Cookie policy
Last updated: 2026-10-07
This page explains how Nutrilia uses cookies and equivalent technologies (localStorage, sessionStorage), in compliance with the Italian Data Protection Authority's measure of 10 June 2021, the EDPB guidelines and the ePrivacy Directive 2002/58/EC.
1. Controller
The controller of the data collected through cookies is Cloudify di Andrea De Castri, an Italian sole proprietorship, VAT IT02563250444, reachable at info@nutrilia.it. For the full picture of personal data processing see the Privacy policy.
2. What cookies and equivalent technologies are
Cookies are small text files that websites you visit save on your device. Alongside cookies we also use equivalent technologies such as localStorage and sessionStorage, which let the browser store information locally without automatically sending it to the server. They help the Service work, remember your preferences and collect aggregated usage statistics.
For simplicity, on this page we use "cookies" to refer to both actual cookies and these equivalent technologies.
3. Categories used
3.1 Strictly necessary (technical)
Strictly necessary for the Service to work. They are set without consent (art. 122 Italian Privacy Code) and cannot be disabled without compromising the Service. They cover:
- authentication and login session;
- protection against CSRF attacks;
- storing the selected language;
- storing your own choice about cookies.
3.2 Preference
Store interface choices that are not strictly necessary, such as the light/dark theme. They are kept locally in your browser and are not shared with third parties. Set only with your consent.
3.3 Statistical / analytics
Measure how the Service is used in aggregated and anonymous form (pages visited, feature clicks, errors). Set only after your explicit consent via the banner. See section 5 (Mixpanel) for details.
3.4 Marketing
We use two advertising measurement tools:
- the Meta Pixel (Meta Platforms Ireland Ltd.), to measure the effectiveness of our campaigns on Facebook and Instagram;
- the Google Ads tag (Google Ireland Ltd.), to measure the effectiveness of our campaigns on Google Search, YouTube and the Display network.
Both are also used to show relevant ads to people who already visited the site (remarketing). They load only after your explicit consent to the marketing category on the banner: without consent the scripts are not even downloaded and no data reaches Meta or Google. When consent is withdrawn both tags are disabled and their cookies are deleted. See section 5 for details.
We do not use Google Analytics and we do not enable Google Ads "enhanced conversions": Google never receives your email or any other identifying data, not even in hashed form.
4. List of cookies and local storage entries
| Name / key | Technology | Category | Purpose | Duration |
|---|---|---|---|---|
better-auth.session_token | HttpOnly cookie | Strictly necessary | Maintains the login session | 30 days (rotation) |
| Better Auth (CSRF) | HttpOnly cookie | Strictly necessary | Protection against CSRF attacks | Session |
NEXT_LOCALE | Cookie | Strictly necessary | Stores the selected language (it/en) | 1 year |
tm_cookie_consent | localStorage | Strictly necessary | Stores your choice on cookies | 6 months |
theme | localStorage | Preference | Light/dark theme | Until manually cleared |
mp_*_mixpanel | localStorage | Statistical | Mixpanel anonymous device id (only after consent) | Until consent is withdrawn |
_fbp | Cookie (Meta) | Marketing | Meta Pixel browser identifier for campaign measurement (only after consent) | 90 days |
_fbc | Cookie (Meta) | Marketing | Stores the click parameter of a Meta ad (only after consent and only when arriving from an ad) | 90 days |
_gcl_au | Cookie (Google) | Marketing | Links the visit to a Google Ads click in order to attribute conversions (only after consent) | 90 days |
_gcl_* (_gcl_aw, _gcl_dc, _gcl_gb, ...) | Cookie (Google) | Marketing | Variants of the above for the different Google advertising networks (only after consent and only when arriving from an ad) | 90 days |
__stripe_mid, __stripe_sid | Third-party cookie (Stripe) | Technical (third party) | Stripe fraud prevention and checkout — set only on payment pages | 1 year / 30 minutes |
Names may change with provider updates; we keep this list as up to date as possible.
5. Third-party cookies and services
Some features require third parties, each with their own policy:
- Mixpanel (analytics) — set only after consent. The IP address is dropped server-side, events are not tied to your name and data are hosted in the European Union.
- Meta Pixel (marketing) — set only after consent to the marketing category. It transmits to Meta Platforms Ireland Ltd. navigation events (pages visited, magic-link request, registration completed, subscription started) tied to technical browser identifiers; we never transmit your email, name or any patient data. For these processing activities Meta acts as an independent or joint controller: see Meta's privacy policy and Meta's cookie policy.
- Google Ads (marketing) — set only after consent to the marketing category. It transmits to Google Ireland Ltd. navigation events (pages visited, magic-link request, registration completed, subscription started) tied to technical browser identifiers; we never transmit your email, name or any patient data, and enhanced conversions are disabled. The tag is configured with Consent Mode v2: without consent it is not loaded at all, and on withdrawal the advertising signals (
ad_storage,ad_user_data,ad_personalization) are set to "denied". For these processing activities Google acts as an independent or joint controller: see Google's privacy policy and how Google uses data from sites that use its services. - Stripe (payments) — the
__stripe_mid/__stripe_sidcookies are set only on pages that load Stripe (checkout, subscription management) for fraud prevention. - Resend (transactional email) — does not set any browser cookies; only relays email delivery.
- Google (optional OAuth login) — clicking "Sign in with Google" redirects you to Google, which applies its own policy. This feature is independent of the Google Ads tag described above and does not require marketing consent.
- Cloudflare Turnstile (anti-bot protection) — loaded only on the login form to verify the magic-link request comes from a human. Does not set persistent cookies in the browser; may exchange a short-lived token with Cloudflare and analyse technical signals (HTTP headers, browser fingerprint, IP address) only for the time strictly needed for verification. Treated as a strictly necessary (anti-fraud) technology and therefore does not require consent under applicable law.
6. Non-EU transfers
Some third parties are based in the United States or use its global infrastructure (Stripe, Google, Cloudflare, Meta). Transfers take place on the basis of the Standard Contractual Clauses (SCC) approved by the European Commission or, where applicable, an adequacy decision (Data Privacy Framework, to which Meta Platforms Inc. is certified).
7. Consent management, duration and withdrawal
On your first visit a banner asks you to accept or reject the non-essential categories (preference, statistical, marketing). Refusing non-essential cookies in no way prevents access to or use of the Service — we do not use cookie walls.
- Your choice is stored in the browser's localStorage under the key
tm_cookie_consentand is valid for 6 months; after that we will ask again. - You can change or withdraw consent at any time by reopening the banner from the "Manage cookies" button in the site footer.
- Withdrawal does not affect the lawfulness of processing carried out on the basis of consent prior to the withdrawal (Art. 7.3 GDPR).
- You can also manage or delete cookies directly from your browser settings. Disabling the strictly necessary cookies will prevent the Service from working properly.
8. Data subject rights
The data collected through cookies is processed in accordance with the Privacy policy. You have the right to access, rectify, request erasure, restrict processing, receive in portable format, object to processing and withdraw consent. To exercise these rights write to info@nutrilia.it. You also have the right to lodge a complaint with the Italian Data Protection Authority at www.garanteprivacy.it.
9. Updates to this cookie policy
We may update this page to reflect technical (new cookies, new third parties) or regulatory changes. If we materially change the categories subject to consent we will ask you to renew your choice via the banner. The last update date is shown at the top of this document.
10. Contact
For any question about the use of cookies or to exercise your rights, write to info@nutrilia.it.