Cookie notice
The service currently uses only essential authentication, security, and language-preference cookies; it does not use advertising or optional analytics cookies.
- Effective date
- August 1, 2026
- Version
- 2.0
1. What this notice covers
This notice explains cookies used by the public website, customer centre, and admin area. A cookie is a small value stored by the browser and returned to the relevant website. Similar browser storage, if introduced for a comparable purpose, will be described here or in an updated notice.
2. Current cookie list
| Cookie | Purpose | Typical duration | Category |
|---|---|---|---|
| bf_access | Authenticates the current signed-in request | 15 minutes | Strictly necessary |
| bf_refresh | Renews an eligible signed-in session | 30 days | Strictly necessary |
| bf_csrf | Helps prevent cross-site request forgery | 30 days | Strictly necessary |
| bf_locale | Remembers the selected interface language | 1 year | Preference / necessary for the requested language |
3. Essential authentication cookies
bf_access and bf_refresh keep authorised customer and administrative sessions working. They are used to provide an account feature you request, not to build advertising profiles. Expiry does not guarantee that a session remains valid until that time: credentials may be rotated or revoked earlier for sign-out, security, account, or administrative reasons.
4. Security cookie
bf_csrf supports verification that a state-changing browser request came from the expected site. Disabling or removing it can prevent forms and other write operations from completing. Cookie protections such as Secure, HttpOnly, and SameSite are applied where appropriate to the cookie's function and production environment.
5. Language preference
bf_locale remembers the language you selected so that subsequent visits and account pages can use that preference. Removing it does not block the public site, but the service may return to its default language or infer a language again.
6. No advertising or optional analytics cookies
This version of the service does not set advertising, cross-site tracking, or optional analytics cookies. There is therefore no optional-cookie consent switch in the current interface. We will update this notice and, where required, provide a consent choice before enabling a non-essential cookie or comparable tracker.
7. Third-party services
Cloudflare R2, Purelymail, payment providers, and other delivery infrastructure may process network or service data when their features are used, but they are not represented here as setting the four first-party cookies above. If a linked external payment, email, or other site sets its own cookies, that site's notice and controls apply to its domain.
8. Browser controls and consequences
You can inspect, block, or delete cookies in browser settings. Blocking essential cookies may prevent sign-in, session renewal, protected form submission, customer-centre access, and admin operations. Deleting them signs you out or removes the remembered language. Browser privacy signals are respected where required by applicable law, although the current cookies are not used for sale or behavioural advertising.
9. Updates and contact
The cookie names, purposes, and durations above describe the current implementation and may change for security or product reasons. A material change, especially the introduction of optional tracking, receives an updated notice and effective date. Contact us through the website if you have a cookie or privacy question; applicable law takes priority where it requires additional information or choice.