1. What this policy covers
The controller is Gitogi Srl, Piazza IV Novembre 4, 20124 Milano, Italy. Email: info@gitogi.com.
Cookies store information in your browser. The Website also uses localStorage, which persists between visits, and sessionStorage, associated with a browser tab's session. Rules on storing or accessing information on a device can also cover technologies other than cookies.
Under Article 122 of the Italian Privacy Code, consent is not required for operations strictly necessary to transmit a communication or provide a service requested by the user. The analytics tools described here are activated with consent.
Last updated: 21 October 2026.
This English version is provided for convenience. If the language versions conflict, the Italian version prevails, without limiting your statutory rights.
2. Your choices
The banner distinguishes between “Necessary” and “Analytics”. You may accept or reject analytics. Closing the banner with the X or pressing Esc counts as rejection.
Analytics tools remain inactive without consent. The Website does not use advertising or marketing cookies.
Your preference is stored in the browser and your choice is also recorded on the server, without a copy of the banner wording. Your choice remains valid for six calendar months from the recorded date, after which the Website asks you to choose again. If you clear browser storage, the previous choice may no longer be recognisable.
You can change or withdraw your choice through “Manage cookies” at the bottom of the pages. Analytics consent is separate from consent for Gitogi AI, the newsletter and marketing communications.
When you reject analytics or withdraw consent to them, the Website disables them and deletes _ga* and ph_* cookies and the ph_* and sentryReplaySession storage keys from your browser. Withdrawal does not affect the lawfulness of earlier processing and does not automatically delete data already received by providers. See the Privacy policy for your rights.
3. Necessary storage for the Website
The following tools operate according to the features you use. They are not all present on every visit.
| Name | Technology | Purpose | Lifetime or criterion |
|---|---|---|---|
gitogi_cookie_consent | localStorage | Remembers your cookie choice | The choice is requested again after six calendar months from the recorded date; localStorage has no inherent automatic expiry |
NEXT_LOCALE | Session cookie | Remembers your chosen language when it differs from your browser's language | Browser session |
gitogi_ai_chat_consent | Signed httpOnly cookie | Remembers consent to chat processing | 180 days; deleted if chat consent is withdrawn |
sb-<ref>-auth-token | Cookie | Administrator authentication | Cookie lifetime of up to 400 days |
Supabase cookies with the code-verifier suffix | Cookie | Verification during authentication | Related to the technical sign-in flow, rather than the administrator session duration |
auth_redirect | Cookie | Remembers the destination after administrator sign-in | 10 minutes |
<ref> identifies the Supabase project. The chat consent cookie records a choice about processing messages. Its necessary function does not remove the requirement for separate consent to that processing.
There is no public registration for the administration area. Automatic sign-out after 30 minutes of inactivity is separate from authentication cookie lifetime: a persistent cookie does not mean access remains usable throughout its lifetime.
4. Google reCAPTCHA v3
On public contact and newsletter forms, reCAPTCHA v3 loads when you interact with the form, including when you move the pointer over it, tap it or move keyboard focus into it. On administrative sign-in pages it loads immediately.
The service processes technical information, including IP addresses, browser characteristics and interactions, to distinguish human requests from automated ones. It may involve Google storing or accessing information on your device.
Legitimate interests in security concern personal data processing. They do not replace consent where Article 122 of the Italian Privacy Code requires it. The device-access exemption applies only to operations strictly necessary for the requested service. Pointing at or focusing on a form does not constitute consent.
See the Privacy policy, provider register and Google privacy policy.
5. Analytics tools
Consent to “Analytics” enables usage statistics and session recording features.
| Name | Provider and technology | Purpose | Browser lifetime |
|---|---|---|---|
_ga, _ga_<ID> | Google Analytics 4; cookies | Identifiers for visitor and session statistics | 2 years by default; maximum 400 days in Chrome |
ph_<key>_posthog | PostHog; cookie | Pseudonymous identifier for usage statistics and navigation paths | 365 days |
ph_<key>_posthog and related entries | PostHog; localStorage | Persistent analytics identifiers and state | No automatic expiry equivalent to the cookie; depends on application handling or clearing browser storage |
| PostHog session entries | PostHog; sessionStorage | Analytics session state and possible recording | Tab session |
sentryReplaySession | Sentry; sessionStorage | Session recording state to understand usage and errors | Tab session |
<ID> identifies the Analytics property and <key> the PostHog project. The variable parts of these names do not indicate different providers.
Google Analytics 4 uses basic consent mode. It sends no requests before consent and remains inactive if consent is refused.
PostHog EU Cloud also captures interactions with page elements and may record sessions with input fields masked.
Sentry Session Replay records sessions with text, fields and media masked. Consent covers this feature; the diagnostics described below operate separately.
The table describes browser lifetimes, not retention on providers' servers. See the provider register for entities, locations and transfer safeguards, and the privacy notices of Google, PostHog and Sentry.
6. Errors and performance
Sentry receives error reports and performance traces regardless of analytics consent, based on legitimate interests in Website availability and security. Before transmission, a filter applied to errors, transactions and breadcrumbs in both the browser and the server removes user data, email addresses including those encoded in URLs, and the values of the email, token and code parameters. The default inclusion of identifying information is disabled, and IP address filters also apply. The selected data region is in the EU.
This is separate from session recording. The absence of cookies does not, by itself, exclude other device-access operations from Article 122.
7. Browser settings and external links
You can clear or block cookies and browser storage through your browser settings. Clearing cookies alone may leave localStorage and sessionStorage intact. Blocking necessary tools may prevent features such as administrator sign-in or remembering chat consent.
Booking, messaging and social links open external services; these are not embedded in the Website. Fonts are self-hosted and do not require an external font service.
8. Contact and rights
The Privacy policy explains legal bases, recipients, transfers, retention and rights.
Use “Manage cookies” for analytics preferences and Your consents for other available choices. Contact info@gitogi.com for information or data rights requests.