GingerControl Privacy policy

Privacy Policy

What we collect when you use our site, app and GingerOS, what we use it for, and who to ask.

On this page

Information we collect
How we use your information
GingerOS access to your ERP and PLM
Data security
Cookies and similar technologies
What we measure for every visitor, without cookies
What we add if you accept cookies
Booking a call
Cookies and browser storage we use
Service providers
Contact us

Last updated October 30, 2026

Information we collect

GingerControl collects information you provide directly when you use our platform, including account registration details, classification queries, and contact form submissions.

How we use your information

We use collected information to provide and improve our trade compliance tools, communicate with you about your account, and ensure the security of our platform.

We never use customer data to train AI models. This covers everything a customer gives us or lets us read: account details, classification queries, uploaded documents, and data read from the customer's own systems.

GingerOS access to your ERP and PLM

If your company uses GingerOS, it connects read-only to your ERP and PLM systems to read the product facts it needs, such as materials, specifications, origins and purchases.

Each connection is set up for your company, together with your IT team.
GingerOS does not migrate or take over your master data.
Results are written back to your ERP only where you approve, and each write-back is kept in an audit trail.
Data read from your ERP and PLM is never used to train AI models.

Data security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction.

Cookies and similar technologies

Cookies are small files a website stores in your browser. Websites can also use your browser's local storage and session storage for the same purposes. On gingercontrol.com we use them for two things: to make the site work, and, if you allow it, to understand how people use the site.

When you first visit, a small notice offers two choices:

Accept all cookies. We use the analytics cookies and session recordings described under "What we add if you accept cookies".
Only essential cookies. We store only what the site needs to work, plus your choice itself. We still measure visits without cookies, as described under "What we measure for every visitor, without cookies".

You can change your choice at any time with the Cookie settings link at the bottom of every page.

If you have not chosen yet. If you are in the European Economic Area, the United Kingdom or Switzerland, nothing beyond essential storage is used until you choose. Everywhere else, until you choose, we treat your visit as if you had accepted. The notice stays on screen until you choose. We work out your region from your IP address on each visit; we do not store it in your browser.

If you choose "Only essential cookies" after analytics have started (because you accepted earlier, or because of the regional default), we stop the analytics described under "What we add if you accept cookies" straight away, remove PostHog's and Microsoft Clarity's cookies and the stored record of how you first found us, and tell Google Analytics to stop using its cookies. Google Analytics cookies already in your browser stay until they expire or you clear them. The A/B test cookie is removed the next time you open a page that is running a test.

What we measure for every visitor, without cookies

Whatever you choose, we collect the following. None of it is written to your browser's storage, and none of it lets us recognise you on a later day.

Visit statistics. Pages viewed, how far you scroll, which sections you see, links and buttons you click, where you click and move the mouse on a page (heatmaps), the steps of our booking form and the options you pick in it, errors on the page, and page speed. We also record your time zone, the local time of your visit and your approximate location, worked out from your IP address. These go to our analytics provider, PostHog.
Server request log. When your browser loads a page, our server sends PostHog a record of the page address, the page you came from, any campaign tags in the link (such as utm_source), your approximate location (country, region and city, worked out from your IP address by our hosting provider), your browser's identification string (user agent) and device type, and the cookie choice you made, if any. Automated traffic we can recognise, such as search engine crawlers, is left out.
Advertising click identifiers. If the link you arrived from carries a click identifier from an advertising platform (Google's gclid, LinkedIn's li_fat_id or Microsoft's msclkid), it is recorded with the statistics above. We do not place advertising pixels from these platforms on the site.
How visits are counted. To count visitors without cookies, PostHog and our server each turn your IP address and browser details into a pseudonymous code, using a secret key that changes every day. The code does not contain your IP address, and you get a new one the next day.
Where your visit came from. The campaign tags, click identifiers and referring site from the page you arrived on are kept in the page's memory while you browse, and attached to the statistics above and to a booking you make. They are never written to your browser's storage and are gone when you close the tab.
Your company's web domain, if you submit our booking form. When you submit a work email address in the booking form, we record the part after the @ (for example, example.com) with the form submission. We do not record the address itself unless you accepted cookies (see "What we add if you accept cookies") or you complete a booking (see "Booking a call"). Personal email domains, such as gmail.com, are not recorded.
Vercel Web Analytics, Speed Insights and Google Analytics. Our hosting provider, Vercel, counts page views and clicks and measures page speed without cookies. Google Analytics receives page views and similar interaction events (such as scrolling, outbound clicks and form interactions) without cookies if you are in the European Economic Area, the United Kingdom or Switzerland and have not accepted, or if you chose "Only essential cookies".
A/B tests. We sometimes show visitors one of two versions of a page to see which works better. Without cookies, the version you see is based on the daily code above, so you may see a different version on another day.

If your browser sends a "Do Not Track" signal, PostHog never uses cookies for you, even if you accept; it still counts your visit without cookies, and our server request log still records page loads.

If you choose "Accept all cookies", or you are outside the European Economic Area, the United Kingdom and Switzerland and have not chosen yet:

PostHog stores an identifier in your browser that recognises you on later visits, so we can see how a visit develops over days and weeks.
Session recordings. PostHog and Microsoft Clarity record how you use the site: mouse movements, clicks, scrolling and the pages you view. PostHog's recordings also include text you type into form fields and messages from the browser's console. We use these recordings to find and fix problems in the site and the booking form.
Microsoft Clarity also produces heatmaps of where people click and scroll.
Google Analytics uses its cookies. Accepting also gives Google the consent signals it uses for advertising features (ad storage, ad user data and ad personalisation).
First visit source. We store, in your browser, how you first found us (campaign tags, click identifiers, referring site, landing page and date), so a later booking can be credited to it.
A/B tests use a cookie, so you keep seeing the same version of a page.
Your email address. When you submit the booking form, we link your email address and answers to your browsing on our site and to your company's web domain in PostHog. Microsoft Clarity receives a hashed form of your email address and your company domain to label the recording. Google Analytics receives your company domain with the form submission and, if you book, references to the booking; Google's tag may also detect the email address you enter and send it to Google in hashed form. If you then book a call, your name is added from the booking.

Booking a call

Our booking calendar is provided by Calendly, and Calendly's script runs on our booking page. When you reach the calendar step, the calendar is filled in with the name and email address you gave in our booking form, some of your answers and the campaign tags from your visit, so you do not have to type them twice. If you accepted cookies, it also carries an analytics identifier that links the booking to your visit. Calendly receives this information when the calendar loads, before you book.

When you book, reschedule or cancel, Calendly sends us the booking: your name, email address, the time you chose, your time zone, your answers to its questions and the campaign tags. We record it in PostHog. When you book, our booking page also emails our team your name, email address, your answers from our booking form and where your visit came from (see "What we measure for every visitor, without cookies"). If you accepted cookies, the booking is also linked to your browsing on our site; if you did not, it is not. Calendly's own privacy policy applies to its booking calendar.

Name	Set by	Purpose	Kind	How long
cookie_consent	GingerControl	Remembers your cookie choice	Essential	1 year (cookie); until you clear it (local storage)
NEXT_LOCALE	GingerControl	Remembers the language you picked	Essential	1 year
unit_metadata_cache, unit_metadata_version, country_data_cache, country_data_version	GingerControl	Keeps reference data for the tariff calculator so it loads faster	Essential	Until you clear it (local storage)
gc-blog-peek	GingerControl	Stops a blog reading suggestion from repeating during your visit	Essential	Until the tab closes (session storage)
gc_analytics_test_run	GingerControl	Marks visits from our own internal test links	Essential	Until the tab closes (session storage)
__ph_opt_in_out_*	PostHog	Remembers whether PostHog may use cookies	Essential	Until you clear it (local storage)
gc_ab_id	GingerControl	Keeps you on the same version of a page in an A/B test	Analytics, with consent	90 days
gc_attribution	GingerControl	How you first found us	Analytics, with consent	Until you clear it (local storage)
ph_*_posthog	PostHog	Recognises your browser on later visits	Analytics, with consent	1 year (cookie); until you clear it (local storage)
ph__posthog, ph__window_id, ph_*_primary_window_exists	PostHog	Tracks the current session and tab	Analytics, with consent	Until the tab closes (session storage)
_ga, _ga_*	Google	Google Analytics	Analytics, with consent	Up to 2 years
_clck, _clsk	Microsoft	Clarity recordings and heatmaps	Analytics, with consent	1 year (_clck), 1 day (_clsk)
CLID, ANONCHK, MR, MUID, SM	Microsoft	Set on Microsoft's own domains when Clarity runs. MUID identifies browsers across Microsoft sites, and Microsoft uses it for advertising, site analytics and other operational purposes	Analytics, with consent	Set by Microsoft

Calendly may set its own cookies inside the booking calendar. The video player on our pages loads from YouTube's privacy-enhanced domain (youtube-nocookie.com) only when you press play; YouTube's policies apply once it does.

Service providers

We use these providers for the purposes above: PostHog (product analytics and session recordings, United States), Vercel (hosting, Web Analytics, Speed Insights and the service that assigns A/B test versions), Google (Google Analytics), Microsoft (Clarity), Calendly (booking calendar) and YouTube (video player). Each processes data under its own terms and privacy policy.