1. Summary

This site sets no advertising cookies, no analytics cookies, and no third-party cookies of any kind.

There is no Google Analytics, no Meta pixel, no LinkedIn tag, no advertising network and no consent-management vendor on vdmdigital.io. You can check this: a strict Content Security Policy on our server refuses to load any script we did not ship ourselves, so a third-party tracker cannot be added casually or accidentally.

One item is connected to advertising, and it is not a cookie: if you arrive from one of our own Google ads, your browser keeps Google's code for that one click for the length of the visit, so that an enquiry can carry it (clause 2.4). It is sent nowhere unless you send us an enquiry, and it is never kept if your browser sends Do Not Track or Global Privacy Control.

That is also why you are not being shown a cookie banner. Nothing here follows you across the web, nothing is shared with an advertising network as you browse, and the one advertising item exists only for a visit that came from our own ad and only until you close the tab.

2. What we do store

Everything below is first-party, stored by vdmdigital.io in your own browser and readable only by vdmdigital.io.

2.1 Analytics identifiers (localStorage and sessionStorage)

  • vdm_anon_id: stored in localStorage. A random identifier, generated in your browser, with nothing derived from you in it. It lets us tell a returning visit from a new one without knowing who you are. Persists until you clear your browser storage.
  • vdm_session_id: stored in sessionStorage. A random identifier for this browsing session, so a single visit reading four pages counts as one visit and not four. Deleted the moment you close the tab.
  • vdm_staff: stored in localStorage, and only in a VDM staff member's own browser, when they open one of our demo sites from our admin area. It holds the digit 1 and stops that browser being counted, so our own checks are never mistaken for a visitor. You will not have it unless you work for us.

These are not cookies. They are never transmitted to any third party, and they are not attached automatically to requests the way a cookie is.

We do not create either of them if your browser sends a Do Not Track or Global Privacy Control signal, if you look like a bot, or if you are signed in to our admin area. In those cases nothing is stored and nothing is recorded.

What we do with the events they identify is set out in clause 3.4 of our Privacy Policy.

2.2 Sign-in session (localStorage)

  • sb-<project>-auth-token: written by our authentication provider when you sign in to the client and staff area. It holds your session token so you stay signed in between pages. Strictly necessary for the sign-in to work; it is not used for tracking, and it does not exist unless you have signed in.
  • Clearing it signs you out. Signing out removes it.

2.3 Motion preference (localStorage)

  • vdm_motion: only offered if your device is set to reduce motion (for example, Windows "Animation effects" turned off). In that case we show a still version of the site, and if you choose to turn the site's motion on instead, this stores the word full so the choice holds on your next visit. It holds nothing else and is never sent anywhere. Choosing "Reduce motion" again removes it. It does not exist unless you press that switch.

2.4 A Google ad's click code (sessionStorage)

  • vdm_ad_click: stored in sessionStorage, and only when you arrive from one of our own Google ads. Google adds a code to the link of every ad click (gclid, or gbraid or wbraid on some Apple devices); this keeps that code and nothing else, so that if you send us an enquiry it goes with it and we can tell Google the click led to an enquiry. It is not read by our analytics, it is sent nowhere unless you send an enquiry, and it is removed once you have. Deleted the moment you close the tab.
  • We do not create it, and we remove it, if your browser sends a Do Not Track or Global Privacy Control signal.

What happens to the code when you send an enquiry is set out in clause 3.1 of our Privacy Policy.

2.5 Your website brief (localStorage)

  • vdm_brief: stored in localStorage, and only when you start the website brief on our page for new websites. It holds the brief's reference, a random key that lets your browser open that brief again, and a copy of your answers so far, so a reload or a trip to the payment page does not lose your work and you can carry on later on the same device. It is sent only to vdmdigital.io, never to anyone else. It is ignored after 14 days, and pressing "Start again" removes it.

What happens to the answers themselves is set out in clause 3.1 of our Privacy Policy.

2.6 What we do not store

  • No retargeting identifier, and no advertising identifier of our own. The one advertising item, in clause 2.4, is Google's code for a single click on our own ad, kept for one visit.
  • No cross-site identifier, and no participation in any identity graph.
  • No device fingerprint. We do not read your fonts, canvas, audio stack, hardware concurrency or screen dimensions to build one.
  • No IP address in our analytics table.

3. Third-party storage you may encounter

Three places on our site involve someone else's infrastructure. None of them tracks you across the web:

  • Payment pages. When you pay us, you are handed to our payment processor's own hosted page. That page is theirs, and their cookies and their privacy policy apply while you are on it: Paystack for ZAR payments, and Stripe for international card payments in future. They use strictly necessary and fraud-prevention cookies. We do not receive them.
  • Testimonial videos. Approved testimonial videos are served from our file-storage provider. Playing one is a plain media request and sets nothing on your device.
  • Links out. Once you follow a link to a client site or anywhere else, that site's own policy applies.

4. Fonts, and why there is no third-party request for them

All fonts on this site are self-hosted from our own server. There is no request to Google Fonts, so no third party learns that you visited us by serving us a typeface. The same applies to our images, styles and scripts: everything loads from vdmdigital.io.

5. How to clear or block it

  • Clear it: your browser's Clear browsing data / Clear site data for vdmdigital.io removes everything listed above. The site keeps working; you will simply be signed out, counted as a new visitor, shown the still version again if your device is set to reduce motion, and unable to carry on a website brief from this device (what you already sent us is kept).
  • Block it: browser settings that block site data will stop localStorage and sessionStorage from being written. Our code handles that gracefully: every read and write is guarded, so nothing breaks. The public site works fully with storage blocked; the sign-in area will not be able to keep you signed in, and the switch that turns motion on is not offered, because it could not remember your choice.
  • Opt out of analytics entirely: enable Do Not Track or Global Privacy Control in your browser. We check for both before we store or send anything.

Blocking site data does not disable any part of the public site.

6. Changes

If we ever add something that stores data in your browser, we will list it here before it ships, and if it needs consent we will ask for it properly rather than assume it.

7. Contact

Questions about this policy: erik@vdmdigital.io

VDM Digital (Pty) Ltd (Reg. No. 2026/179981/07), 13 Jigger Avenue, Somerset West, Western Cape, 7130, South Africa

Last updated: 24 October 2026.