Cookie Policy

INTERNAL STAGING TEST DOCUMENT — NOT FOR PRODUCTION USE COOKIE POLICY This Cookie Policy explains how BusinessManager Staging Sandbox - Internal Evaluation Only uses cookies, local storage, and similar browser technologies in connection with BusinessManager and related web properties. 1. WHAT THESE TECHNOLOGIES ARE Cookies are small data files stored by a browser. Similar technologies may include local storage, session storage, or comparable browser mechanisms. They can support authentication, security, preferences, service operation, and—where enabled—analytics or other optional functionality. 2. STRICTLY NECESSARY TECHNOLOGIES BusinessManager may use technologies required for sign-in, session continuity, account switching, authorization, security, anti-forgery protection, load or request integrity, and other functionality necessary to provide the service. Blocking these technologies may prevent core features from functioning. 3. PREFERENCE TECHNOLOGIES Where enabled, preference storage may remember settings such as interface choices, display preferences, or other user-selected options. Preference technologies should not be treated as strictly necessary when the service can reasonably operate without them. 4. ANALYTICS AND OPTIONAL TECHNOLOGIES If analytics, measurement, advertising, or other non-essential technologies are introduced or enabled, their purpose, provider, and applicable choice mechanism should be disclosed before they are used where required by law. Optional technologies must not be categorized as essential solely for convenience. 5. THIRD-PARTY TECHNOLOGIES Connected or embedded third-party services may set or read their own browser technologies when their functionality is used. Their practices are governed by their own terms and privacy notices. The presence of an integration does not mean every third-party technology is active for every user. 6. COOKIE CHOICES Users can use browser settings to block or delete cookies and related storage. Where applicable law requires additional consent or preference controls, those controls should be provided in the service. Disabling essential technologies may prevent sign-in or other protected functionality. 7. GLOBAL PRIVACY OR BROWSER SIGNALS Where a legally recognized browser-based privacy signal applies to optional technologies used by BusinessManager, the service should honor that signal as required by applicable law and technical capability. 8. SECURITY AND AUTHENTICATION Authentication and security cookies should be protected using appropriate browser security attributes and should contain only the information necessary for their operational purpose. Sensitive payment credentials are not stored in BusinessManager cookies. 9. CHANGES TO THIS POLICY Published revisions identify their version and effective date. This policy may be updated when technologies, providers, product functionality, or legal requirements change. 10. CONTACT Questions about browser technologies used by BusinessManager may be sent to legal-evaluation@businessmanager.com or 305-000-0000. Additional information is available at https://localhost:7167. 11. CONFIGURED BROWSER-TECHNOLOGY SNAPSHOT This version was generated from the service configuration then in effect. The snapshot is preserved in this legal version and is not dynamically rewritten if configuration later changes. Optional-technology posture at draft generation: analytics=off; advertising=off; non-essential browser technologies=off. Configured browser-technology inventory at draft generation: - BusinessManager.Auth | Category: Strictly necessary authentication | Purpose: Maintains the signed-in BusinessManager application session and authorization context. | Retention: Up to 8 hours with sliding expiration, subject to sign-out and security-stamp revalidation. | Scope: First-party secure HttpOnly cookie - BusinessManager.ActiveMembership | Category: Strictly necessary account context | Purpose: Remembers the selected business/workforce membership so one login can safely switch between authorized accounts. | Retention: Session-only in some flows or up to 30 days when the selected context must persist. | Scope: First-party secure HttpOnly cookie - BusinessManager.PortalBusiness | Category: Strictly necessary portal context | Purpose: Keeps the authenticated customer portal scoped to the selected business and its branding/context. | Retention: Up to 30 days while the portal business context remains selected. | Scope: First-party secure HttpOnly cookie - __Host-BusinessManager.Antiforgery | Category: Strictly necessary security | Purpose: Pairs with anti-forgery form/request tokens to protect state-changing requests from cross-site request forgery. | Retention: Security/request lifecycle as managed by ASP.NET Core and the browser. | Scope: First-party security cookie - ASP.NET Core Identity temporary security cookies | Category: Strictly necessary account security | Purpose: Supports temporary identity flows such as multi-factor authentication and other protected sign-in transitions. | Retention: Short-lived for the applicable identity/security flow. | Scope: First-party security cookies