I can explain report types, uploads, payment, privacy, deletion and how to prepare useful evidence.
Cookies
Cookie Policy
Human Response Lab uses a small number of technologies needed to secure forms, remember a private checkout and operate report sessions.
Last updated 1 September 2026
What a cookie is
A cookie is a small piece of data saved by a website in your browser. Similar storage and identifiers may be used to maintain security or complete a requested transaction.
This website does not currently set advertising, behavioural-marketing or audience-analytics cookies. If non-essential cookies are introduced later, they will not be set before the consent required by law has been obtained.
Private visitor records without an analytics cookie
The private Admin dashboard keeps an aggregate page-load counter and a separate encrypted log for eligible public page visits. A detailed record can contain the public route, IP address, an approximate country code where local lookup is enabled, referrer hostname and a search or referral source category. It does not contain query strings, report links, payment references, form contents, user-agent strings or a browser fingerprint.
This server-side feature does not set a visitor-tracking or analytics cookie and does not follow a visitor across other websites. Common automated crawlers are excluded where they identify themselves. Detailed records are scheduled for deletion after 30 days, are capped at 5,000 records, and can be deleted earlier by the administrator.
Necessary session cookie
A first-party PHP session cookie is used for form protection, checkout state, LabBot conversation continuity and private workflow continuity. It is marked HttpOnly and Secure on HTTPS connections, and uses SameSite=Lax protection.
The configured browser lifetime is normally up to two hours. Blocking this cookie can prevent checkout, uploads, contact forms, LabBot and other protected actions from working.
Payment-recovery cookie
After Stripe Checkout is created, a first-party payment-recovery cookie helps the same browser return to an eligible paid upload if the page is closed accidentally. It contains a signed payment reference, not card details or the uploaded evidence.
The browser cookie can remain for up to 30 days and is removed when it is no longer useful or when recovery confirms that the report is unavailable. Report evidence may be deleted much sooner under the report-retention policy.
Google reCAPTCHA
Where enabled, Google reCAPTCHA is loaded on protected forms to distinguish ordinary use from automated abuse. Google may receive technical information and set security-related cookies under its own terms and privacy policy.
reCAPTCHA is used for service and form security, not by Human Response Lab for advertising. Blocking Google scripts or cookies may stop a protected form from being submitted.
Stripe Checkout
When you choose secure payment, you leave this website for a Stripe-hosted checkout. Stripe may use cookies and similar technologies for payment processing, authentication, fraud prevention and regulatory compliance.
Stripe controls the technologies used on its checkout pages. Human Response Lab receives transaction references and payment status, not your complete card details.
Managing cookies
You can delete or block cookies through your browser settings. Necessary features may stop working if you do. Deleting the payment-recovery cookie can also remove the convenient route back to a paid session from that browser.
Review this policy when the published date changes. Questions about website cookies can be sent through the contact page.