| Name | Set by | Purpose | Type | Duration |
|---|---|---|---|---|
| Turnstile challenge state | Cloudflare Turnstile, only on /join | Tells human visitors from bots, so the form is not abused. It runs inside a Cloudflare frame. By default it uses browser signals and does not set a cookie on our domain. If Cloudflare's "pre-clearance" option is turned on, it may set cf_clearance. | Strictly necessary | Session. Pre-clearance is not enabled on the Guild's widget, so no cf_clearance cookie is set. |
Because we use nothing beyond strictly necessary storage, the site shows no cookie banner. If we ever add analytics or embedded video, we will ask for consent first and update this policy.
6. Third-party requests that are not cookies
Google Fonts: the site's typefaces (Inter and Roboto Slab) load from Google's servers. Google receives your IP address and browser details with that request. Google's Fonts API does not set or log cookies (Google, n.d.). Google's privacy FAQ is at https://developers.google.com/fonts/faq/privacy
Slide decks on the resources page are hosted on this site, not on a third-party service.
Links to third-party sites open those organisations' own sites. Those sites have their own cookie practices. These are outbound links, not cookies we set.
7. How to control cookies
You can block or delete cookies in your browser settings. Blocking the Turnstile mechanism may stop the join form from working. Everything else on the site works with all cookies blocked.
The ICO's guidance for the public is at https://ico.org.uk/for-the-public/online/cookies/
8. Roles and responsibilities
| Role | Holder | Responsibilities |
|---|---|---|
| Primary responsibility | Edwin Luther, Risk & Governance Director | Owns this policy. Receives reports and escalations at report@manchesteraiguild.com. Reports to the Senior Leadership Team (SLT). |
| Secondary responsibility | Trevor Roberts, Data Protection Lead | Acts when the primary holder is unavailable, or where the matter concerns the primary holder. |
| Website maintainer | Marek Kurczynski | Re-checks storage after every release that adds a script or embed. Keeps the QA record. Keeps the table in section 5 current. |
| Data Protection Lead | Trevor Roberts | Approves any new storage before it ships. |
| Senior Leadership Team (SLT) | Manchester AI Guild SLT | Decides whether to add analytics. Approves this policy and every review of it. |
| Independent QA reviewer | Any SLT member | Reviews this policy before it goes to the Senior Leadership Team (SLT). Must be a Manchester AI Guild member who did not draft it. |
9. Procedure: adding anything that stores data
The website maintainer describes the storage (name, purpose and duration) in the pull request.
The Data Protection Lead decides whether the storage is strictly necessary. If it is not, a consent mechanism is designed first.
The table in section 5 is updated in the same pull request. The storage check is re-run and recorded.
The Data Protection Lead tells the Senior Leadership Team (SLT) at its next meeting.
10. Compliance
We remove any script or embed that stores data without consent at the next release. If personal data was involved, we record the incident under the Incident response procedure.
11. Further information
Email report@manchesteraiguild.com.
12. Review
This policy is reviewed as often as is reasonable and, as a minimum, once every 12 months. It is reviewed sooner whenever something changes that affects it, for example when a feature that stores anything on your device is added.
The Senior Leadership Team (SLT) approves every review.
Before a review goes to the Senior Leadership Team (SLT), a Manchester AI Guild member who did not draft this policy QA reviews it. The reviewer is never the author. The reviewer's name and the date of the QA review are recorded in the version history.
The version and date at the top show which version you are reading.
13. Related policies
Privacy notice · Data retention schedule · Incident response procedure
14. References and sources
Information Commissioner's Office (n.d.) Cookies and similar technologies. Guide to PECR. [online]. Available at: https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/cookies-and-similar-technologies/ [Accessed 2 November 2026]. Quote: "The basic rule is that you must: tell people the cookies are there".
Information Commissioner's Office (n.d.) Cookies. [online]. Available at: https://ico.org.uk/for-the-public/online/cookies/ [Accessed 2 November 2026]. Quote: "this guidance is under review and may be subject to change".
The Privacy and Electronic Communications (EC Directive) Regulations 2003, SI 2003/2426, regulation 6(1). Available at: https://www.legislation.gov.uk/uksi/2003/2426/regulation/6 [Accessed 2 November 2026]. Quote: "a person must not store information".
Google (n.d.) Google Fonts privacy FAQ. [online]. Available at: https://developers.google.com/fonts/faq/privacy [Accessed 2 November 2026]. Quote: "does not set or log cookies".
Google (n.d.) Delete, allow and manage cookies in Chrome. [online]. Available at: https://support.google.com/chrome/answer/95647 [Accessed 2 November 2026]. Quote: "You can choose to delete existing cookies, allow or block third-party cookies".
Apple (n.d.) Clear your cache and cookies in Safari on Mac. [online]. Available at: https://support.apple.com/en-gb/guide/safari/sfri11471/mac [Accessed 2 November 2026]. Quote: "Clear your cache and cookies in Safari on Mac".
Microsoft (n.d.) Manage cookies in Microsoft Edge. [online]. Available at: https://support.microsoft.com/en-us/windows/manage-cookies-in-microsoft-edge-view-allow-block-delete-and-use-168dab11-0753-043d-7c16-ede5947fc64d [Accessed 2 November 2026]. Quote: "Manage cookies in Microsoft Edge: View, allow, block".
15. Version history
| Version | Date | Author | Reason for change | Presented to SLT | Signed off |
|---|---|---|---|---|---|
| v1.7 | 2 November 2026 | Edwin Luther | Rewritten in plain English for public readers. PECR regulation 6 wording updated to the text in force from 5 February 2026, with Schedule A1 exceptions. Firefox help link removed because the page could not be read. Google Fonts claim sourced. Storage-check path replaced with a note that the Guild keeps a record. Re-check before publication flagged. | — | — |
| v1.6 | 12 October 2026 | Edwin Luther | Named third-party platforms replaced with a category; these are outbound links, so no PECR naming duty attaches. | — | — |
| v1.5 | 24 September 2026 | Edwin Luther | Review cycle set to a minimum of once every 12 months, approved by the Senior Leadership Team (SLT), with QA review by a Manchester AI Guild member who did not draft the document. | — | — |
| v1.4 | 24 September 2026 | Edwin Luther | Reporting and escalation route changed to report@manchesteraiguild.com; ownership allocated to Edwin Luther, Risk & Governance Director, with Trevor Roberts as secondary. | — | — |
| v1.3 | 20 September 2026 | Edwin Luther | Data Protection Officer role replaced by Data Protection Lead (to be appointed) and the dpo@ mailbox by report@manchesteraiguild.com, following #75. | — | — |
| v1.2 | 17 September 2026 | Edwin Luther | Independent critique applied: lawful basis for the bot check cross-referenced; owner named; who informs the SLT. Undated ICO page cited as n.d. Compliance lint (scripts/policy-tools.mjs) passed with 0 errors. | — | — |
| v1.1 | 17 September 2026 | Edwin Luther | MAIG standard applied: document control, principles, roles, compliance, references, version history. Facts unchanged from the 16 September check. | — | — |
| v1.0 | 16 September 2026 | Edwin Luther | First draft against the ICO cookie checklist; real-Chrome storage inspection. | — | — |