Cookie Policy

Last updated: 17 August 2026 Effective from: 10 August 2026

1. About this Policy

This Cookie Policy explains how BOB O JOB LTD ("bob-o-job", "we", "us", "our") uses cookies and similar technologies on our website at www.bob-o-job.com and in our mobile apps.

It sits alongside our Privacy Policy, which explains how we handle personal data more generally. Where this Cookie Policy and the Privacy Policy differ, this Cookie Policy is the more specific document for matters about cookies.

Strictly necessary cookies are used without consent (they are exempt under PECR because the Platform cannot work without them). Non-essential cookies are only set if you choose to allow them via our cookie banner, and you can change that choice at any time.

2. What cookies are

A cookie is a small text file that a website places on your device (computer, phone, tablet) when you visit. Cookies let websites remember things about you — that you're logged in, what you've put in a cart, what language you prefer.

This Policy also covers similar technologies that work the same way:

• Local storage and session storage — built into your browser; we use these to keep your session running between pages
• Pixels and tracking tags — tiny embedded images or scripts that record a page view
• Software development kits (SDKs) — in our mobile apps, code components that perform similar tracking functions
• Device identifiers — in our mobile apps, a push-notification token and a randomly generated installation identifier. We do not access your device's advertising identifier.

When we say "cookies" in this Policy, we mean all of the above unless we specify otherwise.

3. Why we use cookies

We use cookies to:

• keep you logged in as you move between pages
• remember your preferences (e.g. cookie consent choices, language)
• process payments safely through Stripe
• protect against fraud and abuse
• understand how people use the Platform so we can improve it (only if you opt in)

We do not use cookies for:

• behavioural advertising
• cross-site tracking
• selling your data to third parties
• profiling you for any purpose unrelated to the Platform

4. The cookies we use

We group cookies into three categories.

4.1 Strictly necessary cookies

These are required for the Platform to work. They cannot be switched off through the cookie banner — without them, the site doesn't function. We rely on the strictly necessary exemption under PECR (Regulation 6(4)) for these; no consent is needed.

We also use session storage and local storage to hold short-lived UI state (current step in a job-posting form, an open chat thread, etc.). These are wiped when you close the tab or after a short period; they do not contain personal data beyond what's needed to keep the UI working.

One local-storage entry is deliberately longer-lived: bobojob.reviewPrompt.completedAt / bobojob.reviewPrompt.snoozedUntil record that you have already been invited to leave a public review of BOB-O-JOB (on Trustpilot or Google), so that we don't ask you again after you've reviewed us, or for 30 days after you've dismissed the invitation. It stores only a timestamp — no personal data, no identifier — and exists purely so we ask you less often. Clearing your browser storage resets it.

4.2 Analytics cookies (only with your consent)

These help us understand how the Platform is being used so we can improve it. We only set them if you opt in via the cookie banner. We use PostHog as our analytics provider; data is processed in PostHog's EU region (eu.posthog.com). The only other category of optional cookie we set is the marketing attribution cookies described in Section 4.3, which are covered by the same "Accept all" choice; if we add a further category (such as "functional" preference cookies), we will update this Policy and ask for consent first.

If you are not signed in, PostHog data is tied to a generated identifier rather than your name or email. If you are signed in, analytics events are linked to your account identifier and your role (customer or jobber) so we can understand how the Platform is used by real accounts. We do not send your name, email address or phone number to our analytics provider. You can request deletion of your PostHog data at any time via privacy@bob-o-job.com.

We do not currently use third-party advertising cookies, retargeting cookies, or social media tracking pixels. If we add any in the future, we will update this Policy and re-prompt for consent.

4.3 Marketing attribution cookies (only with your consent)

These record where you arrived from, so that if you go on to create an account we can tell which of our campaigns or partners actually reaches people. Without them we cannot tell a visitor who found us through a paid advert from one who typed in our address, and we end up guessing where to spend a small marketing budget.

We only set them if you choose Accept all. Until then the values are held in your browser's memory for the current page only and are never written to your device; if you choose Reject all, or later switch analytics off, we delete both cookies and discard those values.

What they hold is deliberately limited, and both hold exactly the same kinds of value. We store the path of the page you landed on and the address and path of the site that referred you, never the query strings attached to them — that is where personal data such as an email address or a sign-in token would otherwise be picked up. We store no IP address, no device identifier and no browsing history: they answer "which campaign", never "who". We do not record the date or time of individual visits, so neither cookie builds up a history of when you came to the site. Values are length-limited and stripped of anything script-shaped before storage.

boj_fta is written once and is never rewritten by a later visit. boj_lta is different by design: it is replaced whenever you follow another campaign link or advert to us, so that it reflects the most recent one. An ordinary visit — arriving with no campaign link, for example by typing our address — does not change it. Neither cookie grows: each holds one set of values, and a replacement overwrites what was there rather than adding to it.

If you create an account while they are present, we copy those values onto your account as a one-time record of how you found us, and the cookies play no further part. That record is included in the data export you can request under Section 11 and is deleted with your account.

5. Mobile apps

In our customer and jobber mobile apps, we use similar technologies:

• Authentication tokens (similar to session cookies) — strictly necessary
• Device identifiers for push notifications — used only to deliver notifications you have agreed to receive
• PostHog Mobile SDK for analytics — only active if you've consented
• Crash reporting via our hosting providers — strictly necessary for keeping the apps working

App permissions (location, notifications, camera) are governed separately by your device's permission system; you can change them at any time in your device settings.

6. How to manage your cookies

6.1 On bob-o-job

When you first visit the Platform, our cookie banner asks you to choose between:

• Accept all — strictly necessary, analytics and marketing attribution cookies
• Reject all — only strictly necessary cookies

Your choice is stored in the bob-o-job-cookie-consent cookie for 6 months. You can change it at any time on the Cookie settings page (linked in the banner and in the footer), where analytics can be switched on or off with a toggle.

Changing your choice takes effect immediately; existing analytics data already collected is not deleted unless you ask us to delete it (contact privacy@bob-o-job.com).

6.2 In your browser

You can block or delete cookies through your browser settings. Most browsers also offer a "private" or "incognito" mode that doesn't keep cookies after you close the window.

Help pages for common browsers:

• Chrome: https://support.google.com/chrome/answer/95647
• Safari (Mac): https://support.apple.com/en-gb/HT201265
• Safari (iOS): https://support.apple.com/en-gb/HT201265
• Firefox: https://support.mozilla.org/en-US/kb/cookies-information-websites-store-on-your-computer
• Edge: https://support.microsoft.com/en-us/microsoft-edge/delete-cookies-in-microsoft-edge-63947406-40ac-c3b8-57b9-2a946a29ae09

Blocking strictly necessary cookies will break the Platform — you won't be able to log in or pay. Blocking non-essential cookies has no effect on functionality.

6.3 Do Not Track

Some browsers offer a "Do Not Track" (DNT) setting. There is no industry standard for how DNT signals should be honoured, and we currently do not respond to DNT signals beyond the controls described above. Our cookie banner provides equivalent control.

6.4 Global Privacy Control (GPC)

Some browsers and extensions send a Global Privacy Control signal to indicate you don't want your data sold or shared. We do not sell or share data covered by such laws, so GPC does not currently change our behaviour. We will revisit if our practices change.

7. Legal basis

We process the data collected via cookies under the following lawful bases:

• Strictly necessary cookies: PECR Regulation 6(4) exemption; UK GDPR legitimate interest (Article 6(1)(f)) for the underlying data processing — specifically, our legitimate interest in providing a working, secure service
• Analytics cookies: consent (UK GDPR Article 6(1)(a) and PECR Regulation 6)
• Marketing attribution cookie: consent (UK GDPR Article 6(1)(a) and PECR Regulation 6). The account record created from it is retained under our legitimate interest (Article 6(1)(f)) in understanding how we acquire customers, and is deleted with the account.

You can withdraw consent for analytics cookies at any time via the controls in Section 6.1.

8. International data transfers

Some of the cookie providers we use are based outside the UK:

• Stripe processes some data in the United States and Ireland under Standard Contractual Clauses
• Cloudflare (via Vercel) is US-based with EU-located edge servers; data transfers covered by SCCs
• PostHog processes data in the EU region (Frankfurt) under the UK adequacy regulations for the EU

See our Privacy Policy Section 8 for more detail on international transfers and the safeguards in place.

9. Retention

Cookie data is retained for the duration listed in Section 4. After expiry, cookies are automatically deleted by your browser (or our server stops accepting them as valid).

Analytics data inside PostHog is retained for 12 months by default, after which it is automatically deleted. You can request earlier deletion by emailing privacy@bob-o-job.com.

The one-time attribution record copied onto your account when you sign up (Section 4.3) is kept for as long as the account exists and is deleted with it.

10. Children

The Platform is not directed to anyone under 18. We do not knowingly use cookies to collect data from children. If we become aware that we have done so, we will delete the data.

11. Your rights

You have the following rights in respect of personal data collected through cookies:

• Access — request a copy of the data we hold
• Rectification — correct inaccurate data
• Erasure — ask us to delete the data
• Restriction — pause processing
• Portability — receive your data in a machine-readable format
• Object — object to processing based on legitimate interests
• Withdraw consent — at any time, with effect from withdrawal onwards

To exercise any of these rights, email privacy@bob-o-job.com. We will respond within one calendar month.

You also have the right to lodge a complaint with the UK Information Commissioner's Office:

• Web: https://ico.org.uk/make-a-complaint
• Phone: 0303 123 1113

12. Changes to this Policy

We may update this Policy from time to time — particularly if we add new cookie providers, change analytics tools, or change how we use cookies. When we do, we will:

• update the "Last updated" date at the top
• re-prompt for consent if we add cookies that require it
• notify account holders by email if changes are material

We keep an archive of previous versions; if you'd like to see an older version, email privacy@bob-o-job.com.

13. Contact

• Privacy and cookie questions: privacy@bob-o-job.com
• Post: BOB O JOB LTD, 5th Floor, 167-169 Great Portland Street, London, W1W 5PF
• Company number: 17231669
• ICO: https://ico.org.uk | 0303 123 1113

This Cookie Policy is provided in English. If there is any conflict between this version and a translation, the English version prevails.