Cookie policy
A cookie is a small file your browser keeps for a site. This one sets 31, all its own, none of which watches you. Every one is named below with what it carries and how long it lasts.
What this site sets itself
31 cookies, all set by this site rather than anybody else. All but two carry something you have done from one page to the next: a basket, a sign-in, an order you have just placed, an application you have half filled in. Of the other two, pl_consent holds your answer on the cookie banner, and pl_pass is set only when traffic that looks automated has been asked to show it is a browser - most visitors never have it.
These are what the law calls strictly necessary - remove any one and something you asked the site to do stops working - so they are not asked about. Every one is SameSite=Lax, which means it is not sent when another site links to this one, and every one except pl_consent is httpOnly, which means page scripts cannot read it. pl_consent has to be read by the banner's own script, and holds nothing but your three answers and a date.
- pl_pass
- 24 hours
- pl_cart
- 30 days
- pl_auth
- 24 hours
- pl_mfa
- 10 minutes
- pl_order
- 1 hour
- pl_order_email
- 1 hour
- pl_app
- 1 hour
- pl_return
- 30 minutes
- pl_assistant_order
- 30 minutes
- pl_support
- 24 hours
- pl_help
- 30 minutes
- pl_help_email
- 15 minutes
- pl_help_error
- 60 seconds
- pl_seen
- 30 days
- pl_compare
- 30 days
- pl_account_error
- 60 seconds
- pl_tracking
- 30 minutes
- pl_tracking_error
- 60 seconds
- pl_help_notice
- 60 seconds
- pl_return_ref
- 30 minutes
- pl_return_error
- 60 seconds
- pl_question
- 30 days
- pl_question_notice
- 60 seconds
- pl_question_error
- 60 seconds
- pl_review_notice
- 60 seconds
- pl_review_error
- 60 seconds
- pl_review_helped
- 365 days
- pl_review_draft
- 10 minutes
- pl_trade_draft
- 45 minutes
- pl_trade_result
- 5 minutes
- pl_consent
- 180 days
What each one is for
Listed rather than summarised, because a cookie policy that says “we use cookies to improve your experience” tells nobody anything they can check.
- pl_pass
- Only after the site asked your browser to prove it is a browser, which it does only for traffic that looks automated. It says the check was passed, so you are not asked again. It holds nothing about you.
- pl_cart
- Holds your basket between visits. Without it the basket empties on every page.
- pl_auth
- Your sign-in, as a token this server reads and page scripts cannot. It is how an account page knows it is yours.
- pl_mfa
- Only when an account has two-step verification: holds the sign-in between the password and the code, so the code can finish it. Read by this server only.
- pl_order
- The order just placed, so the confirmation page can show it.
- pl_order_email
- The email that order was placed with. Reading an order back takes both, which is what stops one order number reaching somebody else's receipt.
- pl_app
- Set only while paying for an order started in the Pure Lavish app, so the website sends you back to the app when the payment is done.
- pl_return
- The order number and email you typed to find an order. It is a credential, so it is a cookie rather than a web address - a web address reaches server logs and browser history.
- pl_assistant_order
- The order number and email you gave the assistant, so it can answer about that order and no other. Like the returns lookup it is a credential, so it is a cookie rather than a web address, and the assistant is never told the address itself.
- pl_support
- Proof that you confirmed your email address with the code we sent, so you can see your own orders and messages without an account. It is the credential itself, so it never reaches the page or a web address.
- pl_help
- The questions the help assistant has asked and what you answered, while you are still answering them. It holds an order number and your own words, which is why it is a cookie rather than a web address.
- pl_help_email
- The address a code has just been sent to, so the next screen can say where it went. Not the code, and not what the code lets you see.
- pl_help_error
- One message about one thing that did not work in the help section. Read once and deleted.
- pl_seen
- The product codes of the last twelve things you looked at, so your account can show them again. A plain list of codes and nothing else - no times, no pages, nothing joined to your name. It is kept in your own browser rather than in our records, which is why clearing your site data clears it, and why there is a Clear button beside the list.
- pl_compare
- The product codes you have pressed Compare on - four at most - so the compare page can show them side by side. A plain list of codes, kept in your own browser rather than in our records; Clear all on the compare page empties it.
- pl_account_error
- One message about one thing that did not work on your account - most often that a password was not right. A cookie rather than a web address, because a web address reaches server logs, browser history and the next page's referrer. Read once and deleted.
- pl_tracking
- The order number and email you typed to follow an order. Like the returns lookup it is a credential, so it is a cookie rather than a web address - a web address reaches server logs and browser history.
- pl_tracking_error
- One message about one failed order lookup. Read once and deleted.
- pl_help_notice
- One message confirming something in the help section did work. Read once and deleted.
- pl_return_ref
- The return reference just raised, so it survives the page reload.
- pl_return_error
- One message about one failed lookup. It is read once and deleted, so a warning cannot outlive the mistake it describes.
- pl_question
- The key from the link in an email about your question, so the conversation opens without the key staying in the web address, where it would reach browser history and server logs.
- pl_question_notice
- Confirms your reply reached the conversation. Read once and deleted.
- pl_question_error
- One message about a reply that could not be sent. Read once and deleted.
- pl_review_notice
- Confirms your review was sent. Read once and deleted.
- pl_review_error
- Why a review could not be sent. Read once and deleted.
- pl_review_helped
- The reviews you marked helpful on this device, so the button shows it. Holds review numbers only.
- pl_review_draft
- What you typed into a review that could not be sent, so it is back in the form rather than lost.
- pl_trade_draft
- A part-finished trade application, so you can go and find a VAT number and come back to it.
- pl_trade_result
- Whether that application was accepted, across one redirect.
- pl_consent
- Your answer on the cookie banner: which of analytics, advertising and personalised advertising you allowed, and when. It is how the site knows not to ask on every page, and not to load what you refused.
What we ask you about
Measurement and advertising are optional, and none of it is loaded - no script, no cookie - until you say yes on the cookie banner. “That's OK” allows all three kinds, “Essential only” refuses all three, and “Let me choose” lets you pick. Nothing is ticked for you.
You can change your answer at any time with “Cookie preferences” at the foot of every page. Switching something off removes the cookies it left on this site and reloads the page without it. We ask again after 180 days.
- Analytics
- Google Analytics: which pages are visited, what is added to a basket and bought, and where people get stuck. Its cookies begin _ga. Google Tag Manager, which loads such tools, is loaded with it.
- Advertising
- Google Ads and the Meta (Facebook and Instagram) Pixel: whether one of our adverts led to a visit or an order, and what the order was worth. Their cookies begin _gcl and _fbp.
- Personalised advertising
- Lets Google and Meta use what you looked at here to choose which adverts you are shown elsewhere. Only available with Advertising.
What is sent when you say yes
The pages you open, the products you look at, what goes into your basket, that a checkout was begun, and - for an order - its number, its value and what was in it.
Never your name, your email address, your postal address or your payment details. Those stay between you, us and the payment provider.
Things that are not cookies
The site keeps a little in your browser's own storage. It is listed here because what matters is what this site keeps on your machine, not which part of the browser it keeps it in.
- pl_assistant
- A number that ties the questions you ask the assistant into one conversation, so a follow-up knows what it follows. It is not a cookie, it is sent only with a question you have typed, and it says nothing about who you are.
- pl_sent
- Only if you allowed analytics or advertising: a note that an order's confirmation has already been counted, so reloading the page does not count the sale twice. It holds the order number and nothing else.
- pl_pass_tries
- Only on the check some traffic is asked to pass (see pl_pass): how many times this tab has tried, so a browser that keeps no cookies is told so instead of trying for ever. A number and nothing else.
What the server records
Not a cookie, and nothing kept on your machine - but you should know it happens. Every page you open reaches our server with your IP address and the name of your browser, as it does on any website, and we keep a record of it: the address, the browser, the page, the site you came from and the time.
From the IP address we also work out roughly where a visit came from - the country, region and town of your internet provider's network, and at most the first half of a postcode - using a location database kept on our own server, so your address is not sent anywhere to do it. The number of visits from each town is kept to show which areas our visitors come from; those counts hold no address and nothing about you.
If you give us an email address - signing in, checking out, applying for a trade account, tracking an order or asking for help - it is put beside that record, so we can see who a visitor was when they told us.
We also note the steps you take in the shop on each visit - the products you look at, what goes in and out of your basket, how far a checkout gets, whether a payment was accepted or refused, the order it made, and any error the site ran into - so we can see where the shop lets people down. Never your card details or your password: those go to the payment provider or are never kept.
Nothing else is added to it, nothing is shared, and all of it is deleted 7 days after your last visit.
Blocking them yourself
Every browser can refuse cookies, and you are welcome to. The basket, signing in, checking out, looking up an order and applying for a trade account all stop working, because each one is carried by a cookie in the list above.
Nothing else on the site depends on them. Browsing, searching, reading a guide and viewing a product all work with cookies switched off.
Other companies
Paying brings in the payment provider you choose - Stripe for cards, PayPal, or Klarna - whose own form or window sets its own cookies under its own policy while you are paying. That is part of taking the payment, and is not something the banner can switch off.
Three other things are drawn by another company's script and may set that company's cookies: Klarna's and PayPal's instalment messages beside a product's price, and Trustpilot's “Review us” box on the home page.
Analytics and advertising, from Google, Microsoft and Meta, are loaded only with your permission, as described above.
Something here unclear?
The help centre answers what is written. For anything that is not, the returns form and your account both work today.