Cookie Policy
This policy explains the cookies and similar technologies used by Free Business Directory, their purposes and durations, and how to manage your choices. Necessary technologies support requested services; optional technologies remain off until you choose them.
Who we are
Free Business Directory is operated by BRIGHT MARKETLY LTD (company number 16545126), registered in England and Wales, with its registered office at 67 Fernhead Road, London, England, W9 3EY.
Our Privacy Policy explains how we handle personal data. Cookie settings are available on the site so visitors can change or withdraw optional choices.
Current technology inventory
The same application inventory appears here and in the Cookie Policy page.
| Name / technology | Provider | Purpose and context | Category | Duration | Consent |
|---|---|---|---|---|---|
| _ga, _ga_ESF8489BKC | Google Analytics 4 (Google) | Measures public page visits with pseudonymous visitor/session identifiers. Loads independently of the cookie banner. Measurement ID: G-ESF8489BKC. The official Google tag loads directly on public routes without waiting for a cookie choice. This describes the current implementation, not a finding that consent is legally unnecessary. Google receives technical connection data, including the IP address needed to receive the request. Advertising features are disabled by the application configuration. Manual page views omit names, contact details, queries, fragments and referrers; dynamic slugs are replaced with route labels. Enhanced Measurement settings are managed separately in Google Analytics. Google privacy information: https://policies.google.com/privacy. | Analytics | Up to 90 days. | Not required for the stated purpose |
| fbd_analytics_visitor (localStorage key) | Free Business Directory (first party) | Counts anonymous visitors, page and business profile views, claim clicks and website-service banner clicks. Random first-party identifier, activated only with Analytics consent and removed when withdrawn. No account identifiers, full IP addresses, referrer paths or URL query parameters are saved. Country is determined by an offline server lookup using GeoLite2 data created by MaxMind (https://www.maxmind.com). | Analytics | 90 days; anonymous daily visitor hashes kept for 35 days and daily totals for 90 days. | Choice required |
| admin_session | Free Business Directory (first party) | Authenticates an administrator API session. HttpOnly, SameSite=Lax cookie scoped to /api; the token is not readable by page JavaScript. Basis: Strictly necessary for the administrator-requested sign-in service and session security. | Necessary | 12 hours | Not required for the stated purpose |
| business_owner_session | Free Business Directory (first party) | Authenticates a business owner API session. HttpOnly, SameSite=Lax cookie scoped to /api; the token is not readable by page JavaScript. Basis: Strictly necessary for the business owner-requested sign-in service and session security. | Necessary | 12 hours | Not required for the stated purpose |
| fbd_cookie_consent (localStorage key) | Free Business Directory (first party) | Remembers the visitor’s cookie-category choices and consent version. First-party preference record; it must not be used for analytics, advertising, or account identification. Basis: Strictly necessary to remember the visitor’s own privacy choice. | Necessary | 180 days | Not required for the stated purpose |
| fbd_cookie_consent_history (localStorage key) | Free Business Directory (first party) | Maintains a limited audit history of changes to cookie choices. Consent administration only; do not associate this record with an account ID. Basis: Limited record of privacy choices for consent administration; minimize to the anonymous identifier and preference changes. | Necessary | Up to 20 changes, retained for 180 days | Not required for the stated purpose |
| email-code-cooldown:{purpose}:{email} | Free Business Directory (first party) | Remembers the sign-in-code resend countdown in the current browser tab. When Functional is off, the user-interface timer is memory-only. With Functional enabled, its sessionStorage key includes the entered email; consent withdrawal removes all email-code-cooldown:* keys even when the sign-in component is unmounted. Server-side rate limits remain authoritative. | Functional | 60-second countdown; in memory without Functional consent, otherwise sessionStorage until the tab is closed | Choice required |
| commercial-refund-operation:v1:{adminUserId}:{businessId}:{requestKey} | Free Business Directory (first party; administrator tools only) | Allows an administrator to recover the exact in-progress refund request and avoid duplicate refunds. localStorage is only read or written in the administrator commercial refund workflow; it can contain the refund reason, invoice/payment reference, and administrator/business IDs. This is restricted to administrators, not ordinary directory browsing. Basis: Strictly necessary to safely recover an administrator-requested refund operation. | Necessary | Until the administrator removes the saved operation; no automatic expiry is implemented | Not required for the stated purpose |
| DM Sans and Outfit self-hosted WOFF2 files | Free Business Directory (first party; OFL-licensed font files) | Provides the typefaces used for the site’s typography. The Latin and Latin Extended WOFF2 subsets are hosted under /fonts. The active Google Fonts stylesheet import and fonts.googleapis.com / fonts.gstatic.com preconnects have been removed, so font loading no longer contacts Google. Basis: No PECR exception is relied upon; fonts are served as ordinary first-party site assets. | Functional | Browser cache follows the site asset response; deployment cache headers apply | Not required for the stated purpose |
| Uploaded profile, gallery, article, and category-icon images | App Storage object-storage backend; actual external storage provider/host depends on the configured signed URL (manual review) | Displays uploaded business profile and category imagery. The client uses same-origin /api/owner/media/{id} and /api/icons/{id} URLs; those API routes redirect the browser to runtime-generated signed object-storage URLs. The external host is not present in the tracked configuration and is intentionally not guessed. All external HTTP(S) image URLs, these API redirect paths, and srcSet candidates are withheld until Functional consent by ConsentImage in public business profiles, CategoryCard, and public article image components; inline article-body images and crawler HTML are also withheld. First-party static image assets and data/blob URLs remain available. Provider identity and storage/cookie behavior remain manual review; no exemption is asserted. | Functional | Signed image URL expires after 15 minutes; image cache lifetime/provider cookies are unverified (manual review) | Choice required |
| Business profile and contact interaction events | Free Business Directory (first party) | Records business profile views and website/email contact interactions for listing metrics. The client POSTs business_profile_view on profile display, website_click on website link activation, and email_click after a successful contact request only when the analyticsAllowed gate is true. The profile-view effect also re-runs its consent dependency; these first-party event requests do not themselves use browser storage. | Analytics | Server-side retention is not confirmed; manual review required | Choice required |
| OpenStreetMap tiles and Leaflet map resources | OpenStreetMap Foundation; Leaflet is bundled open-source software | Displays a requested business-location map. The map, its stylesheet/module, and tile requests must remain unloaded until Functional consent is available. Map tiles are requested from tile.openstreetmap.org. | Functional | Provider-controlled cache; manual review required | Choice required |
| Postcodes.io postcode lookup | Postcodes.io | Looks up an approximate postcode centroid when a business has no coordinates. Requested only as part of the Functional-consent-gated map flow; it is not called when usable coordinates are already present. | Functional | Provider-controlled; manual review required | Choice required |
| Stripe-hosted Checkout and Billing Portal | Stripe | Processes a business owner’s explicitly requested subscription checkout or billing-portal visit. The application creates Stripe sessions server-side and opens the returned Stripe-hosted URL only after the user starts checkout or opens the billing portal. No Stripe.js SDK, pixel, or embedded Stripe checkout is present in the inspected client source; cookies on Stripe-hosted pages are outside this site’s source inventory. Basis: Technologies strictly necessary to carry out a payment or billing service expressly requested by the user. | Necessary | Provider-controlled; manual review required | Not required for the stated purpose |