This Cookie Policy describes the cookies and related browser technologies verified on the current MECHPLY WordPress website. The audit covers the public Homepage, Capabilities, Services, How It Works, Request a Quote, and Contact pages. Production hosting and infrastructure services must be checked again before this draft is approved and published.
1. What cookies and related technologies are
Cookies are small text files stored by a website in a browser. They can support security, session continuity, preferences, authentication, analytics, or advertising. Related technologies include local storage, session storage, pixels, software development kits, device identifiers, and browser-accessible databases.
2. Cookies verified for public visitors
| Name | Provider | Purpose and data | Duration | Attributes | Category |
|---|---|---|---|---|---|
mechply_rfq_session |
MECHPLY website (first party) | Contains a random 128-bit session identifier. It does not contain contact details, project data, filenames, or quotation content. It binds the signed RFQ form token to the requesting browser and is required for cross-site request and automated-abuse protection. Without it, the server rejects the RFQ submission session. | 2 hours from first issue; it is not renewed on every page request. | Path /; HttpOnly; SameSite=Lax; Secure whenever WordPress correctly detects HTTPS. It is not readable by frontend JavaScript. |
Strictly necessary for the Request a Quote service and its security. Consent is not requested for this cookie. |
The cookie is set only when the Request a Quote page is opened and the browser does not already hold a valid RFQ session identifier. The page is marked private and no-store to prevent a cache from sharing form-session data.
3. Administrator cookies
WordPress may set authentication and test cookies, with names such as wordpress_*, wordpress_logged_in_*, or wordpress_test_cookie, when an authorized administrator uses the WordPress login or administration area. These are not set by the MECHPLY theme for ordinary logged-out visitors and are used for authentication and security.
4. Other technology verified in the audit
- The essential-cookie information notice writes
mechplyEssentialCookieNoticeDismissed=1to first-party session storage only after a visitor selects “OK, understood”. It prevents the same informational notice from reappearing during that browser-tab session. It contains no identifier or consent status, is not sent with HTTP requests, and is removed when the tab session ends. - The theme does not write to browser local storage.
- No browser database, service worker, analytics library, advertising pixel, social tracker, external web font, third-party iframe, video embed, chat widget, map embed, or marketing technology was found.
- All public CSS, JavaScript, icons, and images are loaded from the MECHPLY website origin.
- Inline structured-data and WordPress internal-navigation speculation rules do not set cookies or send data to a third-party origin.
- The Contact form uses a WordPress nonce, hidden honeypot, and a server-side rate-limit transient keyed by a one-way IP-derived hash. It does not set a Contact form cookie.
- The RFQ endpoint also uses server-side rate-limit and duplicate-submission records. These server-side records are not browser cookies or browser storage.
- Public MECHPLY templates do not expose a comment form. If WordPress comments are introduced later, comment-related cookies must be audited and added to this policy before use.
5. Why there is no cookie banner
The audited public website uses only the strictly necessary RFQ session cookie and the session-scoped notice-dismissal preference described above. No analytics, advertising, personalization, or other non-essential browser technology was found, so a cookie-consent banner has not been installed. The small informational notice does not ask for, record, or imply consent. If a non-essential technology is introduced, it must not load or access a user’s device until any legally required consent has been obtained.
6. Managing cookies
You can inspect, delete, or block cookies through your browser settings. Blocking mechply_rfq_session prevents the secure Request a Quote form from being submitted because the server cannot verify the anonymous form session. General content pages and the Contact form do not require this cookie.
7. Reassessment when external services are added
Before adding any external service, MECHPLY must document the provider, domains contacted, cookies or browser storage used, purposes, data received, retention, legal basis, international transfers, and whether the service can operate without consent. The assessment must be repeated in an anonymous browser and on every public page.
- Google Analytics or another analytics service: treat it as non-essential unless a qualified review establishes otherwise. Keep analytics scripts and tags blocked before any required analytics consent, configure data minimization, document provider and transfer terms, and provide an equally prominent way to refuse and later withdraw consent.
- Meta Pixel, advertising pixels, or remarketing tags: classify them as marketing technologies and block the script, pixel request, cookies, and related event transmission until valid marketing consent is recorded.
- YouTube, Vimeo, maps, or other embeds: use a local placeholder or click-to-load component so the third party receives no request before the applicable choice. Privacy-enhanced modes must still be tested rather than assumed to be consent-free.
- CAPTCHA, chat, CRM forms, A/B testing, heatmaps, CDNs, or hosted fonts: audit every request and storage mechanism before activation. If consent is required, load the integration only after the relevant category is accepted.
When consent-requiring technology is introduced, implement category-specific prior blocking, an accessible choice with reject and accept controls, withdrawal as easy as acceptance, consent-record retention, and an updated Cookie Policy before deployment. A consent banner by itself is not sufficient if the underlying requests load before the user’s choice.
8. Server-side logs and production services
Cookies are not the same as server logs. The production hosting, reverse proxy, CDN, security, email, or monitoring providers may record IP addresses, timestamps, user-agent information, request URLs, and security events or may inject additional browser technology. These production services have not yet been verified and must be added to the inventory before publication if present.
Production must use HTTPS and must be configured so WordPress correctly detects HTTPS, including behind a trusted reverse proxy. This is required for the RFQ cookie to carry the Secure attribute. Production response headers must be tested after deployment.
9. Contact and changes
For privacy questions, contact info@mechply.com. Repeat this audit after changes to WordPress plugins, themes, embeds, hosting, CDN, analytics, advertising, consent tools, or frontend scripts. An approved revision date will appear at the top of this page after legal review.