Cookie Policy

We use cookies (short texts stored by the browser) in four categories. On your first visit you can choose which categories you accept; you can come back at any time through the cookie banner.

Necessary

Always active. They include the session cookie (authentication), CSRF, the cookie holding your cookie preferences (_ef_consent_summary) and an anonymous visitor identifier (_ef_vid, valid for 1 year) used to link the pages of the same visit without identifying you personally. Without them the site does not work.

Preferences

They store your language, theme and layout choices. Without them, every visit starts from scratch.

Analytics

We measure how the site is used (pages, duration) in order to improve it, through Plausible (cookieless) and PostHog (hosted in the EU). We do not share this data with advertising third parties.

Marketing

With your consent, we attribute conversions to ads (UTM, gclid, fbclid) to understand which campaigns work, and we send the conversion events (registration, payment) to the advertising platforms. Without your consent, no third-party script is loaded and we send nothing to Meta / Google / LinkedIn — not even server-to-server. In addition, we do not store the IP, the user agent or the platforms' cookie identifiers (_fbp, _fbc, li_fat_id) in our internal attribution rows. We keep only the anonymous visitor→account link, needed for product analytics (which pages you visited before registering) — this link never leaves our server.

Browser pixels loaded only after consent:

• Meta Pixel (Facebook / Instagram) — sets the _fbp and _fbc cookies (90 days) to match your visit with the ad you clicked.
• Google Tag (gtag.js) — used for Google Ads and Google Analytics. Sets _ga, _ga_*, _gid (up to 2 years).
• LinkedIn Insight Tag — sets li_fat_id (30 days) and other LinkedIn cookies.

Conversion API (CAPI) — server-to-server delivery: when you complete a registration or a payment, we send a conversion event directly from our server to Meta, Google Ads and LinkedIn containing: the cookie identifiers above (_fbp, _fbc, li_fat_id, gclid), your IP address, the browser's user agent, the conversion value and — for better matching — your contact data (email, phone, first name, last name) hashed with SHA-256, never in plain text. The cookie identifiers also travel through the Stripe session metadata when you pay, so we can attribute the payment to the same click even if you return later. All these flows stop if you withdraw your consent.

The full list of the marketing sub-processors and their jurisdictions is in Sub-processors.

How to change your choice

The simplest way: Dashboard → Settings → Data & GDPR, where you can enable or disable each category at any time. Alternatively, delete the _ef_consent_summary cookie from your browser and reload the page; the banner reappears with all the options. Withdrawing the marketing consent immediately stops the pixel loading and the server-to-server submissions for future events.