Cookie policy

1. How consent works

• Wherever you visit from, every non-essential storage is off until you make a choice: Google Consent Mode v2 starts with analytics_storage, ad_storage, ad_user_data, ad_personalization and personalization_storage set to “denied”, so no analytics cookie is set and no identifier is created before you click. Only anonymous, cookieless pings reach Google in the meantime, used for aggregate modelling only. The same default applies in every country: we do not use a more permissive setting outside the EEA.
• Refusing has no consequence other than turning the analytics tools off; the site works in full without them. You can deny at any time from the banner or from “Cookie preferences” in the footer, and the denial is applied immediately and remembered for future visits.
• Your choice is stored in the first-party cookie nucleo_consent for 6 months; afterwards, or after you clear cookies, the banner appears again. You can review or change it at any time by clicking “Cookie preferences” in the footer: withdrawing consent turns the tools off immediately for the rest of your visit and for future ones (cookies already set by third parties expire on their own or can be deleted from your browser).
• Continuing to browse, scrolling or closing the banner without choosing does not count as consent.

2. Strictly necessary (no consent required — art. 122(1) Privacy Code)

• nucleo_consent — first-party cookie set by nucleoplatform.com — stores your cookie choices (analytics yes/no, marketing yes/no, timestamp). Duration: 6 months.
• nucleo_preview — first-party, HttpOnly cookie — set only if a password-protected preview of the site is enabled and you unlock it; remembers the unlock. Duration: 30 days. Not set for normal visitors.
• nucleo-pricing-v10 — localStorage (not a cookie) — remembers the stack you compose on the pricing page (modules, packages, connections, volumes, wizard progress) so it is still there when you come back. It stays in your browser, is never read by third parties and persists until you clear site data. Older versions of the key (nucleo-pricing-v9) are migrated and removed automatically.
• Rate-limiting counters — server-side memory keyed on a hashed IP address, expire within minutes; no cookie.
• Fonts are self-hosted and no third-party resource is loaded before consent, except the Google Tag Manager container itself, which is configured to fire tags only according to your consent state.

3. Analytics (only with your consent)

Both tools are loaded through Google Tag Manager (Google Ireland Ltd.) and start only after you enable “Analytics”. They help us understand which pages are used and where visitors get stuck.

• Google Analytics 4 — Google Ireland Ltd. / Google LLC — pages visited, approximate location (IP is used for geolocation and not stored), device and browser type, scroll/click/outbound-link events. Google Signals is disabled: no cross-device or demographic/interest data is collected. Retention on Google's side: 14 months. Cookies: _ga (first-party, distinguishes users, 2 years); _ga_<container-id> (first-party, keeps session state, 2 years). Google's privacy policy: policies.google.com/privacy; opt-out add-on: tools.google.com/dlpage/gaoptout.
• Microsoft Clarity — Microsoft Ireland Operations Ltd. / Microsoft Corporation — heatmaps and session replays (clicks, scrolls, mouse movements, page changes); all text you type is masked at the source and never recorded. Clarity assigns a pseudonymous user identifier and, through Microsoft's shared cookies, may read Microsoft advertising identifiers. Cookies (durations as published by Microsoft): _clck (first-party, Clarity user ID and preferences, 1 year); _clsk (first-party, links page views of one session, 1 day); CLID (clarity.ms, identifies the first time Clarity saw this user, 1 year); ANONCHK (c.clarity.ms, indicates whether MUID is transferred to ANID for advertising — always 0 here, 10 minutes); MR (c.clarity.ms / c.bing.com, indicates whether to refresh MUID, 7 days); MUID (clarity.ms / bing.com, Microsoft user identifier shared across Microsoft domains, 1 year); SM (c.clarity.ms, synchronises MUID across Microsoft domains, session). Microsoft's privacy statement: privacy.microsoft.com.
• Klaviyo (newsletter) sets no cookie on this site: subscriptions are handled server-side and no Klaviyo script runs in your browser.

4. Marketing & personalization (only with your consent — no cookie active today)

The banner includes a “Marketing & personalization” category mapped to the Google Consent Mode signals ad_storage, ad_user_data, ad_personalization and personalization_storage. Today no advertising or personalization tag is configured in our Tag Manager container: enabling this category sets no additional cookie. If we add campaign-measurement or advertising tools in the future (for example Google Ads, Meta or LinkedIn tags), this page will be updated first and your saved choice will keep applying (denied unless you opted in).

5. Managing your choice and third-party controls

• Click “Cookie preferences” in the footer to reopen the banner, review each category and save a new choice.
• You can also block or delete cookies from your browser settings (look for “Cookies and site data”); blocking necessary cookies may prevent the site from remembering your choice. Clearing localStorage only resets your saved pricing configuration.
• Google Analytics: tools.google.com/dlpage/gaoptout and myadcenter.google.com. Microsoft: account.microsoft.com/privacy/ad-settings.

6. Controller

Made in Evolve S.r.l., Via Rosalba Carriera 26, 41126 Modena (MO), Italy — privacy@nucleoplatform.com (or hello@madeinevolve.com). Purposes, legal bases, retention, transfers and your rights are described in the Privacy policy; this cookie policy is part of it.