On the first visit (when no choice is stored), a modal titled Your privacy choices explains:

• Essential cookies always run (sign-in, security, basic operation).
• Optional cookies support analytics and functional features such as social sign-in.

Actions:

• Reject non-essential: only necessary cookies.
• Accept all: allow analytics and functional cookies per your enabled integrations.
• Cookie settings: granular toggles for Functional and Analytics.

The Privacy policy link opens in a new browser tab. A cookie icon on the page reopens settings later.

• Necessary: Session, authentication
• Functional: OAuth state for Google/Facebook login
• Analytics: Google Analytics (if enabled)

1. Maintain accurate Privacy policy text under Site content.
2. List third parties: Google Analytics, Google/Facebook login, payment gateways, video providers, WhatsApp.
3. Enable Google Analytics and social login only when legally and contractually allowed.
4. Train staff not to embed third-party trackers in rich text without review.

Analytics loads only when:

• An administrator enabled it under Site header, and
• The visitor consented to analytics (or accepted all).

See Google Analytics.

Google and Facebook sign-in expect functional consent. Visitors who reject non-essential cookies may need to use email/password instead.

See Social login.

When students or staff are signed in, consent preferences may sync to the server so choices persist across devices (subject to your deployment).

• Site header and footer
• First steps for administrators