Effective 13 July 2026
This notice explains how The Boring AI Ltd, trading as Bily, uses cookies, local storage, tags, pixels, and similar technologies on bily.ai, in the Bily application, and in communications we send. It should be read with our Privacy Policy.
1. What these technologies do
A cookie is a small value stored by a browser. Local storage and similar browser features can retain identifiers or preferences. Tags and server-side measurement requests can send information about a page visit, campaign, or product action. Some technologies are set directly by Bily; others are operated for Bily by a service provider or are enabled by a customer on the customer’s own property.
2. Categories we use
Strictly necessary and security. Used for sign-in, session continuity, account routing, request security, fraud prevention, load distribution, and features a user explicitly requests. Blocking these can prevent the Service from working.
Preferences, consent, and support. Used to remember interface choices and consent, maintain connection state, and provide optional support functions when a visitor requests them.
Campaign attribution. When a visitor arrives with campaign parameters or advertising click identifiers, a first-party attribution cookie may retain those values so a later form or signup can be connected to the original campaign.
Website measurement. Used to understand page visits, navigation, referrers, device and browser characteristics, campaign performance, and whether our public site is working as intended.
Customer-directed tracking. Bily customers may configure commerce, advertising, and analytics destinations for their own properties. The customer determines the lawful basis, notice, consent, and destination configuration for that use.
3. Information involved
Depending on the context, these technologies can involve a session or visitor identifier, IP address, user agent, browser and device information, approximate location, page URL, referrer, timestamps, UTM campaign parameters, advertising click identifiers, form attribution, product interaction, and consent state. Product cookies may also be associated with an authenticated account, organisation, or property.
4. First-party measurement delivery
Bily may route website measurement through a first-party endpoint on the bily.ai domain. Using a first-party endpoint does not change the purpose of the processing or turn an optional technology into a necessary one. Recipient categories and lawful bases remain described in this notice and the Privacy Policy.
5. Consent and controls
Under the UK Privacy and Electronic Communications Regulations, Bily stores or accesses information on a device without consent only where a specific exception applies. Strictly necessary technologies are used only to provide a service the user requests. Appearance or preference technologies and statistical technologies are used without consent only when their sole purpose and operation meet the relevant exception, clear information is provided, and the user has a simple and free way to object. If a technology also supports campaign attribution, advertising measurement, profiling, or another non-exempt purpose, Bily obtains valid consent before using it where required. Any later processing of personal data has the UK GDPR lawful basis described in the Privacy Policy.
Use Cookie preferences in the site footer to accept, reject, customise, or later change your choice for optional technologies.
Use device or browser privacy controls to limit cross-site tracking or advertising identifiers.
Withdraw consent at any time. The change applies from that point, and Bily removes known optional browser identifiers where the control supports it.
Email [email protected] for an applicable opt-out or rights request.
Blocking all cookies may prevent sign-in, account security, remembered settings, forms, or other requested product functions. Browser controls act per browser or device and may need to be repeated.
6. Retention
Campaign parameters captured for a later form or signup are held in a first-party session cookie and expire when the browser session ends. Advertising click-attribution identifiers can persist for up to 90 days, and first-party analytics identifiers can persist for up to 400 days. These optional values are not set before consent where consent is required and are deleted when you withdraw through the site control, subject to technical limits. The consent preference itself is stored so we can remember the choice. Authentication, security, preferences, and product records follow the retention needs described in the Privacy Policy. Provider-side records can have separate limited retention under contract and law.
7. Customer websites
When a Bily customer deploys tracking or connects a destination on its own website or store, that customer controls the visitor relationship and must provide an accurate cookie or privacy notice, obtain any required consent, and configure Bily and connected destinations accordingly. Bily processes supported consent state and customer instructions but does not replace the customer’s consent-management platform or legal assessment.
8. Changes and contact
We may update this notice when our website, product, providers, or legal requirements change. The effective date above identifies the current version. Questions and privacy requests can be sent to [email protected].