Cookie Policy
Version 1.0 · In force from 2026-08-22
We are ITSM Ltd, a company incorporated in England and Wales with company number 17339600 and registered office at 167-169 Great Portland Street, 5th Floor, London, W1W 5PF. This one Cookie Policy covers our Services under both of our trading names — ImproveDesk at https://improve-desk.com/ and Fulfilra at https://fulfilra.com/ — meaning each product's website and application together (Services). What is common to both is set out below; what is specific to one Service is in Annex A (ImproveDesk) or Annex B (Fulfilra).
Please read this policy carefully, as it contains important information on who we are and how we use cookies on our Services. It should be read together with our Privacy Policy, which sets out who we are, how to contact us, what data is collected, how and why we collect, store, use and share personal information generally, your rights in relation to your personal information, and how to contact us and the supervisory authority if you have a complaint.
1. COOKIES
A cookie is a small text file placed onto your device (e.g. your smartphone or other electronic device) when you use our Services. We use only cookies that are essential to provide the Services you have asked for, so you will not see a cookie consent banner. If we ever introduce a cookie that is not essential, we will ask for your consent before placing it.
Cookies help us recognise your device between one request and the next. Both Services use the same two Supabase authentication cookies, described in section 3; ImproveDesk sets one further preference cookie, and Fulfilra sets one further cookie for our own support staff only — each is described in its Annex. We do not use cookies to collect location data, to build a profile of you, or to follow you across other websites.
We do measure how our Services are used — how many pages are viewed, and which parts of the product people reach — but that measurement does not use cookies. The way it works differs by Service and is described plainly in each Annex and in the Privacy Policy. As with any request your browser makes, the request that carries the measurement reaches our hosting provider with your IP address attached; what Vercel does with it is described in the Annexes and in its own documentation.
For further information on cookies generally, including how to control and manage them, see the guidance published by the UK Information Commissioner's Office, or visit www.aboutcookies.org or www.allaboutcookies.org.
2. CONSENT TO USE COOKIES
We will ask for your consent before placing cookies or similar technologies on your device, except where they are essential for us to provide a service you have requested (e.g. to allow you to remain signed in to the Services as you navigate within them).
Every cookie we currently place on a customer's device is essential in that sense, so we do not ask for your consent and you will not see a consent banner. Section 3 and the Annexes explain each cookie: what it holds, how long it lasts, and why it is essential.
3. COOKIES BOTH SERVICES USE
| Type of cookie and who sets it | Name | Purpose | Essential? Will we seek consent? |
|---|---|---|---|
| Strictly necessary, first party — set by ITSM Ltd through our authentication provider, Supabase. It is written by our own servers on our own domain; Supabase does not set it from theirs. | sb-<project-ref>-auth-token, where <project-ref> is that Service's Supabase project reference. When the value is larger than 3,180 bytes the browser receives it split across numbered continuations (…auth-token.0, …auth-token.1, and so on). | This cookie is what keeps you signed in. Without it, every page you open would ask you to sign in again, and the Service could not tell your organisation's data from anyone else's. It holds your Supabase session — an encoded access token and refresh token — and so contains personal information: your user ID, the email address you signed in with, and technical details of the session such as when it was issued and when it expires. It contains nothing from your organisation's Records. It is set when you sign in, refreshed by our servers as you navigate so the session does not lapse mid-task, and deleted when you sign out. Its maximum lifetime in the browser is 400 days — the longest any cookie may live under current browser rules; the session inside it expires and is rotated far sooner. | Yes — essential. You cannot have a signed-in account without it. We will not request your consent before placing it. |
| Strictly necessary, first party — set by ITSM Ltd through our authentication provider, Supabase. Written by our own servers on our own domain. | sb-<project-ref>-auth-token-code-verifier | This cookie is written during the email-link flows described in each Annex — always when you create an account, and, for Fulfilra, also when you ask for a sign-in link by email. It holds a single-use random value which proves that the browser asking for the email is the same browser that later follows the link in it — a standard protection against someone intercepting that link. It holds no personal information: no name, no email address, and no identifier for you. It is written when you submit the relevant form, and it is used up and removed when you follow the link. | Yes — essential. Without it we could not safely confirm that the person opening the link is the person who asked for it. We will not request your consent before placing it. |
4. THIRD-PARTY SERVICES AND COOKIES
Several third-party services run on or alongside our Services, and visitors reasonably expect them to set cookies. None of them sets a cookie on our Services. Which services these are differs by Service and each is named, with what it does instead of setting a cookie, in the Annexes.
5. HOW TO TURN OFF ALL COOKIES, AND THE CONSEQUENCES OF DOING SO
If you do not want to accept any cookies, you may be able to change your device settings so that cookies (including those which are essential to the services you have requested) are not accepted. If you do this, please be aware that you may lose some of the functionality of our Services and of other services you use on your device. For further information about cookies and how to disable them, see the resources in section 1.
6. CHANGES TO THIS POLICY
We may change this Cookie Policy from time to time by posting the updated version on our websites and giving you at least 30 days' prior notice — via the Services or by email to the address you provided when you signed up — in the same way as clause 19 of our SaaS Terms and Conditions.
ANNEX A — IMPROVEDESK
A1. The additional cookie ImproveDesk sets
| Type of cookie and who sets it | Name | Purpose | Essential? Will we seek consent? |
|---|---|---|---|
| Preference (customisation), first party — set by ITSM Ltd. No third party is involved and its contents never leave our servers. | id_theme | Remembers whether you asked for the light appearance, the dark appearance, or to follow your device's setting, so the site looks the way you chose on your next visit. It holds one word — system, light or dark. It collects no personal information, no identifier, and nothing that could be used to recognise you. It is only written when you actively use the appearance control — if you never touch it, it is never created. It remains for one year from the moment you make a choice, and you can remove it at any time through your browser's settings without losing anything else. | Yes — essential to deliver the appearance you explicitly asked for; it is created only by your own action and only stores that action. We will not request your consent before placing it. |
Note on the code-verifier cookie in section 3: for ImproveDesk it is written only when you create an account. It is not written when you reset your password, because that flow deliberately does not use it.
A2. Third-party services on ImproveDesk that do not set cookies
Cloudflare Turnstile protects our sign-up, password reset, waitlist and public capture forms from automated abuse. The check runs a script loaded from challenges.cloudflare.com, but it places no cookie on our Services: Turnstile issues a cookie (cf_clearance) only where a site turns on its optional "pre-clearance" feature, which we have not. To run the check, our server sends Cloudflare the token your browser produced together with your IP address; Cloudflare uses these, and some technical information about your browser, to decide whether the request came from a person or an automated script. Cloudflare describes this in its Turnstile Privacy Addendum. The Turnstile check does read technical characteristics of your browser; we rely on it as strictly necessary to provide the sign-up, password reset and public submission services you have asked for.
Stripe sells subscriptions and collects payment as our merchant of record. When you start or manage a subscription you leave our Services for a checkout or billing page operated by Stripe and branded "Sold through Link", on Stripe's own domains, and any cookie set there is Stripe's, under Stripe's own policy. Stripe places no cookie on our Services.
Vercel hosts our Services and provides the usage measurement described in the Privacy Policy. Its Web Analytics does not use cookies: rather than storing an identifier on your device, it derives a hash from the incoming request, which is discarded after 24 hours, so nothing persists on your device and nothing follows you to another website. See Vercel's analytics privacy documentation and Privacy Policy.
ANNEX B — FULFILRA
B1. The additional cookie Fulfilra sets — for our staff only
A third cookie, named __Host-fulfilra_pg, is set only for ITSM Ltd support staff. It is written when a member of our support team unlocks our internal support portal with a second authentication factor, it holds a signed value that expires after 8 hours, and it is never placed on a customer's device. It is named here for completeness because it is set on our own domain.
Note on the code-verifier cookie in section 3: for Fulfilra it is written when you create an account, and when you ask us to email you a sign-in link. It is not written when you sign in with a password, because that flow does not use it.
B2. Third-party services on Fulfilra that do not set cookies
Atlassian provides Jira Service Management, inside which Fulfilra can run as an embedded page. That page does not use your Fulfilra sign-in session and we place no cookie of our own on it. Any cookie present while you are inside Jira is Atlassian's, set on Atlassian's own domain under Atlassian's own policy.
Stripe sells subscriptions and collects payment as our merchant of record. When you start or manage a subscription you leave our Services for a checkout or billing page operated by Stripe and branded "Sold through Link", on Stripe's own domains, and any cookie set there is Stripe's, under Stripe's own policy. Stripe places no cookie on our Services.
Vercel hosts our Services and provides the usage measurement described in the Privacy Policy. Its Web Analytics does not use cookies: rather than storing an identifier on your device, it derives a hash from the incoming request, which is discarded after 24 hours, so nothing persists on your device and nothing follows you to another website. See Vercel's analytics privacy documentation and Privacy Policy.