Cookie Policy
Last updated: September 29, 2026
1. What are cookies?
Cookies are small text files that are stored on your device (computer, tablet, or mobile) when you visit a website. Cookies allow the website to recognize your device and store information about your preferences or previous actions.
This Cookie Policy complies with the ePrivacy Directive (Art. 5.3) and Spanish LSSI-CE Article 22. Prior consent is obtained for marketing and non-essential analytics cookies, while strictly necessary cookies (LSSI Art. 22.2) are exempt. Users may change or withdraw their consent at any time via the cookie settings.
2. What cookies do we use?
CitaFlow uses different categories of cookies according to their function:
2.1 Strictly Necessary Cookies
Status: Always active (no consent required)
Purpose: These cookies are essential for the website and services you have requested to function, such as logging in, session management, anti-bot security, support chat, and protection against CSRF attacks.
Legal basis: Exempt from consent as strictly necessary (Art. 22.2 LSSI-CE / Art. 5.3 ePrivacy Directive); the associated processing is based on the provision of the requested service (Art. 6.1.b GDPR).
| Cookie | Provider | Duration | Description |
| sb-*-auth-token | Supabase | 7 days | Session authentication token |
| csrf_token | CitaFlow | Session | Protection against CSRF attacks |
| cc_cookie | Cookie Consent | 6 months | Stores your cookie preferences |
| citaflow_currency | CitaFlow | 24 hours | Remembers whether we show you prices in euros or dollars, so we don't have to look up your country on every page. Stored in your browser's local storage, never sent to a server, and cannot identify you |
| __cf_bm | Cloudflare | 30 minutes | Security and anti-bot protection (includes Turnstile verification in forms) |
| cw_conversation | Chatwoot (self-hosted by CitaFlow) | Persistent | Keeps the continuity of your conversation with the support chat (cookie or local storage) |
| cfl_lang | CitaFlow (cfl.my) | 1 year | Remembers your language on service short-link pages |
We also load technical tools with no advertising purpose: Sentry (website error monitoring) does not use advertising cookies or create profiles.
2.2 First-party Attribution (not shared with advertising networks)
Status: In the EEA, the United Kingdom and Switzerland they are stored on your device only after you accept marketing cookies in the banner; elsewhere, active by default (unless a Global Privacy Control signal or a prior rejection).
Purpose: Our own first-party identifiers that let us know which channel or campaign brought you to us and correctly attribute sign-ups and partner referrals. These identifiers are not set by third parties and are not used for cross-site behavioral advertising. If you do not accept them, the parameters of the current visit (UTM, click identifiers, partner code) are only used in memory during that visit and travel with the form if you sign up; they are not kept in your browser.
Legal basis: Consent (Art. 6.1.a GDPR and Art. 22.2 LSSI) where the banner is shown; legitimate interest (Art. 6.1.f GDPR) for first-party measurement of our campaigns elsewhere.
| Cookie | Provider | Duration | Description |
| cf_cid | CitaFlow | 90 days | First-party visit identifier for campaign attribution |
| cf_ref | CitaFlow | 30 days | Remembers the partner program referral code (?ref=) |
| cf_attrib / cf_consent | CitaFlow | Local storage | Visit source parameters (UTM and click identifiers) and a record of your consent choice |
2.3 Cookieless Analytics (Always Active)
Status: Always active (no consent required)
Purpose: Helps us understand how visitors interact with our website by collecting and analyzing information anonymously and in aggregate form.
Legal basis: Legitimate interest (Art. 6.1.f GDPR) - Consent exemption under Art. 5.3 ePrivacy Directive as it does not use cookies or persistent identifiers
| Provider | Cookies | Duration | Description |
| Umami Analytics | None (cookieless) | N/A | Web analytics with no cookies and nothing stored in the browser, hosted on our own servers. To count unique visits it computes, server-side, a hash of the IP and browser with a periodically rotating salt; the IP is not stored and, once the salt rotates, the identifier can no longer be linked to new visits. It only produces aggregate statistics for this site. No cross-site tracking, no matching with other data. |
Why doesn't it require consent? Umami sets no cookies and writes nothing to your browser's storage. To tell unique visits apart it computes, on our server, a hash of your IP address, your browser and the site identifier with a periodically rotating salt; that hash cannot be reversed to the IP, can no longer be linked to new visits once the salt rotates, and is shared with no one. What our team sees are aggregate statistics (pages, sources, countries, devices). We do not use it to profile, to advertise, to match with other data or to re-identify anyone, and aggregate data is retained for no more than 25 months. Under those conditions we rely on the audience-measurement exemption of Art. 5.3 of the ePrivacy Directive as set out in the Spanish DPA (AEPD) analytics guidance; the documented assessment is available on request at privacy [arroba] citaflow [punto] com .
2.4 Marketing and Advertising Cookies
Status: Require consent
Purpose: Used to show you relevant ads and measure the effectiveness of our advertising campaigns. These cookies track your visit to our website and other sites to create a profile of your interests.
Legal basis: Consent (Art. 6.1.a GDPR + Art. 5.3 ePrivacy Directive)
| Provider | Cookie | Duration | Description |
| Meta (Facebook) | _fbp | 3 months | Facebook Pixel for conversion tracking and retargeting |
| fr | 3 months | Advertising cookie to display relevant ads |
| _fbc | 2 years | Stores click information from Facebook ads |
| TikTok | _ttp | 13 months | TikTok Pixel for campaign measurement and attribution |
| _tta | 1 year | User identifier for audience analysis |
| Google Ads | _gcl_au | 3 months | Google Ads conversion attribution (only after consent) |
Important: The Meta and TikTok pixels only load after you give your explicit consent through the cookie banner. The Google Ads tag is not downloaded until you accept; when you do, it runs in consent mode (Consent Mode v2) with the permissions you granted. You can withdraw your consent at any time from the preference center.
In addition to the pixels, when you contact us from the website and only if you have accepted marketing cookies, we may record the conversion event server-side with Meta and TikTok using pseudonymized identifiers (SHA-256 hashed email or phone number), in order to measure the effectiveness of our campaigns.
3. How to manage your cookie preferences?
3.1 Preference Center
You can manage your cookie preferences at any time by clicking the following button:
3.2 Browser Settings
You can also configure your browser to block or alert you about cookies:
- Chrome: Settings → Privacy and security → Cookies and other site data
- Firefox: Options → Privacy & Security → Cookies and Site Data
- Safari: Preferences → Privacy → Manage Website Data
- Edge: Settings → Cookies and site permissions → Cookies and site data
Note: Blocking all cookies may affect website functionality.
4. Third-party cookies
Some of our providers may set third-party cookies when you visit our website. We do not have control over these cookies. We recommend you consult the privacy policies of these third parties:
5. Geolocation and scope
The cookie banner and consent request are displayed only to visitors located in the European Economic Area (EEA), United Kingdom, and other countries with similar data protection legislation.
We use IP-based geolocation to determine your location. If we cannot determine your location with certainty, we will display the banner as a precaution to ensure compliance.
For visitors outside these jurisdictions, marketing cookies load automatically without requesting consent, in accordance with the applicable laws in their respective countries, unless your browser sends a Global Privacy Control signal or you previously rejected them via "Cookie settings" in the footer.
6. US Privacy Notice (California and other US States)
This section applies to residents of California and other US states with comprehensive privacy laws (such as Virginia, Colorado, Connecticut, and Utah).
6.1 Categories of Information Collected
Through our cookies and tracking technologies, we may collect: identifiers (IP address, device ID), internet activity information (browsing history on our site, interactions with ads), and inferences drawn from this information.
6.2 "Sale" or "Sharing" of Personal Information
Under California law (CPRA/CCPA), certain advertising cookies and cross-context behavioral advertising may be considered "selling" or "sharing" personal information. When we use marketing pixels (Meta, TikTok, Google Ads) for targeted advertising purposes, this may constitute sharing under California law.
Your Rights: California residents have the right to opt out of the sale or sharing of their personal information.
6.3 Do Not Sell or Share My Personal Information
To exercise your right to opt out of the sale or sharing of your personal information:
- Cookie Settings: Click the "Open cookie settings" button above to disable marketing cookies
- Global Privacy Control: We honor Global Privacy Control (GPC) signals. If your browser sends a GPC signal, we will treat it as a valid opt-out request
- Direct Request: Email us at privacy [arroba] citaflow [punto] com with "Do Not Sell or Share" in the subject line
6.4 Other California Rights
California residents also have the right to: know what personal information we collect, delete personal information, correct inaccurate personal information, and not be discriminated against for exercising privacy rights. See our Privacy Policy for how to exercise these rights.
6.5 Sensitive Personal Information
We do not use or disclose sensitive personal information for purposes other than those permitted by the CPRA.
7. Updates to this policy
We may update this Cookie Policy periodically to reflect changes in the cookies we use or for legal reasons. We will notify you of significant changes through a prominent notice on our website or by email.
The "Last updated" date at the beginning of this policy indicates when the last revision was made.
8. Contact
If you have questions about our Cookie Policy or wish to exercise your rights, you can contact us at:
You can also consult our Privacy Policy for more information on how we process your personal data.