Back to Home

Cookie Policy

Last updated: July 21, 2026

1. What are cookies?

Cookies are small text files that are stored on your device (computer, tablet, or mobile) when you visit a website. Cookies allow the website to recognize your device and store information about your preferences or previous actions.

This Cookie Policy complies with the ePrivacy Directive (Art. 5.3) and Spanish LSSI-CE Article 22. Prior consent is obtained for marketing and non-essential analytics cookies, while strictly necessary cookies (LSSI Art. 22.2) are exempt. Users may change or withdraw their consent at any time via the cookie settings.

2. What cookies do we use?

CitaFlow uses different categories of cookies according to their function:

2.1 Strictly Necessary Cookies

Status: Always active (no consent required)

Purpose: These cookies are essential for the website and services you have requested to function, such as logging in, session management, anti-bot security, support chat, and protection against CSRF attacks.

Legal basis: Exempt from consent as strictly necessary (Art. 22.2 LSSI-CE / Art. 5.3 ePrivacy Directive); the associated processing is based on the provision of the requested service (Art. 6.1.b GDPR).

Cookie Provider Duration Description
sb-*-auth-token Supabase 7 days Session authentication token
csrf_token CitaFlow Session Protection against CSRF attacks
cc_cookie Cookie Consent 6 months Stores your cookie preferences
citaflow_currency CitaFlow 24 hours Remembers whether we show you prices in euros or dollars, so we don't have to look up your country on every page. Stored in your browser's local storage, never sent to a server, and cannot identify you
__cf_bm Cloudflare 30 minutes Security and anti-bot protection (includes Turnstile verification in forms)
cw_conversation Chatwoot (self-hosted by CitaFlow) Persistent Keeps the continuity of your conversation with the support chat (cookie or local storage)
cfl_lang CitaFlow (cfl.my) 1 year Remembers your language on service short-link pages

We also load technical tools with no advertising purpose: Sentry (website error monitoring) does not use advertising cookies or create profiles.

2.2 First-party Attribution (not shared with advertising networks)

Status: Active by default

Purpose: Our own first-party identifiers that let us know which channel or campaign brought you to us and correctly attribute sign-ups and partner referrals. These identifiers are not set by third parties and are not used for cross-site behavioral advertising.

Legal basis: Legitimate interest (Art. 6.1.f GDPR) for first-party measurement of our campaigns.

Cookie Provider Duration Description
cf_cid CitaFlow 90 days First-party visit identifier for campaign attribution
cf_ref CitaFlow 30 days Remembers the partner program referral code (?ref=)
cf_attrib / cf_consent CitaFlow Local storage Visit source parameters (UTM and click identifiers) and a record of your consent choice

2.3 Cookieless Analytics (Always Active)

Status: Always active (no consent required)

Purpose: Helps us understand how visitors interact with our website by collecting and analyzing information anonymously and in aggregate form.

Legal basis: Legitimate interest (Art. 6.1.f GDPR) - Consent exemption under Art. 5.3 ePrivacy Directive as it does not use cookies or persistent identifiers

Provider Cookies Duration Description
Umami Analytics None (cookieless) N/A Cookieless web analytics, aggregated and anonymous data. Anonymized IP addresses. Does not create user profiles or track across sites. Complies with the "strictly necessary" exception for service functionality.

Why doesn't it require consent? Umami Analytics is configured in fully anonymous, cookieless mode. It does not store persistent identifiers, does not access local storage (localStorage/sessionStorage), and IPs are anonymized. Data is aggregated without linking actions to individual users. This complies with the Art. 5.3 ePrivacy Directive exception for technologies "strictly necessary" to provide a requested information service.

2.4 Marketing and Advertising Cookies

Status: Require consent

Purpose: Used to show you relevant ads and measure the effectiveness of our advertising campaigns. These cookies track your visit to our website and other sites to create a profile of your interests.

Legal basis: Consent (Art. 6.1.a GDPR + Art. 5.3 ePrivacy Directive)

Provider Cookie Duration Description
Meta (Facebook) _fbp 3 months Facebook Pixel for conversion tracking and retargeting
fr 3 months Advertising cookie to display relevant ads
_fbc 2 years Stores click information from Facebook ads
TikTok _ttp 13 months TikTok Pixel for campaign measurement and attribution
_tta 1 year User identifier for audience analysis
Google Ads _gcl_au 3 months Google Ads conversion attribution (only after consent)

Important: The Meta and TikTok pixels only load after you give your explicit consent through the cookie banner. The Google Ads tag loads in consent mode (Consent Mode v2) with consent denied by default: until you accept, it does not set cookies or send advertising identifiers. You can withdraw your consent at any time from the preference center.

In addition to the pixels, when you contact us from the website and only if you have accepted marketing cookies, we may record the conversion event server-side with Meta and TikTok using pseudonymized identifiers (SHA-256 hashed email or phone number), in order to measure the effectiveness of our campaigns.

3. How to manage your cookie preferences?

3.1 Preference Center

You can manage your cookie preferences at any time by clicking the following button:

3.2 Browser Settings

You can also configure your browser to block or alert you about cookies:

  • Chrome: Settings → Privacy and security → Cookies and other site data
  • Firefox: Options → Privacy & Security → Cookies and Site Data
  • Safari: Preferences → Privacy → Manage Website Data
  • Edge: Settings → Cookies and site permissions → Cookies and site data

Note: Blocking all cookies may affect website functionality.

4. Third-party cookies

Some of our providers may set third-party cookies when you visit our website. We do not have control over these cookies. We recommend you consult the privacy policies of these third parties:

5. Geolocation and scope

The cookie banner and consent request are displayed only to visitors located in the European Economic Area (EEA), United Kingdom, and other countries with similar data protection legislation.

We use IP-based geolocation to determine your location. If we cannot determine your location with certainty, we will display the banner as a precaution to ensure compliance.

For visitors outside these jurisdictions, analytics and marketing cookies load automatically without requesting consent, in accordance with the applicable laws in their respective countries.

6. US Privacy Notice (California and other US States)

This section applies to residents of California and other US states with comprehensive privacy laws (such as Virginia, Colorado, Connecticut, and Utah).

6.1 Categories of Information Collected

Through our cookies and tracking technologies, we may collect: identifiers (IP address, device ID), internet activity information (browsing history on our site, interactions with ads), and inferences drawn from this information.

6.2 "Sale" or "Sharing" of Personal Information

Under California law (CPRA/CCPA), certain advertising cookies and cross-context behavioral advertising may be considered "selling" or "sharing" personal information. When we use marketing pixels (Meta, TikTok, Google Ads) for targeted advertising purposes, this may constitute sharing under California law.

Your Rights: California residents have the right to opt out of the sale or sharing of their personal information.

6.3 Do Not Sell or Share My Personal Information

To exercise your right to opt out of the sale or sharing of your personal information:

  • Cookie Settings: Click the "Open cookie settings" button above to disable marketing cookies
  • Global Privacy Control: We honor Global Privacy Control (GPC) signals. If your browser sends a GPC signal, we will treat it as a valid opt-out request
  • Direct Request: Email us at privacy [arroba] citaflow [punto] com with "Do Not Sell or Share" in the subject line

6.4 Other California Rights

California residents also have the right to: know what personal information we collect, delete personal information, correct inaccurate personal information, and not be discriminated against for exercising privacy rights. See our Privacy Policy for how to exercise these rights.

6.5 Sensitive Personal Information

We do not use or disclose sensitive personal information for purposes other than those permitted by the CPRA.

7. Updates to this policy

We may update this Cookie Policy periodically to reflect changes in the cookies we use or for legal reasons. We will notify you of significant changes through a prominent notice on our website or by email.

The "Last updated" date at the beginning of this policy indicates when the last revision was made.

8. Contact

If you have questions about our Cookie Policy or wish to exercise your rights, you can contact us at:

Privacy email: privacy [arroba] citaflow [punto] com
General email: contact [arroba] citaflow [punto] com
Postal address: Lince Media LLC, 25 SE 2nd Ave, Ste 550 #1172, Miami, FL 33131, USA

You can also consult our Privacy Policy for more information on how we process your personal data.

Back to Home