Cookie Policy
Last updated: 2026-10-20
1. What cookies are
Cookies are small text files stored in your browser. Lucanto may also use similar technologies, such as local storage or SDK identifiers. In this policy we refer to all of these together as "cookies".
2. Categories and legal basis
Necessary cookies
These are needed for sign-in, Cloudflare proxy/CDN and Turnstile bot protection, security, order processing, storing your privacy choice, traffic routing and basic functionality. They do not require consent because without them the Service you requested, or its security, would not work. We do not use them for optional advertising or analytics. Turnstile may process IP, TLS fingerprint, user-agent, sitekey/origin and a security token; the Turnstile Privacy Addendum also explains Cloudflare's role.
In the app at app.lucanto.eu, this category also covers the Better Stack browser tag, which captures errors in the app interface so we can fix them quickly. It runs on the basis of a legitimate interest in the Service's security and stability, regardless of your cookie choice. Session replay, event autocapture, web analytics and browser fingerprinting are turned off in Better Stack. The _bs session identifier applies only to app.lucanto.eu and is used only to group errors into a single session.
Analytics cookies
These help us understand visits and product usage: Google Analytics 4 measures site traffic and PostHog (hosted in the EU) measures page usage. Google Tag Manager is a container, not analytics by itself: the local dataLayer only makes values available to tags. The external GTM script does not load until you give consent to at least one optional category, and each tag inside it only fires once you have consented to its own category. So analytics tags do not run without analytics consent, and before consent no cookieless ping is sent to Google either. Declining does not affect Lucanto's core functionality, server-side security logging or error monitoring (Better Stack).
We use Google Consent Mode in basic mode: Google tags load only after you make your choice in the banner. If you decline all optional cookies, no Google tag loads and Google receives nothing. If you allow analytics cookies only, Google receives analytics data together with the information that you declined marketing, and no advertising cookies are stored.
Marketing cookies
On lucanto.eu we only use these with your separate consent to the "Marketing" category. The default setting is off. They support the following services: the Meta Pixel (Meta Platforms Ireland) measures whether a visit or sign-up came from our Facebook or Instagram ads and lets us show ads to people who already visited the site; Google Ads does the same for ads on Google; Apollo.io recognizes, from your IP address, the company a visit is coming from. The legal basis is consent. If you withdraw it, the tags stop firing and we delete the Meta and Google Ads cookies set on the lucanto.eu domain.
If you allow marketing cookies, the Google tag sends your email address to Google in hashed form (SHA-256) after sign-up, the start of a trial or a form submission. Google uses it only to match the conversion with a click on our ad (enhanced conversions) and does not share it with other advertisers. Without marketing consent, no email address is sent.
With your marketing consent, Lucanto also uses its own cookies lucanto_attribution and lucanto_attribution_latest, shared between lucanto.eu and app.lucanto.eu. They store the first and most recent campaign UTM parameters (source, medium, campaign, content and term) for up to 30 days. We link these campaign labels to your sign-up and to paid-subscription conversion for each workspace to understand which campaigns bring paying customers. Withdrawing marketing consent deletes both cookies in the browser. When the application next receives the updated choice, it marks the stored campaign labels inactive and stops using them for campaign evaluation. They stay in the account record until the related account or workspace is deleted. Operational classification, such as whether an account was created through an invitation or referral, remains separate from campaign labels.
3. Register of cookies and similar technologies
| Name / pattern | Provider | Category | Purpose | Lifetime |
|---|---|---|---|---|
| Lucanto session cookie | Lucanto | necessary | sign-in and keeping the session | until sign-out or a maximum of 30 days of inactivity |
| Lucanto CSRF/security token | Lucanto | necessary | protection of forms, requests and the session | for the duration of the session |
| Lucanto consent preference | Lucanto | necessary | stores your cookie choice by category, its date and the settings version; also applies to app.lucanto.eu so the app respects the same choice | 12 months, then you will be asked again |
| __cf_bm | Cloudflare | necessary when bot protection is active | computing a bot score and protecting against malicious traffic | 30 minutes of inactivity |
| cf_clearance, _cfuvid and related security cookies | Cloudflare | necessary when the relevant security feature responds | proving a passed challenge, rate limiting and distinguishing visitors from the same IP | for the security session set for the relevant feature |
| Turnstile token and browser signals (not always a cookie) | Cloudflare Turnstile | necessary | distinguishing a human from a bot at registration and protecting the form | token valid 5 minutes and for a single verification only |
| Google OAuth / Sign in with Apple cookies | Google or Apple | necessary only after choosing external sign-in | authentication with the chosen provider | per the chosen provider's settings and policy |
| Google Tag Manager container (not a cookie) | analytics/depends on tag | loading and managing optional tags | loads only after the relevant consent and for the duration of the visit | |
| _bs cookie and related local identifier (app.lucanto.eu only) | Better Stack | necessary (legitimate interest) | session identifier used to group errors in the app interface; no session replay | up to 90 days |
| _ga, ga<ID> | Google Analytics 4 | analytics | distinguishing visitors and sessions for traffic statistics | up to 2 years or until consent is withdrawn |
| ph_<project>_posthog and local storage | PostHog (EU Cloud) | analytics | random (pseudonymous) visitor and session identifier for analyzing page usage | up to 1 year or until consent is withdrawn |
| lucanto_attribution, lucanto_attribution_latest | Lucanto | marketing | first and most recent campaign UTM parameters; shared with app.lucanto.eu to analyse sign-ups and paid-subscription conversion per workspace | up to 30 days or until marketing consent is withdrawn |
| _fbp, _fbc | Meta Platforms Ireland | marketing | measuring conversions from Facebook and Instagram ads (_fbc carries the ad click identifier) and building audiences for retargeting | 90 days or until consent is withdrawn |
| _gcl_au and related Google Ads cookies | marketing | measuring conversions from Google ads | 90 days or until consent is withdrawn | |
| Google Ads enhanced conversions (not a cookie) | marketing | hashed email address to match a conversion with an ad click | sent once per event; data held by Google under its own terms | |
| Apollo website tracker (script and its cookies) | Apollo.io | marketing | recognizing the visitor's company from IP address and pages visited | per Apollo.io's rules; once consent is withdrawn the tracker no longer loads and you can delete its cookies in your browser |
| Stripe Checkout cookies and local storage | Stripe | necessary for the chosen payment | payment security, fraud prevention and completing checkout | for the period necessary for security and fraud prevention set out in Stripe's rules |
3A. External resources without cookies
Loading Google Fonts, jsDelivr or UNPKG directly creates a network request in which the provider receives at least an IP address, user-agent, requested URL and, depending on the browser, referrer. This is not necessarily a cookie, but it is still processing of technical personal data. We use these requests only to the extent necessary for display or technical functionality and do not use them for marketing profiling.
4. Setting and withdrawing consent
On your first visit you can accept all optional cookies, decline them, or open the settings and allow analytics and marketing cookies separately. The buttons to accept and to decline all optional cookies carry equal visibility. No analytics or marketing runs before you consent to the relevant category. We remember your choice for 12 months; after that we will ask again.
You can change your choice at any time through the Cookie Settings link in the footer or in the user menu in the app. Withdrawal stops future collection and removes the analytics and marketing cookies set by Lucanto; it does not necessarily retroactively delete aggregated statistics already lawfully obtained. You can also delete cookies in your browser, which may sign you out or remove saved settings.
5. Transfers and providers
Google, Meta, Apollo.io, Better Stack, Cloudflare, Stripe and CDN providers may process data outside the EEA under the transfer safeguards described in the Privacy Notice. We use analytics and marketing tags only after consent. Cloudflare/Turnstile, Stripe and Better Stack may, without optional consent, use technologies necessary for security, bot or fraud prevention, or error monitoring; server-side logging and backend error reporting do not use the Better Stack browser cookie.
6. Contact and changes
Send questions to hello@lucanto.eu. When we add a new optional purpose, we update the register and request consent before activating it. The date of the last change is shown above.
Operated by: Stark Codes, s.r.o.