Cookie Policy
Information on the use of cookies and similar technologies pursuant to EU and Italian data protection legislation
1. What are cookies
Cookies are small text files that websites visited by the user send to the user's browser (or device), where they are stored and retransmitted to the same websites on subsequent visits. Cookies may be set by the website the user is visiting (first-party cookies) or by other websites that provide content on the page being viewed (third-party cookies). Similar technologies, such as localStorage, serve comparable purposes. The use of cookies and similar technologies is governed by Directive 2002/58/EC (ePrivacy Directive), as amended by Directive 2009/136/EC, and by its transposition into Italian law.
2. Legal framework
The use of cookies and similar tracking technologies on this website is governed by Article 122 of Legislative Decree 196/2003 (Italian Personal Data Protection Code), Article 5(3) of Directive 2002/58/EC (ePrivacy Directive), and the General Data Protection Regulation (EU) 2016/679 (GDPR), in particular Article 5(1)(e) on the principle of storage limitation. In accordance with these provisions, strictly technical cookies — those necessary for the transmission of a communication over an electronic network or for the provision of a service explicitly requested by the user — do not require prior consent but are disclosed in this policy for transparency. Analytical, profiling, and marketing cookies are installed only after the user has given explicit, informed consent via the cookie banner displayed on the first visit.
3. Types of cookies and technologies used
Technical cookies (necessary)
These cookies are essential for the proper functioning of the website and cannot be disabled without compromising core features. They do not require the user's consent. They include:
- AWS Cognito authentication tokens: the website uses the AWS Cognito service for user authentication management. Tokens (IdToken, AccessToken, RefreshToken) are stored in the browser's localStorage and are necessary to maintain the authenticated session, verify user identity, and authorize access to protected account resources.
- Consent preferences (localStorage): store the user's cookie consent choices locally in the browser (pythagor_cookie_consent, pythagor_cookie_analytics, pythagor_cookie_marketing), ensuring that the consent decision persists across browsing sessions without transmitting data to external servers
- Security cookies (Stripe): the payment processor Stripe installs technical cookies necessary for fraud prevention and secure management of payment sessions. These cookies are essential to ensure the security of financial transactions made on the website.
Analytical cookies
We use Google Analytics to collect aggregate, anonymised information about website usage, including the number of visitors, pages visited, and browsing behaviour. The cookies used are _ga (distinguishes unique users, duration: 2 years), _gid (distinguishes users within a 24-hour window), and _gat (throttles request rate, duration: 1 minute). These cookies are installed only after the user has provided explicit consent via the cookie banner. No personal data is collected in identifiable form.
Functional cookies and tracking technologies
Sentry (Functional Software Inc.) is used for error monitoring and application stability. Sentry does not set cookies; it captures network request metadata and error stack traces under the legal basis of the controller's legitimate interest in maintaining service reliability (GDPR Article 6(1)(f)). Mapbox (Mapbox Inc.) may send anonymous telemetry events to events.mapbox.com for map tile performance monitoring. Mapbox telemetry does not set cookies on the user's device and does not collect personal data.
4. Cookie inventory
The following table provides a detailed inventory of all cookies set by this website, including their name, provider, purpose, category, and duration.
| Name | Provider | Purpose | Category | Duration |
|---|---|---|---|---|
| CognitoIdentityServiceProvider.*.idToken | AWS Cognito | Verification of the authenticated user's identity | Necessary | 1 hour (auto-refresh) |
| CognitoIdentityServiceProvider.*.accessToken | AWS Cognito | Authorization to access protected account resources | Necessary | 1 hour (auto-refresh) |
| CognitoIdentityServiceProvider.*.refreshToken | AWS Cognito | Automatic renewal of the authentication session | Necessary | 30 days |
| CognitoIdentityServiceProvider.*.LastAuthUser | AWS Cognito | Identification of the last authenticated user | Necessary | Persistent |
| _ga | Google Analytics | Distinguishing unique users for traffic statistics | Analytics | 2 years |
| _gid | Google Analytics | Distinguishing users over a 24-hour period | Analytics | 24 hours |
| _gat | Google Analytics | Throttling the rate of requests to Google Analytics | Analytics | 1 minute |
| __stripe_mid | Stripe | Payment fraud prevention | Necessary | 1 year |
| __stripe_sid | Stripe | Managing the current payment session | Necessary | 30 minutes |
5. Local storage technologies (localStorage)
In addition to cookies, this website uses the browser's localStorage mechanism to store certain preferences and operational flags. Unlike cookies, localStorage data is never automatically transmitted to the server with each request. The following table lists all localStorage keys used by the website.
| Key | Provider | Purpose | Duration |
|---|---|---|---|
| pythagor_cookie_consent | Pythagor | Storing the user's cookie consent choice | Persistent |
| pythagor_cookie_analytics | Pythagor | Analytics cookie preference | Persistent |
| pythagor_cookie_marketing | Pythagor | Marketing cookie preference | Persistent |
| pythagor_push_enabled | Pythagor | Browser push notification preference | Persistent |
| pythagor_email_enabled | Pythagor | Email notification preference | Persistent |
| pythagor_onboarding_bonus_claimed_{userId} | Pythagor | Recording that the welcome bonus has been claimed | Persistent |
| ghl_analytics_user_id | GoHighLevel | Visitor analytics identifier, stored by GoHighLevel on its own domain when the booking calendar is loaded | Persistent |
| v2_history_*, v2_session_history_*, v2_contact_session_*, v3_first_session_event_* | GoHighLevel | Session and browsing history of the booking calendar visit, stored by GoHighLevel on its own domain | Persistent |
6. Third-party cookies and services
This website integrates the following third-party services, each of which may set its own cookies or collect data independently. We recommend consulting the respective privacy policies for full details:
- AWS Cognito (Amazon Web Services): identity management and user authentication service, provided by Amazon Web Services, Inc. Session tokens are stored in the browser's localStorage. Privacy policy: https://aws.amazon.com/privacy/
- Google Analytics (Google LLC): website performance monitoring and aggregate traffic analysis. Cookies used: _ga, _gid, _gat. Installed only with user consent. Privacy policy: https://policies.google.com/privacy
- Stripe (Stripe Inc.): online payment processing platform provided by Stripe, Inc. It installs technical cookies necessary for fraud prevention and secure transaction management. Privacy policy: https://stripe.com/privacy
- Sentry (Functional Software Inc.): application error monitoring and crash reporting. No cookies are set; data processing is based on the controller's legitimate interest. Privacy policy: https://sentry.io/privacy/
- Mapbox (Mapbox Inc.): interactive map rendering and anonymous telemetry for tile performance. No cookies are set on the user's device. Privacy policy: https://www.mapbox.com/legal/privacy
- GoHighLevel (HighLevel Inc.): contact and appointment management platform provided by HighLevel Inc. (United States). The booking calendar embedded on the /prenota page sets no cookies, but it stores several keys in localStorage on its own domain, including a persistent visitor identifier used for analytics; it loads when the page opens, and the page states this with a link to this policy. The same platform also receives the data submitted through the contact form, the research request form and account registration, for the management of the commercial relationship. Privacy policy: https://www.gohighlevel.com/privacy-policy
Data transferred to third-party providers located outside the European Economic Area is protected by adequate safeguards, including Standard Contractual Clauses (SCCs) pursuant to GDPR Article 46(2)(c). For further information, please consult the privacy policies linked above.
7. Cookie management
Users can manage their cookie preferences directly through their browser settings. Most modern browsers allow users to:
- View all stored cookies and delete them individually
- Block third-party cookies while allowing first-party cookies
- block all cookies, preventing the installation of any cookie on their device;
- Automatically delete all cookies when closing the browser
Please note that disabling technical cookies may significantly impair the functioning of the website and prevent access to authenticated services.
8. How to give or revoke consent
Upon the user's first visit, a cookie consent banner is displayed, allowing the user to accept or decline non-essential cookies (analytical and marketing). The user may change their preferences at any time by clicking the "Cookie preferences" link available in the website footer. Revoking consent does not affect the lawfulness of processing carried out on the basis of consent given prior to its withdrawal.
9. Updates
This Cookie Policy may be updated periodically to reflect changes in the cookies and technologies used, or to comply with new regulatory requirements. Users are encouraged to consult this page regularly. The date of the last update is indicated at the bottom of this page.
2026-05-09
10. Contact
For any questions or requests regarding the use of cookies and similar technologies, you may contact the Data Controller at info@pythagor.it.