Cookie and Tracking Notice
1. The Short Version
A cookie is a small file a site stores in your browser. A pixel, tag, SDK, or beacon does a similar job by loading a tiny resource from another company. All of them let a site remember something or measure something, and some of them let another company see that you were here.
On Banrox, only the technologies needed to make the site work and keep it secure run without asking you. Everything else waits for your choice in the banner. If you never answer the banner, nothing beyond strictly necessary loads.
What that means in practice. No analytics, no advertising tag, no session recording, and no social pixel fires on your first visit unless and until you accept it. Declining costs you nothing: every feature on this site works with only the strictly necessary category enabled.
2. The Categories We Use
| Category | What it does | Runs before consent | Typical life |
|---|---|---|---|
| Strictly necessary | Keeps you signed in, holds your form as you fill it, balances traffic, blocks bots and denial of service attacks, remembers your cookie choice, protects against cross site request forgery | Yes. The site cannot function without these and the law does not require consent for them. | Session to 12 months |
| Functional | Remembers preferences such as a saved calculator input, a dismissed banner, or a chosen comparison filter | No | Up to 12 months |
| Analytics and performance | Counts visits, measures which pages work, finds broken journeys and slow pages, in aggregate | No | Up to 25 months |
| Session behaviour | Heat maps and session replay, where used, to see where a page confuses people. Keystrokes in any field, and the content of any field, are masked at source and never recorded. | No | Up to 12 months |
| Advertising and cross site | Measures whether an advert worked and, if you allow it, lets an advertising network show you a Banrox advert elsewhere | No | Up to 13 months |
The specific vendor behind each category, and what each is contractually barred from doing, is listed at Service Providers and Data Recipients. That page is updated in the same release as any change to the tags on this site, so the two never drift apart.
3. What We Do Not Do
- We do not record what you type into any field. Form inputs are masked before anything leaves your browser.
- We do not load an advertising or analytics tag on a page where you are viewing your credit report, your score, your identity alerts, or your account details. Those pages carry strictly necessary technologies only.
- We do not pass your name, email, phone number, or any identifier derived from them to an advertising network.
- We do not use device fingerprinting for advertising. We use device signals only to detect fraud and account takeover, which is a strictly necessary security purpose.
- We do not sell cookie derived data.
4. How to Change Your Mind
- Cookie settings. Open the cookie preferences link in the footer at any time. Withdrawing is exactly as easy as consenting, and takes effect immediately.
- Global Privacy Control. If your browser sends a GPC signal we treat it as a withdrawal of consent for advertising and as an opt out of sale and sharing, and we do not ask you again.
- Your browser. Every major browser can block or delete cookies. Blocking strictly necessary cookies will break sign in.
- Your account. Signed in members can set the same preferences in Privacy Settings, and the choice follows the account across devices.
We do not respond to legacy Do Not Track browser headers, because the industry never agreed a standard for what a site should do with one. We say so here rather than stay silent about it. Global Privacy Control is the signal that works.
5. Chat, Support Tools and Recordings
If a live chat or support widget is present, the conversation is stored so we can answer you and resolve disputes, and the widget provider processes it on our behalf under contract. Telephone calls may be monitored or recorded for quality, training and dispute resolution where the law allows, and where the law requires consent you will be told at the start of the call and may decline without losing service.
6. Why This Page Exists
Website tracking is regulated by state privacy statutes, by the California Invasion of Privacy Act and equivalent state wiretap laws, and by the Federal Trade Commission Act. Those laws turn on what a visitor was told and what a visitor agreed to. This page exists so the answer to both questions is on the record, in language a person can actually check against what the site does.
If you believe a technology on this site is doing something this page does not describe, write to [email protected]. We will look, and if the page is wrong we will fix the page or the tag, and tell you which.