ByLocals Storage Technologies Notice

ByLocals Storage Technologies Notice

Draft v1.0 for technical and legal review — publish at bylocals.co.uk/cookies

Effective: [LAUNCH-DATE] · Last revised: 10 Aug 2026 · Operated by Aceman Software Solutions Ltd

This notice explains cookies, local storage, pixels, device signals and similar storage/access technologies (“technologies”) used by ByLocals. The final production inventory, names, providers, durations and purposes must replace every placeholder before launch.

1. Our rule

We use only technologies required to operate/security-protect a feature until you make a valid choice. Optional audience measurement, opted-in repeat measurement and any optional email interaction measurement remain off unless the required consent or another confirmed PECR condition applies.

We do not use cross-site advertising cookies, build advertising profiles or sell technology-derived personal data. Rejecting optional technologies must not reduce Free Core, ranking, correction access or service quality beyond the measurement feature itself.

2. Categories

Category	Examples/purpose	Default	Provisional duration	Legal treatment to confirm
Strictly necessary	Security, load balancing, consent preference, one-time claim/login magic-link state, checkout basket/session, fraud prevention essential to the requested action	On when needed	Session to [30 days], or preference [6 months]	PECR exemption only to the extent genuinely necessary; UK GDPR contract/legitimate interests
Vouch/enquiry abuse protection	Limited device/session signal to enforce one-vouch and abuse controls	Off until feature use; minimized	Raw signal up to [90 days]; derived participant/business limit up to 13 months	Confirm whether each access is strictly necessary; otherwise obtain consent
Basic aggregate audience statistics	Page/event counts configured not to identify or follow a person	[On/off to confirm]	Aggregate; raw up to [90 days]	Confirm the statutory statistical exception conditions and opt-out design before relying on it
Opted-in repeat measurement	A first-party pseudonymous cohort identifier used to understand return visits	Off	Up to 13 months	Express consent; not required for service
Optional communications measurement	Link attribution or message interaction measurement beyond delivery evidence	Off	Up to [90 days] raw	Express consent where required; no invisible open-tracking pixel at launch
Third-party media/maps	Embedded map, video or social content that may let the third party store/access information	Blocked/placeheld until selected	Provider-specific	Consent unless a confirmed exemption applies
Error/performance monitoring	Diagnostic event, IP/device/browser data needed to diagnose failure/security	Minimized	[30–90 days]	Separate necessary diagnostics from optional product analytics; document assessment

3. Production technology register

Populate and expose this table before launch; include SDKs and server-set identifiers, not just browser cookies.

Name	Provider	First/third party	Category and exact purpose	Data accessed/stored	Duration	Activated by	Transfer information
[CONSENT-PREFERENCE-NAME]	ByLocals/[PROVIDER]	First	Remember privacy choice	Choice + timestamp/version	[6 months]	Any choice	[UK/other]
[AUTH-SESSION-NAME]	[AUTH-PROVIDER]	[ ]	Requested sign-in/claim session	Random session/token reference	[ ]	Sign-in/claim	[ ]
[SECURITY-NAME]	[HOSTING/SECURITY-PROVIDER]	[ ]	Essential fraud/security	[ ]	[ ]	Relevant request	[ ]
[ANALYTICS-NAME]	[ANALYTICS-TOOL]	[ ]	[Aggregate/consented repeat]	[ ]	[ ]	[Exception/consent]	[ ]
[ERROR-NAME]	[ERROR-MONITORING-PROVIDER]	[ ]	Diagnostics	[ ]	[ ]	Essential/consent decision	[ ]

No unlisted technology may be shipped. Engineering must generate/test the register from the deployed configuration and network/storage scan at each release.

4. Your choices

The consent interface must provide equally prominent accept optional, reject optional and granular settings, with no preselected optional choices. You can change your choice at [PRIVACY-SETTINGS-LINK]; withdrawal takes effect for future access and triggers deletion/expiry where applicable. Consent receipts record the categories, policy version, time and pseudonymous proof, not more identity than necessary.

Browser blocking/deletion remains available but may also remove necessary sign-in or preference state. Global Privacy Control and similar signals are honoured where legally required and assessed as a privacy preference elsewhere.

5. Email and link measurement

Service messages record delivery/bounce information needed to operate the account. Marketing/open tracking pixels are disabled at launch. Aggregate link redirects may count destination and campaign without building an individual activity profile. Any person-level link history or cross-message measurement requires a disclosed purpose and the required prior choice; it is not inferred from opening an account or consenting to marketing.

6. Device and session data

IP addresses, user agent, timestamps, security events and limited device/session signals may be personal data. We separate:

• short-lived security/fraud evidence necessary to protect the service;
• the 12-month one-vouch-per-business enforcement record tied to a verified participant; and
• optional cohort measurement, which is consented and never used for ranking, pricing or eligibility.

We do not claim that hashing makes data anonymous. Access, salts/keys, rotation and deletion are restricted and logged.

7. Changes and contact

Material new purposes or third parties require a new assessment and, where needed, a renewed choice before activation. See the Privacy Notice for recipients, transfers, retention and rights.

Questions or withdrawal help: [PRIVACY-EMAIL].

---

Version 1.0 · 10 Aug 2026 · draft. Confirm the final stack and UK PECR/DUAA conditions with qualified counsel before publication.