Cookie Policy

How we handle this

• Refusing is one click. Accept and decline sit side by side, the same size, on the first screen. Nothing is pre-ticked, and closing the dialog counts as declining.
• Two separate categories. You can allow measurement without allowing advertising. They are asked for separately and stored separately.
• Nothing optional loads before you answer. The marketing pixel and the session-recording tools are not merely idle until consent — their scripts are never fetched.
• Two of our tools record your visit. We say so plainly in section 2 rather than filing it under "analytics", because it is more than counting page views.
• We don't sell your data. No cookie on this site exists to pass you to a data broker.

1. What cookies are

Cookies are small text files a website stores on your device. They let a site remember things — like whether you've answered a banner — and help owners understand how their site is used. We also use similar browser storage (local storage and session storage) for the same purposes, and we list it in the same table below, because the law treats it the same way.

2. How we use them

Essential entries run the site and are always on. Beyond those there are exactly two optional categories, and you choose them independently.

• Analytics — three tools, and they are not equivalent. Google Analytics 4 counts page views and tells us which pages get read and where people give up. Microsoft Clarity and Hotjar go further: they record how the page is actually used — mouse movement, clicks, scrolling, and the order of the pages you visit — and let us replay that visit as a video and see it aggregated as a heatmap. We use them to find things that are broken or confusing, such as a button people click that does nothing. They do not record your screen outside this website, and they are not used to identify you personally, but a replay is a recording of your visit and we would rather you knew that before you agreed to it. Anything you type into a form is masked before it reaches either tool — they record that you used a field, never what you wrote in it. That masking is set by the page itself, not only by the providers' defaults, so it cannot be switched off from a dashboard.
• Marketing — Google Ads and the Meta pixel, to see which campaigns bring real enquiries so we stop paying for the ones that don't. The Google Ads tag also adds your visit to our own remarketing audience lists, which is what allows an ad for us to be shown to you again elsewhere.

We also run Cloudflare Web Analytics, which measures aggregate page-view statistics without cookies, without identifiers and without storing anything on your device; because it cannot identify you, it needs no consent and is always on.

Cittago emails contain a pixel and links that pass through Brevo, so we can measure opens and clicks. These are not cookies set by this website; they are covered by your email consent, described in our Privacy Policy.

3. The cookies and storage we use

Measured on a real visit, not copied from a vendor's documentation. Retention is what your browser was actually told.

If you decline, Google's tags run in advanced Consent Mode: they send only anonymous, aggregate signals (pings), with no cookies and nothing stored on your device, and Google truncates the IP address within the EU. The Meta pixel, Clarity and Hotjar have no such mode, so on a decline they are never loaded or started at all. If you accept, the analytics and advertising cookies described above are used, within the categories you chose.

4. Cookies set on the providers' own domains

The table above is what is stored under cittago.com — we can name every entry because it is ours to read. Once you allow a category, the providers also set cookies on their domains, which we can neither read nor list from here. Microsoft documents these for Clarity: MUID, CLID, ANONCHK, MR and SM, set on clarity.ms. MUID identifies your browser across Microsoft sites and Microsoft states it is used for advertising as well as analytics — so allowing Analytics on this site does involve a Microsoft advertising identifier, and we would rather write that down than leave you to discover it.

With Marketing allowed, your browser also contacts doubleclick.net, googleadservices.com and facebook.com, which set their own cookies under the same arrangement. Each provider's policy governs them, and we link to all of them in the Privacy Policy.

5. Managing your choice

On your first visit a dialog asks you to accept or keep essential only — both one click, both on the first screen. Settings opens the two switches so you can allow analytics without allowing marketing. Closing the dialog with the ✕, or pressing Escape, is treated as essential only.

You can reopen the choice at any time from Cookie settings in the site footer, and we ask again after six months. You can also block or delete cookies in your browser settings — though the essential entries are needed for parts of the site to work.

If you want a visit that has already been recorded to be deleted, email us and we will ask the provider to remove it; see your rights.

6. Third parties

Google (Analytics 4 and Google Ads), Microsoft (Clarity), Hotjar — part of Contentsquare — and Meta set the cookies marked above as theirs, once you have allowed the matching category. They are governed by those providers' own policies, and each may process data outside the European Economic Area under the European Commission's adequacy decision for the EU–US Data Privacy Framework or, where that does not apply, under Standard Contractual Clauses. Our Privacy Policy covers that in full.

7. Changes and contact

We update this page when the tools change — the table above is meant to match what actually runs, not what once did, and we re-check it against a real visit rather than against our own tag list. For any question, email — Cittago s.r.l., Cluj-Napoca, Romania.