Last updated: 8 August 2026
Cookie Policy
1. What cookies are
Cookies are small text files that websites place on your device (computer, phone, or tablet) when you visit them. They are widely used to make websites work, remember your preferences, and gather information about how you use the site.
2. How we use cookies
We use strictly necessary cookies to secure and reopen a saved report. We also use local storage to remember your preferences. Third-party analytics and advertising storage, Meta Pixel and browser/device advertising measurement are optional and remain denied unless you accept them. A first-party channel cookie may be set when you arrive from a tagged advertising or campaign link, as described below.
The banner choice does not control the limited server-side Meta Lead event described in section 4. That event is sent only when you confirm an installer quote request, does not set or read Meta advertising cookies or transmit cookie identifiers, and is never triggered by saving, opening or editing a report.
3. Cookie categories
Essential cookies
These cookies are required for the report-access and security features you request. They cannot be switched off through the analytics-and-marketing preference.
| Cookie | Purpose | Protection | Duration |
|---|---|---|---|
__Host-eb-report | Contains an opaque token for the saved report session. It lets the server authenticate access to one estimate and report; the report address alone is not enough. | Host-only, HttpOnly, Secure, SameSite=Lax, path /. Browser scripts cannot read it. | Up to about 30 days; the server expires an inactive session after roughly 30 days and also applies an absolute limit. |
eb_report_csrf | Provides the browser half of cross-site request forgery protection for changes made inside an authenticated report. | Host-only, Secure, SameSite=Strict, path /. It is intentionally readable by our report script and is checked against both a request header and a server-side hash. | Up to about 30 days, aligned with the report session. |
An operational report-access email contains a single-use magic link that expires after 15 minutes. The magic link is not a cookie and does not subscribe you to marketing.
First-party channel cookie
| Cookie | Provider | Purpose | Duration |
|---|---|---|---|
eb_attr | EnergyBase.ie | Set when you arrive from a tagged advertising or campaign link. It remembers the advertising channel that brought you here and is read only by our server. It is used when you save an estimate and is also counted, in aggregate only, in our own page-view statistics by advertising channel. It is never shared with any other organisation and is not used to identify you. | 30 days |
Marketing cookies
These cookies are only set when you explicitly consent via our cookie banner.
| Cookie | Provider | Purpose | Expiry |
|---|---|---|---|
_fbp | Meta (Facebook) Pixel | Used by Meta to measure page visits and advertising performance after permission is granted. | Provider-controlled; typically up to 90 days |
_fbc | Meta (Facebook) Pixel | Stores a Meta ad-click identifier for attribution after permission is granted. | Provider-controlled; typically up to 90 days |
_gcl_au | Google Ads | Links Google ad-click information with a successfully confirmed installer quote request. Saving or viewing a report is not the conversion. | Provider-controlled; typically up to 90 days |
_gcl_* | Google Ads | Other Google Ads attribution cookies that may be set for the relevant ad-click source after permission is granted. | Provider-controlled; typically up to 90 days |
_ga, _ga_* | Google Analytics | Google Analytics cookies used to distinguish visits and measure site use after permission is granted. | Provider-controlled; may persist for up to 2 years |
Marketing cookies require your explicit consent before they are set. You can grant or withdraw consent at any time using our cookie banner.
4. Consent Mode and conversion timing
The Google tag loads with analytics and advertising storage denied and may send limited cookieless configuration or page pings. Accepting the optional category updates those signals and may allow Google Analytics, Google Ads and Meta technologies to set or read their cookies.
Saving, opening or editing a report is not an installer-lead conversion. Only the first successful confirmation of an installer quote request is a Lead boundary. With accepted consent, the existing Meta Pixel, Meta browser event, enriched Meta Conversions API event and Google Ads measurement may run.
Even if you reject optional cookies or make no banner choice, confirmation sends Meta one limited server-side Lead event for advertising measurement. It contains normalized hashed email and phone plus confirmation metadata, but no _fbp or _fbc Meta cookie identifiers, IP address, user agent or other device-derived advertising signals. This server-side event does not set or read Meta advertising cookies or transmit cookie identifiers. Meta Pixel/browser events and all Google advertising effects remain consent-gated. See our Privacy Policy for the legitimate-interests basis and Article 21 objection route.
5. localStorage usage
We use localStorage, which is not a cookie, for:
energybase_consent: stores the analytics-and-marketing choice, timestamp and policy version so the site can remember it for up to six months.
Report credentials and quote-form personal information are not stored in localStorage. A localStorage value remains in your browser until it expires under our code or you clear it, and it is not automatically attached to every web request as a cookie is.
6. How to manage cookies
You can change your cookie preferences at any time by clicking the "Cookie preferences" link in the footer of any page on EnergyBase.ie.
Rejecting analytics and advertising keeps Meta Pixel, optional third-party analytics, browser/device advertising measurement and advertising storage denied, and does not prevent a saved report from working. It does not prevent the limited server-side Meta Lead event when you confirm a quote request. The first-party eb_attr channel cookie may still be set after a tagged arrival, and the essential report and CSRF cookies remain in place while the authenticated report session is active. Clearing site data or letting the session expire removes or invalidates access; you can request another 15-minute access link when needed.
You can also clear cookies directly in your browser settings:
Please note that blocking all cookies may affect the functionality of some websites.
7. Changes to this policy
We will update this page if we add new cookies or change how we use existing ones. The "Last updated" date at the top reflects the most recent version.
8. Contact
If you have questions about our use of cookies, please contact us at hello@energybase.ie.