Cookie Policy
On this page
This policy explains the cookies and similar technologies (such as local storage) that Branded Mark Limited ("BrandedMark", "we") uses on:
- our website, brandedmark.com (section 3);
- the BrandedMark app that our customers' staff sign in to (section 4);
- brand portals and product passports that consumers reach by scanning a product, on *.brandedmark.app or a brand's own domain (section 5).
On brand portals, the brand is responsible for the portal and its privacy notice. We supply the technology and set the cookies on the brand's behalf.
1. What cookies are
A cookie is a small text file a website asks your browser to store. Local storage is similar, but it stays in your browser and is not sent to the server with each request. Both are covered by the same law, and in this policy "cookies" means both.
2. The rules we follow
- Strictly necessary cookies (for sign-in, security, keeping a form working, remembering a choice you made) do not need your consent anywhere. We still tell you about them.
- UK visitors: since 5 February 2026, the Privacy and Electronic Communications Regulations (as amended by the Data (Use and Access) Act 2025) allow some cookies without consent but with a simple way to object. These are cookies used only to measure use of our own service in aggregate (statistics), or only to remember how you want a page to look or behave (appearance). We use this exception only where a cookie's sole purpose fits it, and never for advertising.
- Visitors from the EU/EEA and Switzerland: we ask for your consent before setting any cookie that is not strictly necessary, including analytics.
We do not use advertising, retargeting or cross-site tracking cookies on any of our sites.
3. Our website (brandedmark.com)
3.1 Cookies and storage on the website
Both are set by us, only in your browser, and are strictly necessary.
| Cookie | What it's for | How long |
|---|---|---|
bm_analytics_optout (local storage) |
Remembers that you opted out of analytics. Only set if you opt out | Until you clear it |
bm_demo_email (local storage) |
Remembers the work email you entered to open the interactive demo, so you don't have to re-enter it | Until you clear it |
Security. Cloudflare protects our website from attacks and abuse. On a normal visit it sets no cookies. If it needs to check that a visitor is a person and not an automated bot, it may set a short-lived security cookie such as __cf_bm or cf_clearance. These are strictly necessary and are used only for that check.
Analytics without cookies. We measure use of the website with Cloudflare Web Analytics only. It counts page views, referrers, countries, device types and page speed. It sets no cookies and uses no local storage or fingerprinting. It does not track you across sites or build a profile of you, and Cloudflare reports to us only in aggregate.
Because this measurement is used only to produce statistics about our own website, UK law allows it without consent provided we tell you and give you a simple way to object. You can opt out at any time (section 3.2). For visitors from the EU/EEA and Switzerland, we rely on the same safeguards that EU regulators accept for exempt audience measurement: aggregate-only, no cookies, no cross-site tracking, and an easy opt-out.
Fonts. Our website serves its typefaces from our own servers, so your browser doesn't contact a third party to load them, and fonts set no cookies. These legal pages use fonts already on your device.
3.2 Opting out of analytics
Use Opt out of analytics in the footer of our website's main pages. The analytics script then stops loading in that browser, and the choice is remembered in local storage (bm_analytics_optout). Use the same control to switch analytics back on. If your browser sends a Global Privacy Control signal, we treat it as an opt-out automatically and the script never loads. There is no cookie banner, because the website sets no cookies that need consent.
4. The BrandedMark app (for our customers' staff)
The app uses only strictly necessary cookies. There are no analytics or advertising cookies in the app.
All of these are strictly necessary.
| Cookie | What it's for | How long |
|---|---|---|
.BrandedMark.Admin |
Keeps you signed in (secure, HTTP-only, same-site) | 7 days, renewed while you are active |
Identity.ReAuth |
Confirms you signed in recently before a sensitive change, such as a password or security setting | 5 minutes |
Identity.ContactChange |
Holds a pending change to your email or phone while you confirm it | Until the change completes (minutes) |
Identity.StatusMessage |
Shows a one-off confirmation message after an account action | Single page view |
Identity.TwoFactorUserId, Identity.TwoFactorRememberMe |
Completes two-factor sign-in, and remembers a trusted browser if you choose | Session / up to 14 days |
.AspNetCore.Antiforgery.* |
Protects forms against forged requests | Session |
.AspNetCore.Culture |
Remembers your language | 1 year |
| Local storage (designer, help panel, search and layout preferences) | Remembers app layout and editor preferences on your device | Until you clear it |
5. Brand portals and product passports (for consumers)
These pages are run by the brand whose product you scanned. The brand's privacy notice, linked on every page, explains how it uses your data. We set the cookies below on the brand's behalf.
We set these for the brand. All are strictly necessary, except video cookies, which need your consent.
| Cookie | What it's for | How long |
|---|---|---|
__Host-bm_signin |
Keeps you signed in to your account with the brand | 7 days |
Identity.ReAuth |
Confirms a recent sign-in before a sensitive change | 5 minutes |
sessionId |
Identifies your visit and your guest basket, and limits abuse | 400 days |
bm_tenant |
Remembers which brand's portal you were on | 30 days |
bm_tz |
Your time zone, so dates display correctly | 1 year |
.AspNetCore.Culture |
Your language | 1 year |
.AspNetCore.Antiforgery.* |
Protects forms against forged submissions | Session |
bm_consent |
Records your cookie choice for embedded videos | 6 months |
__stripe_mid, __stripe_sid |
Set by Stripe's fraud-prevention script, which loads on brand portal pages, to help prevent payment fraud | 1 year; 30 minutes |
| YouTube and Vimeo cookies | Set only when an embedded video plays (set by YouTube (Google), Vimeo) | Set by the provider |
Videos. YouTube videos load from youtube-nocookie.com, which sets no cookies until the video plays, and Vimeo is told not to track you. Visitors from the UK, EU/EEA or Switzerland see a placeholder until they accept optional cookies. Pressing play on a video counts as accepting them for videos from then on. You can change your choice at any time from Cookie choices on the portal.
Local storage. Brand portals keep a few settings on your device, such as the addresses the page needs to start up and whether you have already rated a page. These stay in your browser.
Brand portals use no analytics or advertising cookies.
6. How to control cookies in your browser
You can block or delete cookies in your browser settings. Help pages: Chrome, Safari, Firefox, Edge. If you block strictly necessary cookies, sign-in and checkout will not work.
7. Changes and contact
We update this policy whenever we add, remove or change a cookie, and record each change in the version history below. For questions, or a copy of an earlier version, email [email protected]. How we use personal data more generally is explained in our Privacy Policy.
Version history
| Version | Date | Change |
|---|---|---|
| 1.0 | 20 October 2026 | First published version. |
| 1.1 | 20 October 2026 | Our website serves its own fonts, so Google Fonts is no longer used; clarifications. Replaces 1.0 before it takes effect. |