Cookie Policy
Effective Date: 10/08/2026
This Cookie Policy explains which cookies and similar technologies Chamelix uses, for what purpose, for how long, and which of them require your consent.
Data controller: ArizenLab S.r.l.s., Via Padova 20, 36010 Zanè (VI), Italia, VAT 04578500243.
Cookies and similar technologies
For simplicity, "cookies" here covers every technology that reads or writes
information on your device: cookies proper, plus the browser's localStorage
and sessionStorage. The same rules apply to all of them (Art. 5(3) of
Directive 2002/58/EC — ePrivacy, Art. 122 of the Italian Privacy Code, and the
Italian DPA's "Guidelines on cookies and other tracking tools", decision
no. 231 of 10 June 2021).
How consent works
- On your first visit no optional cookie or storage is written: the banner starts with every optional category switched off.
- Optional tools load only after you explicitly opt in. The block is not browser-side only: our own server-side page-view tracking is subject to the same choice.
- "Decline" carries the same visual weight as "Accept", and the choice can be withdrawn at any time, as easily as it was given.
- If we add a category or a vendor, the banner is shown again: consent collected under a narrower disclosure does not extend to tools you were never told about.
1) Necessary / Functional
These deliver the service you asked for and keep it secure. They require no consent and cannot be switched off from the banner.
| Name | Type | Purpose | Retention | Party |
| --- | --- | --- | --- | --- |
| cookie-consent | Cookie | Stores your cookie category choices and the disclosure version | 12 months | First party |
| NEXT_LOCALE | Cookie | Stores the selected language | 12 months | First party |
| auth.session_token | Cookie | Authentication session | 7 days, refreshed while in use | First party |
| auth.session_data | Cookie | Short-lived cache of session data, to cut database reads | 5 minutes | First party |
| onboarding-business-id | Cookie | Lets you resume an interrupted business onboarding | 7 days | First party |
| Anti-bot protection (Vercel BotID) | Technical browser storage | Tells automated traffic apart on login, registration and other sensitive endpoints | Technical duration of the check | First party / Vercel |
Error monitoring (Sentry): application error capture runs without consent because it is necessary for the security and continuity of the service. In this mode it does not record the session and writes nothing to your device; events are stripped of personal data before being sent. Session recording is a separate thing, covered in section 3.
2) Analytics (optional)
Loaded only with the Analytics preference enabled.
| Name | Type | Purpose | Retention | Party |
| --- | --- | --- | --- | --- |
| sessionId | Cookie | Session identifier used by our server-side visit counting; regenerated on each new calendar day | Browser session | First party |
| lastSessionIdUpdate | Cookie | Date of the last sessionId rotation | Browser session | First party |
| _ga, _ga_* | Cookie | Google Analytics: audience measurement | 24 months | Third party (Google LLC) |
| Vercel Analytics | — | Aggregate audience measurement | Sets no cookies | Third party (Vercel Inc.) |
With this preference off, the Google Analytics and Vercel Analytics scripts
are not loaded, the sessionId and lastSessionIdUpdate cookies are not
written, and no visit is recorded in our systems. Firebase Analytics automatic
collection stays disabled.
3) Diagnostics and session replay (optional)
Loaded only with the Diagnostics preference enabled.
| Name | Type | Purpose | Retention | Party |
| --- | --- | --- | --- | --- |
| sentryReplaySession | sessionStorage | Sentry Session Replay: records a small share of sessions to reconstruct failures | Until the tab is closed | Third party (Functional Software, Inc. — Sentry) |
Recording masks all text and blocks media, and is excluded on operator dashboards, the admin area, document upload and the membership registration panel. If you withdraw consent, an in-flight recording stops immediately.
4) Third-party maps (optional)
Loaded only with the Maps preference enabled.
| Name | Type | Purpose | Retention | Party |
| --- | --- | --- | --- | --- |
| Google Maps JavaScript API | Cookies and storage set by Google (for example NID) | Interactive maps and address search | Defined by Google, typically up to 6 months | Third party (Google LLC) |
While the preference is off, the platform does not contact
maps.googleapis.com: a placeholder appears instead of the map, and city
search keeps working using platform data only. You can still load a single map
by clicking "Load the map": that load applies to that browser tab alone and
does not change your standing preferences.
Changing or withdrawing your preferences
You can reopen the panel at any time from the Cookie Preferences button in the footer of every page, and switch individual categories on or off. Withdrawal takes effect immediately for tools already loaded.
You can also block or delete cookies from your browser settings. Blocking necessary cookies may prevent authentication and break the platform.
Transfers outside the European Union
Google LLC, Vercel Inc. and Functional Software, Inc. are established in the United States: enabling the relevant categories means data collected by those tools may be transferred to a third country, under the safeguards listed on the Sub-processors page, which sets out each vendor and its transfer mechanism.
Updates
We may update this Cookie Policy to reflect product, regulatory or operational changes. The updated version is published on this page with a new effective date; when categories or vendors change, the banner is shown again to collect a fresh choice.
Contact
For questions about this Cookie Policy, or to exercise your rights, write to app@chamelix.it. How we process personal data is described in our Privacy Policy.