Cookie Policy
Last updated: 16 October 2026
Our own code stores nothing in your browser. This page lists everything that does store or read something on your device when you visit limeline.ai: the network error reports of Cloudflare, which serves our pages, and the tools from other companies that we put on our pages. It says when each one happens and what you can do about it. We chose every one of these tools, so we are responsible for telling you about them. The law behind this page is in section 7.
1. The short version
- Our own code stores nothing. No cookies, no analytics, no advertising, no tracking. We checked this on 16 October 2026 and will keep it that way.
- Cloudflare, which serves our pages, asks your browser to report network errors to it for seven days (section 3). It is not a cookie; it is there to find faults in the network.
- Two tools from other companies touch your browser, and only when they are used. Cloudflare’s bot check runs when you press the “Talk to it now” button or open the enquiry form; it sets no cookie. Calendly’s booking calendar does set cookies, and it loads when you press to book, when you say yes to our receptionist, or when you scroll to the booking section at the foot of a page.
- We show no cookie banner. Calendly’s cookies are the ones that are not strictly necessary, and we are responsible for them because we put Calendly’s calendar on our pages. Section 4.2 says exactly when they land, which ones land before you can answer Calendly’s notice, and what you can do.
2. What “cookies” means here
A cookie is a small file a website puts in your browser so it can recognise you later. “Similar technologies” are other ways of storing or reading information on your device, such as local storage (a notebook inside your browser) or a script that reads your browser’s characteristics. This page covers all of them.
3. What our own pages store
Nothing. The pages of limeline.ai are plain pages served by Cloudflare. They do not set cookies, they do not write to local storage, and they load no analytics or advertising script. We do not measure visitors. Our fonts are stored on our own site, so no font service sees you. We checked the live site on 15 October 2026: no cookie and nothing in local storage after a visit to the home page.
Cloudflare’s network error reports. With every page, Cloudflare (which serves our pages) sends two instructions to your browser, called “NEL” and “Report-To”. They ask your browser to remember, for seven days, to send Cloudflare a short report if a page of ours fails to load, for example because of a broken connection. A report holds the page address, the kind of error and your IP address, and goes to a.nel.cloudflare.com. As Cloudflare has it set for our site, only failures are reported, never successful visits. Your browser keeps this instruction in its own network settings, not in a cookie. It is part of securing the connection (section 7).
Cloudflare, which serves our pages, sets no cookie on our site as we have it set up. Cloudflare’s cookies only appear if a site turns on features that need one, such as its “bot fight mode”, a security challenge page, or a rate limit that counts by visitor rather than by address. We use none of these: our one rate limit, on the call service, counts by address, and we found no Cloudflare cookie on the live site when we checked on 15 and 16 October 2026. Cloudflare lists its cookies at https://developers.cloudflare.com/fundamentals/reference/policies-compliances/cloudflare-cookies/ and explains them in its cookie policy, https://www.cloudflare.com/cookie-policy/. If we ever turn one on, it will be listed here.
Our design pages (/edit/ and the working preview) exist only on the review copy of our site that
we use before changes go live, not on limeline.ai. They keep the founders’ own drafts in the browser’s local storage on the device.
4. Tools from other companies
4.1 Cloudflare Turnstile: checking that you are a person
Before you can start a call with our AI receptionist, and before the enquiry form sends, Cloudflare Turnstile checks that a person, not a program, is using the page. It runs invisibly: there is nothing to click. On the home page it runs the first time you press “Talk to it now”; in the pricing section of the home page and of our page for dental practices it runs when you open the enquiry form; on our preview pages it runs when the page loads. To make the check, Turnstile reads your IP address, your browser type, the way your connection is encrypted (its “TLS fingerprint”) and which features your browser supports, and gives the page a one-time token, valid for five minutes, that our server verifies. Cloudflare says it uses these signals “solely to detect and block bots”, not to identify or profile anyone.
| Stored item | Set by | Purpose | Lasts | When it appears | Your choice |
|---|---|---|---|---|---|
| None on our site: Turnstile sets no cookie here and writes nothing to our site’s local storage. We checked on 16 October 2026 after opening the enquiry form, so after the check had run: no cookie, nothing stored, and no request to the Cloudflare challenge address on our domain that its optional “pre-clearance” cookie (one that would remember you passed the check) would need. What Cloudflare’s own script keeps in its own area of your browser is not stated by Cloudflare. | Cloudflare, Inc. | Stopping automated abuse of a service that costs us money per call and per email, and protecting the page you are on | The one-time token, five minutes | The first press of the call button; opening the enquiry form; loading a preview page | Do not press the call button or open the form; book a call or email us instead |
- Why no consent is needed: the check is strictly necessary for the security of the page, the call and the form you asked for (PECR Schedule A1, paragraph 4). We still tell you about it here.
- Cloudflare’s own terms for it: https://www.cloudflare.com/turnstile-privacy-policy/
4.2 Calendly: booking a call
Calendly’s calendar is a page from calendly.com shown inside ours. Nothing from Calendly loads until the calendar is asked for in one of three ways: pressing “Book a call” or the booking slide at the top of the home page; saying yes when our AI receptionist offers to open it during a call; or scrolling down to the booking section at the foot of a page, which loads the calendar when it comes into view.
The moment the calendar is on the page, Calendly’s page sets its own cookies, some before you can answer the cookie notice it shows inside the frame. We measured this in a real browser on 5 October, 15 October and 16 October 2026. We chose to put Calendly’s calendar on our pages and we decide when it loads, so we are responsible for these cookies landing and for telling you about them. What Calendly does with what they collect is in its own privacy notice: https://calendly.com/legal/privacy-notice.
| Stored item | Set by | Purpose (as published by the setter) | Lasts | When it appears | Your choice |
|---|---|---|---|---|---|
__cf_bm on calendly.com |
Cloudflare, for Calendly | Protects Calendly’s calendar against automated use | 30 minutes | As soon as the calendar loads | Do not open the calendar |
_cfuvid on calendly.com |
Cloudflare, for Calendly | Lets Calendly’s rate limit tell visitors apart who share one internet address | Until you close your browser | As soon as the calendar loads | Do not open the calendar |
OptanonConsent on calendly.com |
Calendly, through its consent tool OneTrust | Remembers your answer to Calendly’s cookie notice | 365 days | As soon as the calendar loads | Change your answer under “Cookie Settings” in the calendar |
_calendly_session on calendly.com |
Calendly | Calendly’s session cookie, which keeps one visit to its booking page together | 21 days | Only if your browser lets a page inside another site set cookies, or when you open the booking page on calendly.com itself; on our page most browsers do not | Do not open the calendar; delete it in your browser |
__stripe_mid, set by Stripe’s script inside the calendar |
Stripe, Calendly’s payment provider | Fraud prevention for Calendly’s paid bookings (our call is free, so it does nothing for you) | 400 days as we measured it (Stripe says one year) | When the calendar loads, on some visits (seen on 5 October 2026, not on 16 October 2026) | Do not open the calendar; delete it in your browser |
__stripe_sid, set by Stripe’s script inside the calendar |
Stripe, Calendly’s payment provider | As above | 30 minutes (Stripe’s own figure) | As above | As above |
| Calendly’s optional cookies (analytics, functional, targeting) | Calendly and the partners named in its notice | Calendly’s own measurement and marketing | As Calendly’s notice says | Only if you accept them in Calendly’s notice | Refuse or change them under “Cookie Settings” in the calendar |
To show the calendar, your browser also contacts these addresses, which then see your IP address and browser type (measured on 16 October 2026): calendly.com, assets.calendly.com and dfp.calendly.com (Calendly); js.stripe.com (Stripe); cdn.cookielaw.org and geolocation.onetrust.com (OneTrust, Calendly’s consent tool); www.recaptcha.net, www.gstatic.com, fonts.gstatic.com and accounts.google.com (Google: Calendly’s bot check, fonts and Google sign-in); and notifier-configs.airbrake.io (Airbrake, Calendly’s error reporting).
Why we load it the way we do. The cookies in the table that land before Calendly’s notice are set the moment the calendar loads, which is why we load the calendar only when it is asked for. When you press the booking button, or say yes to the receptionist, that press is your choice to use Calendly, cookies included, and this page tells you beforehand what that means. In the booking section at the foot of the page the calendar loads as you scroll to it, without a press of yours, so there Calendly’s cookies land without your having asked for the calendar. We are reviewing that section so that the calendar loads only when you press a button.
If you would rather not load Calendly at all: do not open the calendar and do not scroll to the booking section at the foot of the page. Book by email at hello@limeline.ai instead, or use the “Open the booking page” link, which takes you to calendly.com in a new tab where the same notice applies.
4.3 Prighter’s certificate on the privacy page
Our privacy policy page shows a small certificate image from Prighter, our UK representative, confirming the appointment. We serve our own copy of the image from limeline.ai, so showing it contacts no one else and stores nothing. Pressing the image opens Prighter’s page for Limeline in the same way as the Trust Center link.
4.4 LiveKit: the call itself
During a call with our AI receptionist your browser holds a live connection to LiveKit Cloud to carry the sound. LiveKit’s browser library stores nothing in cookies or local storage (we checked its source code, version 2.22.4); your one-off key for the call lives in the page’s memory until the call ends. What happens to the call itself is in the privacy policy, section 5.
5. How to control cookies
Because our own code sets no cookies, there is nothing of ours to switch off. For Calendly’s cookies, use “Cookie Settings” inside Calendly’s calendar, or delete them in your browser. Your browser can also block or delete cookies for any site: look for “Cookies and site data” in its settings. Blocking cookies does not affect reading this site; Calendly’s calendar may not work with all cookies blocked, and the booking page on calendly.com is the alternative.
6. Changes
If we ever add a tool that stores something on your device that is not strictly necessary, we will ask for your consent before it loads, and this page will list it. The date at the top is the date of the last change.
7. The law behind this page
Storing information on your device, or reading what is there, needs clear information and your consent, unless it is strictly necessary for a service you asked for or only carries your connection. In the UK that is regulation 6 of the Privacy and Electronic Communications Regulations 2003 (as rewritten on 5 February 2026, with Schedule A1). In the EU it is Article 5(3) of the ePrivacy Directive, explained by the European Data Protection Board in its Guidelines 2/2023 on the technical scope of Article 5(3); in Cyprus, where we are based, it is Article 99(5) of Law 112(I)/2004.
Schedule A1 also lets a UK website use some things without consent if it offers a simple way to refuse them, such as visitor statistics or remembering how the page looks for you. We use none of those exceptions: we run no statistics and store no settings. We rely on the “strictly necessary” exception for the bot check and the network error reports (the security of the service you asked for and of the network that carries it), and on the “carrying the connection” exception for the call itself. Calendly’s cookies are not covered by any exception, which is why section 4.2 says exactly when they land.
The UK regulator’s guidance on it is at https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guidance-on-the-use-of-storage-and-access-technologies/.
8. Contact
Questions about this page: hello@limeline.ai. For your data-protection rights, see the privacy policy, section 15, and our Trust Center: https://app.prighter.com/portal/limeline