- Essential cookies only, unless you agree to analytics.
- No advertising cookies, ever.
- Analytics never runs while you are signed in.
- You can change your mind at any time.
Our approach
We use strictly necessary cookies, the ones needed to sign you in and keep your session secure. Only if you agree, we also use Google Analytics to understand how our public pages are used. We do not use advertising or marketing cookies, build advertising profiles, or share data with ad networks.
Strictly necessary cookies do not need consent under the Privacy and Electronic Communications Regulations 2003. Analytics cookies do, so we ask first. Until you choose Accept analytics, no Google Analytics script is loaded and no analytics cookie is created. If you choose Essential only, it stays that way, and the site works exactly the same.
Analytics never runs while you are signed in. It is limited to our public pages: the home page, sign-up, the affiliate page and our legal pages. It is not present in the client portal or the staff application, so no page about your own tax affairs is ever reported to Google.
Cookies we set
| Name | Type | Purpose | Expiry |
|---|---|---|---|
oa-session | Strictly necessary | Keeps you signed in. Holds a session token that our server checks, never your password. First-party, HttpOnly and Secure. | 8 hours, or when you sign out |
| HMRC sign-in cookies | Strictly necessary | Set by HMRC's own sign-in service while you authorise us as your agent, to secure that step. | End of the authorisation |
_ga | Analytics, with consent | Google Analytics: tells visits from different browsers apart. Public pages only. | 2 years |
_ga_M1TJYT4EXD | Analytics, with consent | Google Analytics: keeps track of the current visit. Public pages only. | 2 years |
Browser storage
We also keep a little data in your browser's local or session storage. This is not a cookie. It stays on your device and is never sent to third parties.
| Key | Purpose |
|---|---|
oa-cookie-consent | Remembers your cookie choice, so the notice is not shown on every visit. |
ola-lang | Remembers whether you chose English or Romanian. |
ola-ref | Keeps the referral code from an affiliate's link you followed, so it can be sent with your sign-up and the affiliate credited. |
ola-service | Remembers which service you picked before signing up, so the portal opens on it. Removed once used. |
oa-paid-ack-… | Remembers that you have seen a one-time payment confirmation in the portal. |
ola-z017-editreq-… | Remembers that you have an open request to correct a submitted residence case. |
oa-mtd-device | A random device identifier that HMRC's fraud prevention rules require us to send with Making Tax Digital submissions. Required by HMRC; not used for tracking. |
ola-z017-pre (session storage) | Keeps your eligibility pre-check answers while you finish signing up. Cleared when the tab closes. |
oa-client (session storage) | Staff only: remembers which client record was last open. Cleared when the tab closes. |
Third-party services
Our pages load fonts from Google Fonts and icons from cdnjs (Cloudflare). Card payments go through Stripe, on Stripe's own checkout page, so card details never touch our systems. With your consent, we measure use of our public pages with Google Analytics (Google Ireland Limited). We do not enable Google Signals, advertising features or data sharing for advertising.
When your browser loads these resources, your IP address is shared with the provider so it can deliver them. Analytics data may be processed outside the UK under Google's safeguards. Our Privacy Notice lists every provider we use.
Managing your choice
You can reopen your cookie choice at any time. This clears any analytics cookies already set and asks you again.
You can also control or delete cookies in your browser settings. Blocking the strictly necessary ones may stop you signing in or completing HMRC authorisation. Clearing your browser's local storage resets the cookie notice and the preferences listed above.
Changes to this policy
We added Google Analytics to our public pages in August 2026 and asked for consent before setting it, as the earlier version of this policy promised. If we add further non-essential cookies we will do the same again. Changes are shown by the date at the top of this page.