Cookie policy

Google Tag Manager

Loads and organises measurement and marketing tags. It does not profile on its own, but it can start other services according to consent.

• Provider: Google Ireland Limited / Google LLC
• Consent category: Necessary
• Legal basis: Legitimate interest / contract (GDPR art. 6(1)(b)(f))
• Data: URL, events, tag identifiers
• Cookie: none typical
• Retention: No cookies of its own; retention depends on the tags enabled in the container

May involve a transfer outside the EEA and Switzerland, for example to the United States.

Privacy: https://policies.google.com/privacy

Google tag (gtag.js)

Google snippet that sends events to Analytics, Ads and other Google products. Behaviour follows consent (Consent Mode v2).

• Provider: Google Ireland Limited / Google LLC
• Consent category: Necessary
• Legal basis: Legitimate interest / contract (GDPR art. 6(1)(b)(f))
• Data: Events, measurement ID, Consent Mode state
• Cookie: none typical
• Retention: No cookies of its own; duration depends on the connected Google products

May involve a transfer outside the EEA and Switzerland, for example to the United States.

Privacy: https://policies.google.com/privacy

Google Analytics 4

Measures visits and on-site behaviour. Starts after statistics consent. QS Cookies reports this with analytics_storage.

• Provider: Google Ireland Limited / Google LLC
• Consent category: Statistics
• Legal basis: Consent (GDPR art. 6(1)(a))
• Data: IP address (possibly anonymised), device, pages, events, client ID
• Cookie: _ga, _ga_*, _gid
• Retention: _ga and _ga_*: 24 months; _gid: 24 hours

May involve a transfer outside the EEA and Switzerland, for example to the United States.

Privacy: https://policies.google.com/privacy

Google Signals

GA4 feature that joins sessions across devices for signed-in Google users. Needs consent and an opt-in in the property.

• Provider: Google Ireland Limited / Google LLC
• Consent category: Statistics
• Legal basis: Consent (GDPR art. 6(1)(a))
• Data: Cross-device sessions, data from users signed in to Google, demographics
• Cookie: _ga, _ga_*
• Retention: _ga and _ga_*: 24 months, same as Google Analytics 4

May involve a transfer outside the EEA and Switzerland, for example to the United States.

Privacy: https://policies.google.com/privacy

Microsoft Clarity

Analyses usability and sessions to understand how people use the site.

• Provider: Microsoft Ireland Operations / Microsoft Corporation
• Consent category: Statistics
• Legal basis: Consent (GDPR art. 6(1)(a))
• Data: Interactions, heatmaps, session recordings, device
• Cookie: _clck, _clsk
• Retention: _clck: about 1 year; _clsk: 1 day, per Microsoft

May involve a transfer outside the EEA and Switzerland, for example to the United States.

Privacy: https://privacy.microsoft.com/privacystatement

Meta Pixel

Browser pixel for Facebook, Instagram and Messenger. Measures conversions and builds audiences. Starts after marketing consent.

• Provider: Meta Platforms Ireland Ltd / Meta Platforms, Inc.
• Consent category: Marketing
• Legal basis: Consent (GDPR art. 6(1)(a))
• Data: Pages, events, advertising identifiers, browser
• Cookie: _fbp, _fbc, fr
• Retention: _fbp, _fbc and fr: 90 days, per Meta

May involve a transfer outside the EEA and Switzerland, for example to the United States.

Privacy: https://www.facebook.com/privacy/policy/

Meta Conversions API (CAPI)

Sends server-side events to Meta (purchases, leads, signups) so campaigns can be measured when browser cookies are not enough.

• Provider: Meta Platforms Ireland Ltd / Meta Platforms, Inc.
• Consent category: Marketing
• Legal basis: Consent (GDPR art. 6(1)(a))
• Data: Server-side events, hashed email/phone number, click ID, order value
• Cookie: _fbp, _fbc
• Retention: Cookies read from the browser (_fbp, _fbc): 90 days; server-side events follow Meta's measurement retention

May involve a transfer outside the EEA and Switzerland, for example to the United States.

Privacy: https://www.facebook.com/privacy/policy/

Meta SDK / Facebook SDK

Meta SDK for apps and advanced web: in-app events, login and campaign measurement.

• Provider: Meta Platforms Ireland Ltd / Meta Platforms, Inc.
• Consent category: Marketing
• Legal basis: Consent (GDPR art. 6(1)(a))
• Data: App events, device ID, advertising identifiers
• Cookie: none typical
• Retention: No cookies of its own in the browser; retention on Meta's side follows the app's settings

May involve a transfer outside the EEA and Switzerland, for example to the United States.

Privacy: https://www.facebook.com/privacy/policy/

WhatsApp Business Cloud API

Messages and click-to-WhatsApp for support or campaigns. Data goes through Meta infrastructure.

• Provider: WhatsApp Ireland Limited / Meta Platforms, Inc.
• Consent category: Marketing
• Legal basis: Consent (GDPR art. 6(1)(a))
• Data: Phone number, messages, conversation events, CTA clicks
• Cookie: none typical
• Retention: No cookies; messages and events are kept per the WhatsApp Business account settings

May involve a transfer outside the EEA and Switzerland, for example to the United States.

Privacy: https://www.whatsapp.com/legal/privacy-policy

Meta Offline Conversions / Custom Audiences

Uploads offline conversions and customer lists to Meta for measurement and retargeting, usually with hashed data.

• Provider: Meta Platforms Ireland Ltd / Meta Platforms, Inc.
• Consent category: Marketing
• Legal basis: Consent (GDPR art. 6(1)(a))
• Data: Hashed email/phone number, offline events, custom audiences
• Cookie: none typical
• Retention: No cookies; uploaded lists persist per the Meta custom audience settings (typically up to 180 days unless refreshed)

May involve a transfer outside the EEA and Switzerland, for example to the United States.

Privacy: https://www.facebook.com/privacy/policy/

Google Ads

Measures Search, Display and Shopping campaigns. QS Cookies uses ad_storage, ad_user_data and ad_personalization.

• Provider: Google Ireland Limited / Google LLC
• Consent category: Marketing
• Legal basis: Consent (GDPR art. 6(1)(a))
• Data: Clicks, conversions, advertising identifiers
• Cookie: _gcl_au, _gcl_aw, IDE
• Retention: _gcl_au and _gcl_aw: 90 days; IDE: 13 months, per Google

May involve a transfer outside the EEA and Switzerland, for example to the United States.

Privacy: https://policies.google.com/privacy

Google Ads Remarketing

Builds remarketing lists and shows ads to people who already visited the site.

• Provider: Google Ireland Limited / Google LLC
• Consent category: Marketing
• Legal basis: Consent (GDPR art. 6(1)(a))
• Data: Pages viewed, remarketing lists, identifiers
• Cookie: IDE, NID, _gcl_*
• Retention: IDE: 13 months; _gcl_*: 90 days; NID: a few months, variable per Google

May involve a transfer outside the EEA and Switzerland, for example to the United States.

Privacy: https://policies.google.com/privacy

Display & Video 360

Buys and measures Google programmatic display and video ads.

• Provider: Google Ireland Limited / Google LLC
• Consent category: Marketing
• Legal basis: Consent (GDPR art. 6(1)(a))
• Data: Programmatic impressions, audiences, conversions
• Cookie: IDE, DSID
• Retention: IDE: 13 months; DSID: tied to the Google account session, variable duration

May involve a transfer outside the EEA and Switzerland, for example to the United States.

Privacy: https://policies.google.com/privacy

Search Ads 360

Measures and optimises search campaigns across engines via Search Ads 360.

• Provider: Google Ireland Limited / Google LLC
• Consent category: Marketing
• Legal basis: Consent (GDPR art. 6(1)(a))
• Data: Search clicks, conversions, keywords
• Cookie: _gcl_*
• Retention: _gcl_*: 90 days, per Google

May involve a transfer outside the EEA and Switzerland, for example to the United States.

Privacy: https://policies.google.com/privacy

LinkedIn Insight Tag

Measures LinkedIn campaigns and audiences.

• Provider: LinkedIn Ireland Unlimited Company / LinkedIn Corporation
• Consent category: Marketing
• Legal basis: Consent (GDPR art. 6(1)(a))
• Data: Pages, conversions, LinkedIn identifiers
• Cookie: li_sugr, bcookie, lidc
• Retention: bcookie: 2 years; lidc: 24 hours; li_sugr: 3 months, per LinkedIn

May involve a transfer outside the EEA and Switzerland, for example to the United States.

Privacy: https://www.linkedin.com/legal/privacy-policy

TikTok Pixel

Measures and optimises TikTok campaigns.

• Provider: TikTok Technology Limited / TikTok Inc.
• Consent category: Marketing
• Legal basis: Consent (GDPR art. 6(1)(a))
• Data: Events, device, advertising identifiers
• Cookie: _ttp, ttclid
• Retention: _ttp: 13 months; ttclid: a few days, per TikTok

May involve a transfer outside the EEA and Switzerland, for example to the United States.

Privacy: https://www.tiktok.com/legal/page/eea/privacy-policy/en

Pinterest Tag

Measures conversions and serves ads on Pinterest.

• Provider: Pinterest Europe Ltd
• Consent category: Marketing
• Legal basis: Consent (GDPR art. 6(1)(a))
• Data: Pages, conversions, identifiers
• Cookie: _pinterest_ct_ua, _epik
• Retention: Variable duration per Pinterest Ads settings, typically up to 1 year

May involve a transfer outside the EEA and Switzerland, for example to the United States.

Privacy: https://policy.pinterest.com/privacy-policy

Microsoft Advertising UET

Microsoft Advertising Universal Event Tracking (UET) tag (ads on Bing and the Microsoft network). Measures conversions and builds remarketing lists. Starts after marketing consent, using UET Consent Mode (ad_storage).

• Provider: Microsoft Ireland Operations Limited / Microsoft Corporation
• Consent category: Marketing
• Legal basis: Consent (GDPR art. 6(1)(a))
• Data: Pages viewed, events and conversions, click ID (msclkid), IP address, device and browser, Microsoft advertising identifiers
• Cookie: _uetsid, _uetvid, _uetmsclkid, MUID
• Retention: _uetsid: 1 day; _uetvid: 13 months; _uetmsclkid: 90 days; MUID: 13 months, per Microsoft

May involve a transfer outside the EEA and Switzerland, for example to the United States.

Privacy: https://privacy.microsoft.com/privacystatement

X Pixel (conversion tracking)

Browser pixel for X (formerly Twitter) advertising campaigns. Measures conversions and builds remarketing audiences. Starts after marketing consent.

• Provider: X Internet Unlimited Company / X Corp.
• Consent category: Marketing
• Legal basis: Consent (GDPR art. 6(1)(a))
• Data: Pages viewed, events and conversions, click ID (twclid), browser and advertising identifiers, e-mail or phone only if sent for matching
• Cookie: _twclid, _twpid, _twsid, muc_ads, personalization_id
• Retention: _twclid, _twpid and _twsid: 13 months (390 days, from X's pixel code); muc_ads and personalization_id: X does not publish the duration and states that in certain areas its cookie lifespans are capped at 13 months

May involve a transfer outside the EEA and Switzerland, for example to the United States.

Privacy: https://x.com/en/privacy

Google reCAPTCHA

Protects forms and logins from spam and bots. May send usage data to Google.

• Provider: Google Ireland Limited / Google LLC
• Consent category: Necessary
• Legal basis: Legitimate interest / contract (GDPR art. 6(1)(b)(f))
• Data: IP address, pointer behaviour, device, anti-abuse score
• Cookie: _GRECAPTCHA
• Retention: _GRECAPTCHA: about 6 months, per Google

May involve a transfer outside the EEA and Switzerland, for example to the United States.

Privacy: https://policies.google.com/privacy

YouTube

Embedded YouTube player. May set Google and profiling cookies.

• Provider: Google Ireland Limited / Google LLC
• Consent category: Marketing
• Legal basis: Consent (GDPR art. 6(1)(a))
• Data: Videos watched, device, Google identifiers
• Cookie: VISITOR_INFO1_LIVE, YSC, PREF
• Retention: VISITOR_INFO1_LIVE: about 6 months; YSC: session-length; PREF: up to 2 years, per Google

May involve a transfer outside the EEA and Switzerland, for example to the United States.

Privacy: https://policies.google.com/privacy

Vimeo

Embedded Vimeo player.

• Provider: Vimeo.com, Inc.
• Consent category: Preferences
• Legal basis: Consent (GDPR art. 6(1)(a))
• Data: Video, device, player preferences
• Cookie: vuid, player
• Retention: Per Vimeo's settings, typically up to 2 years for vuid

May involve a transfer outside the EEA and Switzerland, for example to the United States.

Privacy: https://vimeo.com/privacy

Bunny Stream / Bunny.net

Bunny.net video hosting and player (CDN and Stream). EU provider, used for first-party video instead of YouTube.

• Provider: BunnyWay d.o.o.
• Consent category: Preferences
• Legal basis: Consent (GDPR art. 6(1)(a))
• Data: Videos requested, IP address, device, viewing statistics
• Cookie: none typical
• Retention: No cookies of its own; technical logs kept per Bunny.net's policy (EU provider)

Privacy: https://bunny.net/privacy

Wistia

Wistia video player and analytics, often used for marketing and courses.

• Provider: Wistia, Inc.
• Consent category: Statistics
• Legal basis: Consent (GDPR art. 6(1)(a))
• Data: Videos watched, engagement, email address if the viewer is identified
• Cookie: wistia, __distillery
• Retention: Per Wistia's settings, typically up to 2 years

May involve a transfer outside the EEA and Switzerland, for example to the United States.

Privacy: https://wistia.com/privacy

Google Fonts

Loads fonts from Google CDN. May send the IP address to Google.

• Provider: Google Ireland Limited / Google LLC
• Consent category: Necessary
• Legal basis: Legitimate interest / contract (GDPR art. 6(1)(b)(f))
• Data: IP address, user agent, fonts requested
• Cookie: none typical
• Retention: No cookies; requests to the CDN generate technical logs on Google's side for a few days

May involve a transfer outside the EEA and Switzerland, for example to the United States.

Privacy: https://policies.google.com/privacy

Cloudflare

CDN, DNS, DDoS protection and performance.

• Provider: Cloudflare, Inc.
• Consent category: Necessary
• Legal basis: Legitimate interest / contract (GDPR art. 6(1)(b)(f))
• Data: IP address, technical logs, anti-abuse measures
• Cookie: __cf_bm, cf_clearance
• Retention: __cf_bm: 30 minutes; cf_clearance: up to 1 year depending on the controller's configuration

May involve a transfer outside the EEA and Switzerland, for example to the United States.

Privacy: https://www.cloudflare.com/privacypolicy/

Hostinger

Web and VPS hosting. Processes technical delivery data.

• Provider: Hostinger International Ltd
• Consent category: Necessary
• Legal basis: Legitimate interest / contract (GDPR art. 6(1)(b)(f))
• Data: Server logs, IP address, site files
• Cookie: none typical
• Retention: No cookies; technical logs kept per Hostinger's policy

May involve a transfer outside the EEA and Switzerland, for example to the United States.

Privacy: https://www.hostinger.com/legal/privacy-policy

Google Drive

File storage and sharing (backups, documents, media).

• Provider: Google Ireland Limited / Google LLC
• Consent category: Necessary
• Legal basis: Legitimate interest / contract (GDPR art. 6(1)(b)(f))
• Data: Uploaded files, metadata, linked Google account
• Cookie: none typical
• Retention: No cookies; files remain until the controller deletes them from the Google Drive account

May involve a transfer outside the EEA and Switzerland, for example to the United States.

Privacy: https://policies.google.com/privacy

Google Cloud Storage

Google Cloud object storage for files and backups.

• Provider: Google Ireland Limited / Google LLC
• Consent category: Necessary
• Legal basis: Legitimate interest / contract (GDPR art. 6(1)(b)(f))
• Data: Objects, backups, logs
• Cookie: none typical
• Retention: No cookies; objects remain until the controller deletes them or lifecycle rules apply

May involve a transfer outside the EEA and Switzerland, for example to the United States.

Privacy: https://policies.google.com/privacy

GoHighLevel

Agency CRM and automation: email, SMS, pipeline and funnels. The client's contact data goes through the platform.

• Provider: HighLevel Inc.
• Consent category: Marketing
• Legal basis: Consent (GDPR art. 6(1)(a))
• Data: Email address, phone number, CRM, appointments, opens, clicks
• Cookie: none typical
• Retention: No cookies on the site; contact data remains in the agency's GoHighLevel account until removed

May involve a transfer outside the EEA and Switzerland, for example to the United States.

Privacy: https://www.gohighlevel.com/privacy-policy

OpenAI

GPT models for assistants, text generation or site features. Submitted content may leave the EEA.

• Provider: OpenAI Ireland Ltd / OpenAI, L.L.C.
• Consent category: Necessary
• Legal basis: Legitimate interest / contract (GDPR art. 6(1)(b)(f))
• Data: Prompts, responses, any files or text sent to the model
• Cookie: none typical
• Retention: No cookies; OpenAI retains prompts and responses per its own policy (typically up to 30 days for API abuse monitoring only, unless legally required)

May involve a transfer outside the EEA and Switzerland, for example to the United States.

Privacy: https://openai.com/policies/privacy-policy

Anthropic Claude

Claude models for chat, summaries or internal and customer-facing automation.

• Provider: Anthropic PBC / Anthropic Ireland Ltd
• Consent category: Necessary
• Legal basis: Legitimate interest / contract (GDPR art. 6(1)(b)(f))
• Data: Prompts, responses, any attached documents
• Cookie: none typical
• Retention: No cookies; Anthropic retains prompts and responses per its own policy, with different periods for API use versus account use, per Anthropic

May involve a transfer outside the EEA and Switzerland, for example to the United States.

Privacy: https://www.anthropic.com/legal/privacy

Google Gemini

Gemini models (AI Studio / Vertex AI) for generative features on the site or in the back office.

• Provider: Google Ireland Limited / Google LLC
• Consent category: Necessary
• Legal basis: Legitimate interest / contract (GDPR art. 6(1)(b)(f))
• Data: Prompts, responses, any files, Google account if linked
• Cookie: none typical
• Retention: No cookies; Google retains prompts and responses per the account settings and the Gemini, AI Studio and Vertex AI policies

May involve a transfer outside the EEA and Switzerland, for example to the United States.

Privacy: https://policies.google.com/privacy

Stripe

Takes payments and prevents fraud.

• Provider: Stripe Payments Europe / Stripe, Inc.
• Consent category: Necessary
• Legal basis: Performance of the contract (GDPR art. 6(1)(b)) and legal obligation for accounting and tax (art. 6(1)(c))
• Data: Payment data, email address, IP address, anti-fraud device signals
• Cookie: __stripe_mid, __stripe_sid
• Retention: __stripe_mid: 1 year; __stripe_sid: 30 minutes, per Stripe

May involve a transfer outside the EEA and Switzerland, for example to the United States.

Privacy: https://stripe.com/privacy

PayPal

Takes payments via PayPal account or card.

• Provider: PayPal (Europe) S.a r.l. et Cie, S.C.A.
• Consent category: Necessary
• Legal basis: Performance of the contract (GDPR art. 6(1)(b)) and legal obligation for accounting and tax (art. 6(1)(c))
• Data: Payment data, email address, transaction details
• Cookie: none typical
• Retention: No cookies on the site; transaction data remains in the PayPal account per its policy and accounting obligations

May involve a transfer outside the EEA and Switzerland, for example to the United States.

Privacy: https://www.paypal.com/legalhub/privacy-full

WooCommerce

Runs cart and orders on the WordPress site.

• Provider: Automattic Inc. / titolare del sito
• Consent category: Necessary
• Legal basis: Performance of a contract or pre-contract steps (GDPR art. 6(1)(b))
• Data: Cart, orders, address, email address
• Cookie: woocommerce_cart_hash, woocommerce_items_in_cart, wp_woocommerce_session_*
• Retention: woocommerce_cart_hash and wp_woocommerce_session_*: session-length, 2 days by default

Privacy: https://automattic.com/privacy/

WhatsApp

Support contact through WhatsApp chat.

• Provider: WhatsApp Ireland Limited / Meta Platforms, Inc.
• Consent category: Preferences
• Legal basis: Consent (GDPR art. 6(1)(a))
• Data: Phone number, messages started by the user
• Cookie: none typical
• Retention: No cookies; messages remain in the WhatsApp app per the user's settings and WhatsApp's policy

May involve a transfer outside the EEA and Switzerland, for example to the United States.

Privacy: https://www.whatsapp.com/legal/privacy-policy