01What this policy covers
This policy covers regulatoryleadership.com, the public website of Regulatory Leadership Partners LLC, and the sign-in pages of our client portal. It lists every cookie and browser-storage entry they can set, the choice that governs them, and how to change it. It supplements our Privacy Policy and forms part of our Terms of Use.
03Before you choose
Until you answer the banner, this site sets no analytics or advertising cookies and stores nothing about you in your browser. No request goes to Google Analytics, Microsoft, Bing or PostHog. Our typefaces are served from our own domain, so reading a page sends nothing to a font provider either.
Once you choose, one strictly necessary entry, rlp-consent, records your answer so we don’t ask again.
Two features set their own strictly necessary cookies, and only where they appear:
- The booking calendar on our contact page, and at the booking step of the proposal tool, is provided by Cal.com. As it loads, Cal.com sets security cookies on its own domain, and the calendar fetches its fonts and the host’s profile picture from Cal.com and Google’s image servers. They are listed in the inventory below.
- The client portal sets sign-in cookies when an invited user signs in. If you never sign in, none of them touches your browser.
04The complete inventory
Measured live on this site on October 12, 2026. “First-party” means set on regulatoryleadership.com; “third-party” means set on the provider’s own domain.
| Name | Set by and where | Purpose | Lifetime |
|---|---|---|---|
| Strictly necessary · always | |||
rlp-consent | This site · localStorage | Remembers whether you allowed or declined analytics. Holds one word. | Until you change it or clear site data |
| Analytics · Google Analytics 4 · only with consent | |||
_ga | Google · first-party | Distinguishes returning visitors with a random identifier. | 2 years; Chrome and other browsers cap it at about 13 months |
_ga_TF6MH5V7TS | Google · first-party | Keeps session state for our Google Analytics property. | Same as _ga |
_ga_8V7BV6ET0K | Google · first-party | Keeps session state for a second Google Analytics data stream that our Google tag also reports to. | Same as _ga |
| Analytics · Microsoft Clarity · only with consent | |||
_clck | Microsoft · first-party | Keeps the Clarity visitor ID and preferences, so visits are attributed to one visitor. | 1 year |
_clsk | Microsoft · first-party | Joins page views by one visitor into a single Clarity recording. | 1 day |
_cltk | Microsoft · sessionStorage | Clarity’s working state for the open tab. | Until you close the tab |
CLID | Microsoft · third-party, www.clarity.ms | Records the first time Clarity saw this browser on any site that uses Clarity. | 1 year |
MUID Advertising | Microsoft · third-party, clarity.ms and bing.com | Identifies the browser across Microsoft sites; Microsoft says it is “used for advertising, site analytics, and other operational purposes.” | 390 days |
MR | Microsoft · third-party, c.clarity.ms and c.bing.com | Flags whether MUID is due to be refreshed. | 7 days |
SRM_B Advertising | Microsoft · third-party, c.bing.com | A Microsoft Advertising cookie that recognizes a returning device for Bing Ads. | 390 days |
SM | Microsoft · third-party, c.clarity.ms | Synchronizes MUID across Microsoft domains. | Session |
ANONCHK Advertising | Microsoft · third-party, c.clarity.ms | Governs whether MUID is passed to ANID, Microsoft’s advertising cookie. Clarity sets it to 0, meaning no transfer. | Session |
| Analytics · PostHog · only with consent | |||
ph_phc_rZM6iiLN4sxKDaNTJXLnfTWd2Hyqxw86wbBJiyucZAhQ_posthog | PostHog · first-party cookie, with a copy in localStorage | A random visitor ID and the current session, so page views can be counted as visits. | 1 year |
| PostHog tab entries | PostHog · sessionStorage | Three working entries for the open tab. | Until you close the tab |
__ph_opt_in_out_phc_… | PostHog · localStorage | Written only if you withdraw consent after allowing it: records that you opted out, so PostHog stays off. | Until you clear site data |
| Attribution · this site · only with consent | |||
rl-attr | This site · localStorage | The first and most recent campaign link or external site that brought you here, sent with a form you later submit. | Until you withdraw consent, which deletes it, or clear site data |
| Booking calendar · Cal.com · strictly necessary, where the calendar appears | |||
__cf_bm | Cal.com (Cloudflare) · third-party, app.cal.com | Bot protection for the booking service. | 30 minutes |
__Secure-next-auth.csrf-token | Cal.com · third-party, app.cal.com | Protects booking requests from forgery. | Session |
__Secure-next-auth.callback-url | Cal.com · third-party, app.cal.com | Routes Cal.com’s own sign-in flow. | Session |
| Client portal · strictly necessary, only when you sign in | |||
__Host-__convexAuthJWT | Our portal · first-party | Proves you are signed in. | 30 days |
__Host-__convexAuthRefreshToken | Our portal · first-party | Keeps you signed in between visits. | 30 days |
__Host-__convexAuthOAuthVerifier | Our portal · first-party | Completes a sign-in securely. | Up to 30 days |
portal-role | Our portal · first-party | Remembers which portal view to show you. | 24 hours |
__convexAuthServerStateFetchTime_… | Our portal · localStorage | Times the refresh of your sign-in state. | Until you clear site data |
Google processes Analytics data on our behalf, and our configuration keeps Google signals and ad personalization switched off, with every Consent Mode advertising flag denied. PostHog processes its data on our behalf, with session recording off and no visitor profiles. The portal reports technical errors to Sentry, which sets no cookies.
05Microsoft’s cookies, plainly
Clarity is different from the other tools, and we would rather say so than leave you to find it. Microsoft’s own documentation describes three of the cookies Clarity brings, MUID, SRM_B and ANONCHK, as serving Microsoft’s advertising and cross-site identity purposes, and running Clarity gives us no setting that switches that off. We tell Clarity that advertising storage is denied, we run no advertising of our own, and none of these cookies exists unless you allow analytics. If that trade is not one you want, decline: the site works exactly the same.
06Change your mind
Your choice is yours to revise, in either direction, at any time. This panel shows your current setting and changes it immediately. Withdrawing consent stops collection on the spot, tells Clarity that consent is withdrawn, and deletes the cookies and storage this page can reach: the first-party Google Analytics, Clarity and PostHog cookies and the attribution entry. Cookies on Microsoft’s own domains stop being used once the scripts stop loading, but a page on our domain cannot delete them; your browser’s settings can.
07Global Privacy Control and Do Not Track
We honor both signals the strong way. If your browser sends Global Privacy Control or Do Not Track, we treat it as a declined banner: you are never asked, and none of the analytics tools loads.
The only exception is your own explicit choice. If you allow analytics with the panel above, or allowed it in this browser before you turned the signal on, that choice stands until you change it here.
08Verify it yourself
We spend our working lives being audited, so we won’t object if you audit us. In Chrome or Edge, open Developer Tools, choose the Application tab and expand Cookies and Local storage. Before you answer the banner, there is nothing for this site. Decline, and only rlp-consent appears. Allow analytics, and you will find the first-party cookies listed above on regulatoryleadership.com, and the rest under the clarity.ms and bing.com entries. In Firefox use the Storage tab; in Safari, enable the Develop menu and use Storage. The Network tab works too: nothing is requested from google-analytics.com, googletagmanager.com, clarity.ms, bing.com or posthog.com until you click Allow.
If you ever find more than we disclose here, tell us. We will treat it as a deviation, correct it, and record the correction below.
09Outbound links
Where this site links elsewhere, such as LinkedIn, regulators’ sites and cited sources, those destinations set their own cookies under their own policies once you arrive. We don’t control them, and we receive nothing from them about your visit.
10Changes and revision history
If we add a cookie, it is listed here by name, purpose and lifetime before it ships, with consent requested wherever the law requires it. The effective date above always shows the current version. We keep the history in the open, including our own mistakes:
- Full re-measurement. Added the second Google Analytics stream (
_ga_8V7BV6ET0K), which declining now also deletes; the Cal.com booking-calendar cookies; corrected portal sign-in cookies (30 days, not session-length); and Clarity’s tab storage. Campaign attribution (rl-attr) had been stored without consent since September 14; it now waits for consent. Removed an outdated statement that a typeface loads from Google Fonts: our fonts are self-hosted. - PostHog added, behind the same consent choice, and listed here the same day.
- Microsoft Clarity had been added on August 4 without a matching update here and without the consent gate that already governed Google Analytics. We corrected both together: Clarity now waits for consent and its cookies are listed.
- First published, the day we adopted Google Analytics, in the same release as the cookies it introduced.
11Contact
Questions about cookies or tracking go to an inbox a person actually reads:
Regulatory Leadership Partners LLC
30 N Gould St Ste N, Sheridan, Wyoming 82801, USA
hello@regulatoryleadership.com