Legal
Cookie Policy
This policy explains what cookies and similar technologies we use on this website, what they do, and how you can control them. It should be read together with our Privacy Policy.
How we handle this
- Refusing is one click. Accept and decline sit side by side, the same size, on the first screen. Nothing is pre-ticked, and closing the dialog counts as declining.
- Two separate categories. You can allow measurement without allowing advertising. They are asked for separately and stored separately.
- Nothing optional loads before you answer. The marketing pixel and the session-recording tools are not merely idle until consent — their scripts are never fetched.
- Two of our tools record your visit. We say so plainly in section 2 rather than filing it under "analytics", because it is more than counting page views.
- We don't sell your data. No cookie on this site exists to pass you to a data broker.
1. What cookies are
Cookies are small text files a website stores on your device. They let a site remember things — like whether you've answered a banner — and help owners understand how their site is used. We also use similar browser storage (local storage and session storage) for the same purposes, and we list it in the same table below, because the law treats it the same way.
2. How we use them
Essential entries run the site and are always on. Beyond those there are exactly two optional categories, and you choose them independently.
- Analytics — three tools, and they are not equivalent.Google Analytics 4 counts page views and tells us which pages get read and where people give up.Microsoft Clarity and Hotjar go further: they record how the page is actually used — mouse movement, clicks, scrolling, and the order of the pages you visit — and let us replay that visit as a video and see it aggregated as a heatmap. We use them to find things that are broken or confusing, such as a button people click that does nothing. They do not record your screen outside this website, and they are not used to identify you personally, but a replay is a recording of your visit and we would rather you knew that before you agreed to it. Anything you type into a form is masked before it reaches either tool — they record that you used a field, never what you wrote in it. That masking is set by the page itself, not only by the providers' defaults, so it cannot be switched off from a dashboard.
- Marketing — Google Ads and the Meta pixel, to see which campaigns bring real enquiries so we stop paying for the ones that don't. The Google Ads tag also adds your visit to our own remarketing audience lists, which is what allows an ad for us to be shown to you again elsewhere.
We also run Cloudflare Web Analytics, which measures page views without cookies and without storing anything on your device; because it cannot identify you, it needs no consent and is always on.
3. The cookies and storage we use
Measured on a real visit, not copied from a vendor's documentation. Retention is what your browser was actually told.
| Name | Set by | Category | Purpose | Retention |
|---|---|---|---|---|
| cittago-consent local storage | Cittago | Essential | Remembers which categories you allowed, so we don't ask again. | 6 months, then we ask once more |
| cittago-speed session storage | Cittago | Essential | Holds your last page-speed result so it can be shown while you browse the tools. | Cleared when you close the tab |
| _ga cookie | Analytics | Distinguishes one visitor from another for aggregate reporting. | 400 days | |
| _ga_S9E7YX355G cookie | Analytics | Keeps the state of the current Google Analytics 4 session. | 400 days | |
| _clck cookie | Microsoft Clarity | Analytics | Holds the Clarity user ID, so repeat visits are attributed to the same recording history. | 1 year |
| _clsk cookie | Microsoft Clarity | Analytics | Joins several page views into one recorded session. | 1 day |
| _cltk session storage | Microsoft Clarity | Analytics | Identifies the current tab while the recording is in progress. | Cleared when you close the tab |
| _hjSessionUser_3670828 cookie | Hotjar | Analytics | Holds the Hotjar user ID, so repeat visits are attributed to the same recording history. | 1 year |
| _hjSession_3670828 cookie | Hotjar | Analytics | Holds the current Hotjar session. | 30 minutes |
| hjActiveViewportIds local storage | Hotjar | Analytics | Records which screen sizes you viewed, so a heatmap can be drawn per layout. | Until you clear site data |
| hjViewportId session storage | Hotjar | Analytics | The screen size of the current tab. | Cleared when you close the tab |
| _gcl_au cookie | Marketing | Links an ad click to what happened afterwards, so we can tell which ads produce enquiries. | 90 days | |
| _gcl_ls local storage | Marketing | The same ad-click link, kept in browser storage as well as in the cookie. | Until you clear site data | |
| _fbp cookie | Meta | Marketing | Identifies the browser for Meta advertising measurement. | 90 days |
| _fbc cookie | Meta | Marketing | Stores the click identifier when you arrive from a Meta ad, so the visit can be matched to that ad. Set only if you actually arrive from one. | 90 days |
| lastExternalReferrer local storage | Meta | Marketing | The site you came from before this one. | Until you clear site data |
| lastExternalReferrerTime local storage | Meta | Marketing | When that referral happened. | Until you clear site data |
If you decline, Google's tags switch to Consent Mode: they send anonymous, aggregate signals with no cookies and nothing stored on your device. The Meta pixel, Clarity and Hotjar have no such mode, so on a decline they are simply never loaded.
4. Cookies set on the providers' own domains
The table above is what is stored under cittago.com — we can name every entry because it is ours to read. Once you allow a category, the providers also set cookies on their domains, which we can neither read nor list from here. Microsoft documents these for Clarity: MUID, CLID, ANONCHK, MR and SM, set on clarity.ms. MUID identifies your browser across Microsoft sites and Microsoft states it is used for advertising as well as analytics — so allowing Analytics on this site does involve a Microsoft advertising identifier, and we would rather write that down than leave you to discover it.
With Marketing allowed, your browser also contacts doubleclick.net, googleadservices.com and facebook.com, which set their own cookies under the same arrangement. Each provider's policy governs them, and we link to all of them in the Privacy Policy.
5. Managing your choice
On your first visit a dialog asks you to accept or keep essential only — both one click, both on the first screen. Settings opens the two switches so you can allow analytics without allowing marketing. Closing the dialog with the ✕, or pressing Escape, is treated as essential only.
You can reopen the choice at any time from Cookie settings in the site footer, and we ask again after six months. You can also block or delete cookies in your browser settings — though the essential entries are needed for parts of the site to work.
If you want a visit that has already been recorded to be deleted, email us and we will ask the provider to remove it; see your rights.
6. Third parties
Google (Analytics 4 and Google Ads), Microsoft (Clarity), Hotjar — part of Contentsquare — and Meta set the cookies marked above as theirs, once you have allowed the matching category. They are governed by those providers' own policies, and each may process data outside the European Economic Area under the European Commission's adequacy decision for the EU–US Data Privacy Framework or, where that does not apply, under Standard Contractual Clauses. Our Privacy Policy covers that in full.
7. Changes and contact
We update this page when the tools change — the table above is meant to match what actually runs, not what once did, and we re-check it against a real visit rather than against our own tag list. For any question, email — Cittago s.r.l., Cluj-Napoca, Romania.
