Cookie Policy
Last updated: September 2026
1. What cookies are
Cookies are small text files that the websites you visit send to your device (computer, tablet, smartphone), where they are stored and then sent back to those same sites on your next visit. Cookies let a site work correctly, improve the browsing experience and give information to the site's owner.
Besides cookies, this document also tells you about other similar tracking tools (pixels, local storage, server-side conversion events), in line with the guidelines of the Italian Data Protection Authority of 10 June 2021.
2. Data controller
- Roberto Cinque
- P.IVA 10201131215
- Email: info.robertocinque@gmail.com
3. Types of cookie used
A. Technical cookies (strictly necessary)
These cookies are essential for the site to work and do not require your consent. They cannot be switched off.
| Cookie | Provider | Purpose | Type | Duration |
|---|---|---|---|---|
| cookie_consent | Artificiale | Stores your cookie preferences | Persistent | 6 months |
| NEXT_LOCALE | Artificiale | Stores the language you chose, so later visits don't fall back to the automatically detected one | Persistent | 12 months |
B. Analytics cookies and tools
These tools are used to gather aggregate information about how the site is used and to understand how visitors interact with the pages.
| Tool | Provider | Purpose | Cookies | Consent |
|---|---|---|---|---|
| Vercel Analytics | Vercel Inc. | Aggregate statistics (pages visited, performance) | No cookies — identification based on an anonymised hash of the request headers | Not required (no personal data collected) |
| PostHog | PostHog Inc. | Behaviour analysis, events and conversion funnels | First-party cookies (e.g. ph_phc_*) — persistent, up to 12 months | Required — enabled only after explicit consent |
| Google Ads (gtag.js) | Google Ireland Ltd. | Measuring advertising campaign conversions and remarketing | First-party cookies (e.g. _gcl_au) and the gclid parameter — up to 90 days | Required — enabled only after explicit consent |
| ChatGPT Ads (oaiq pixel) | OpenAI | Conversion measurement for advertising campaigns on ChatGPT | First-party cookies __obref and __oppref | Required — the pixel is loaded only after explicit consent |
Google Ads is handled through Consent Mode v2: without consent the state is set to denied and no advertising cookie is written. Only after explicit consent to analytics cookies does the state move to granted and conversion measurement start.
Vercel Analytics uses no cookies and collects only aggregate, anonymous data, so it is treated as an analytics tool exempt from consent under the Italian Authority's guidelines (aggregate data, masked IP, no sharing with third parties, no cross-referencing with other information).
C. Server-side notification of a WhatsApp click
Clicking a WhatsApp button or the booking link triggers a Telegram notification to the controller, generated by a serverless function hosted on Vercel. That notification installs no cookie, does not store the IP address and is not saved in any database: there is no event archive. It contains the page, the button position, the campaign parameters (utm_*), the referrer, the device type (desktop or mobile) and the page language.
From the same function, and with no cookie at all, the WhatsApp click is reported to OpenAI as a ChatGPT Ads conversion: click identifier read from the page address, IP address, user agent, event identifier, date and time. Since nothing is read from or written to the terminal equipment, this transmission falls outside art. 122 of Legislative Decree 196/2003 and rests on legitimate interest (art. 6.1.f GDPR). Choosing “Necessary only” in the banner stops it: that is the objection under art. 21 GDPR. The browser pixel, which does use cookies, remains subject to consent and is described under B.
Without analytics consent the notification includes no session identifier and no gclid or fbclid. Only with consent are the session identifier and advertising click identifiers added, which is what allows a conversion to be traced back to the campaign it came from. The message stays only in the controller's Telegram chat; the function's logs on Vercel are short-lived, following the platform's standard periods.
D. Language detection
The site is shown in the visitor's language. To decide which, it reads, in order: the explicit choice saved in the NEXT_LOCALE technical cookie, the country the hosting infrastructure derives from the IP address, and the preferred language declared by the browser. The IP address is neither read nor stored by the controller: it arrives already reduced to a country code, which is not retained. None of these steps installs any cookie other than NEXT_LOCALE, which is written only when you pick a language in the footer.
4. Third-party services
The site may pass data to the following third-party services. The relevant privacy notice is given for each:
- Vercel Inc. — site hosting, the serverless function that sends the click notification and aggregate analytics — Vercel Privacy Policy
- PostHog Inc. — product analytics — PostHog Privacy Policy
- Google Ireland Ltd. — advertising conversion measurement (Google Ads) — Google Privacy Policy
- OpenAI — conversion measurement for ChatGPT Ads campaigns (cookie-based pixel, only after consent; cookie-free server-side reporting, on legitimate interest) — OpenAI Privacy Policy
- WhatsApp Ireland Ltd. (Meta) — the conversation started by clicking the WhatsApp buttons happens in the app and involves no cookies on the site — WhatsApp Privacy Policy
- Telegram FZ-LLC — notifying the controller of WhatsApp button clicks and calendar openings (no cookies on the site) — Telegram Privacy Policy
- Calendly LLC — call booking: the site only links out to calendly.com, embeds no widget and sets no Calendly cookies — Calendly Privacy Notice
5. Legal basis
- Technical cookies: no consent required, as they are strictly necessary for the site to work (Art. 122(1), Italian Legislative Decree 196/2003).
- Anonymised first-party analytics (Vercel Analytics, the click notification without identifiers): treated as equivalent to technical cookies by the Italian Authority; no consent required when used solely for aggregate statistics and without cross-referencing other information.
- Profiling analytics cookies (PostHog): require your prior, explicit consent, collected through the cookie banner on first visit (Art. 122(1), Legislative Decree 196/2003; Art. 6(1)(a) GDPR).
- Advertising cookies (Google Ads): require prior, explicit consent. Without consent they run in Consent Mode denied, writing no cookies (Art. 122(1), Legislative Decree 196/2003; Art. 6(1)(a) GDPR).
- Server-side ChatGPT Ads conversion measurement: it neither sets nor reads cookies, so it falls outside art. 122 of Legislative Decree 196/2003. It rests on legitimate interest (art. 6.1.f GDPR) and stops when you choose “Necessary only” in the banner (art. 21 GDPR).
6. Cookie banner and managing consent
On your first visit you see an information banner that lets you:
- Accept all cookies, including analytics and advertising ones
- Reject all non-necessary cookies (only technical cookies stay active)
- Customise your preferences, category by category
- Close the banner with the close button, which counts as not giving consent
Scrolling the page does not count as consent. Non-essential cookies are not installed until you make an explicit choice.
Your choice is recorded and kept for 6 months. After that the banner is shown again.
7. Managing cookies from your browser
You can also manage cookie preferences directly from your browser settings:
Disabling technical cookies may stop the site from working properly.
8. Withdrawing consent
You can withdraw cookie consent at any time:
- by opening the cookie settings panel from the “Cookie preferences” link in the site footer
- by deleting cookies from your browser settings (section 7)
- by sending a request to info.robertocinque@gmail.com
Withdrawing consent does not affect the lawfulness of processing based on consent given before the withdrawal.
9. Your rights
To exercise the rights set out in Articles 15-22 GDPR (access, rectification, erasure, restriction, portability, objection), see the Privacy Policy, section 9.
10. Updates
This Cookie Policy may be updated from time to time to reflect changes to the tools used or to the applicable law. The date of the last update is shown at the top of the document.
11. Applicable legislation
- Regulation (EU) 2016/679 (GDPR)
- Italian Legislative Decree 196/2003 (Privacy Code) as amended (Legislative Decree 101/2018)
- Directive 2002/58/EC (ePrivacy Directive)
- Guidelines of the Italian Data Protection Authority on cookies and other tracking tools (decision no. 231 of 10 June 2021, effective from 10 January 2022)