Cookie policy
Last updated: 2026-06-01
This page explains how Nutrilia uses cookies and equivalent technologies (localStorage, sessionStorage), in compliance with the Italian Data Protection Authority's measure of 10 June 2021, the EDPB guidelines and the ePrivacy Directive 2002/58/EC.
1. Controller
The controller of the data collected through cookies is Cloudify, an Italian sole proprietorship, VAT IT02563250444, reachable at info@nutrilia.it. For the full picture of personal data processing see the Privacy policy.
2. What cookies and equivalent technologies are
Cookies are small text files that websites you visit save on your device. Alongside cookies we also use equivalent technologies such as localStorage and sessionStorage, which let the browser store information locally without automatically sending it to the server. They help the Service work, remember your preferences and collect aggregated usage statistics.
For simplicity, on this page we use "cookies" to refer to both actual cookies and these equivalent technologies.
3. Categories used
3.1 Strictly necessary (technical)
Strictly necessary for the Service to work. They are set without consent (art. 122 Italian Privacy Code) and cannot be disabled without compromising the Service. They cover:
- authentication and login session;
- protection against CSRF attacks;
- storing the selected language;
- storing your own choice about cookies.
3.2 Preference
Store interface choices that are not strictly necessary, such as the light/dark theme. They are kept locally in your browser and are not shared with third parties. Set only with your consent.
3.3 Statistical / analytics
Measure how the Service is used in aggregated and anonymous form (pages visited, feature clicks, errors). Set only after your explicit consent via the banner. See section 5 (Mixpanel) for details.
3.4 Marketing
We do not use marketing cookies at present. The category is included in the consent banner so it can be activated quickly if we ever launch advertising campaigns (Meta Pixel, Google Ads or similar). Until then the category stays inactive.
4. List of cookies and local storage entries
| Name / key | Technology | Category | Purpose | Duration |
|---|---|---|---|---|
better-auth.session_token | HttpOnly cookie | Strictly necessary | Maintains the login session | 30 days (rotation) |
| Better Auth (CSRF) | HttpOnly cookie | Strictly necessary | Protection against CSRF attacks | Session |
NEXT_LOCALE | Cookie | Strictly necessary | Stores the selected language (it/en) | 1 year |
tm_cookie_consent | localStorage | Strictly necessary | Stores your choice on cookies | 6 months |
theme | localStorage | Preference | Light/dark theme | Until manually cleared |
mp_*_mixpanel | localStorage | Statistical | Mixpanel anonymous device id (only after consent) | Until consent is withdrawn |
__stripe_mid, __stripe_sid | Third-party cookie (Stripe) | Technical (third party) | Stripe fraud prevention and checkout — set only on payment pages | 1 year / 30 minutes |
Names may change with provider updates; we keep this list as up to date as possible.
5. Third-party cookies and services
Some features require third parties, each with their own policy:
- Mixpanel (analytics) — set only after consent. The IP address is dropped server-side, events are not tied to your name and data are hosted in the European Union.
- Stripe (payments) — the
__stripe_mid/__stripe_sidcookies are set only on pages that load Stripe (checkout, subscription management) for fraud prevention. - Resend (transactional email) — does not set any browser cookies; only relays email delivery.
- Google (optional OAuth login) — clicking "Sign in with Google" redirects you to Google, which applies its own policy.
- Cloudflare Turnstile (anti-bot protection) — loaded only on the login form to verify the magic-link request comes from a human. Does not set persistent cookies in the browser; may exchange a short-lived token with Cloudflare and analyse technical signals (HTTP headers, browser fingerprint, IP address) only for the time strictly needed for verification. Treated as a strictly necessary (anti-fraud) technology and therefore does not require consent under applicable law.
6. Non-EU transfers
Some third parties are based in the United States or use its global infrastructure (Stripe, Google, Cloudflare). Transfers take place on the basis of the Standard Contractual Clauses (SCC) approved by the European Commission or, where applicable, an adequacy decision (Data Privacy Framework).
7. Consent management, duration and withdrawal
On your first visit a banner asks you to accept or reject the non-essential categories (preference, statistical, marketing). Refusing non-essential cookies in no way prevents access to or use of the Service — we do not use cookie walls.
- Your choice is stored in the browser's localStorage under the key
tm_cookie_consentand is valid for 6 months; after that we will ask again. - You can change or withdraw consent at any time by reopening the banner from the "Manage cookies" button in the site footer.
- Withdrawal does not affect the lawfulness of processing carried out on the basis of consent prior to the withdrawal (Art. 7.3 GDPR).
- You can also manage or delete cookies directly from your browser settings. Disabling the strictly necessary cookies will prevent the Service from working properly.
8. Data subject rights
The data collected through cookies is processed in accordance with the Privacy policy. You have the right to access, rectify, request erasure, restrict processing, receive in portable format, object to processing and withdraw consent. To exercise these rights write to info@nutrilia.it. You also have the right to lodge a complaint with the Italian Data Protection Authority at www.garanteprivacy.it.
9. Updates to this cookie policy
We may update this page to reflect technical (new cookies, new third parties) or regulatory changes. If we materially change the categories subject to consent we will ask you to renew your choice via the banner. The last update date is shown at the top of this document.
10. Contact
For any question about the use of cookies or to exercise your rights, write to info@nutrilia.it.