Cookie Policy

1What are cookies?

A cookie is a small text file that a website stores on the user's browser or device when visiting it. Cookies allow, among other things, the site to remember information about the visit (such as preferred language), to improve browsing experience or to measure usage in an aggregated way. In this document, "cookies" also refers to similar technologies (browser localStorage, tags, identifiers and pixels) when used for equivalent purposes.

2Categories used on carabela.ai

Carabela AI uses an in-house consent management system with four categories. By default, all non-necessary categories are disabled (true opt-in); no analytics, preferences or marketing script is loaded until the user provides explicit consent.

• Necessary (always on): essential for the operation of the site. They include the storage of the consent itself, the browsing session, the language preference and security elements (anti-fraud / CSRF). They do not require consent under art. 22.2 LSSI-CE.
• Analytics: allow aggregated measurement of site usage to improve content. Carabela AI uses Google Analytics 4 with IP anonymisation, and the script is only loaded if the user has consented to this category.
• Preferences: enable functional storage (functionality_storage) to remember interface and UX choices beyond what is strictly necessary.
• Marketing: category prepared for future advertising and remarketing campaigns (ad_storage, ad_user_data, ad_personalization). No advertising pixels or cookies are currently active on the site; the category is kept visible for transparency and to allow the granular consent that is already available.

3Cookie and storage inventory

The following identifiers and services are actually used on carabela.ai as of the last update of this policy:

Analytics cookies are only installed after the user expressly accepts the corresponding category. The IP address is anonymised (anonymize_ip: true) before being sent to Google.

4Integrated third-party services

Certain features of the site are provided by external providers that may set cookies or receive connection data when the user interacts with them:

• Google Analytics 4 (Google Ireland Ltd., EU; possible transfers to Google LLC, USA). Active only with consent to the "Analytics" category.
• Cal.com — embedded only on the contact page when the user requests to schedule a meeting. The provider may set its own cookies at the moment of interaction.
• Custom chat webhook — managed by Carabela AI; does not install third-party cookies.

Where any of these third parties carries out international data transfers outside the European Economic Area, such transfers are based on the mechanisms provided by the GDPR (adequacy decision, Standard Contractual Clauses or equivalents). Users may consult each provider's policies for further details.

5Consent management

Cookies that are not strictly necessary will only be installed if the user grants their free, specific, informed and unambiguous consent through the cookie banner displayed on first access or through the configuration panel available at any time.

The user may at any time:

• Accept all cookies.
• Reject all non-necessary cookies.
• Configure granularly the Analytics, Preferences and Marketing categories (the Necessary category is always on and cannot be disabled).
• Modify or withdraw consent at any time.

To reopen the configuration panel, use the permanent "Cookie settings" link available in the site's footer, or click here: open cookie settings.

The consent is stored together with its version and timestamp and automatically expires after 6 months, in line with AEPD recommendations. Once expired, consent is requested again. Withdrawing consent is as easy as granting it and does not affect the lawfulness of processing carried out on the basis of consent prior to its withdrawal.

6Technical operation (Google Consent Mode v2)

The site implements Google Consent Mode v2 with prior blocking: no non-necessary script runs before consent is obtained. Specifically:

• By default, all consent signals (analytics_storage, ad_storage, ad_user_data, ad_personalization, functionality_storage) are initialised as denied. Only security_storage remains granted, as it is essential for anti-fraud and CSRF protection.
• When the user saves their preferences, gtag('consent','update', …) is executed immediately, updating all signals according to the accepted categories.
• The Google Analytics 4 script is loaded dynamically and only if the Analytics category has been accepted.
• On application load, the system automatically reapplies any previously stored consent to keep a consistent experience across visits.

7Cookies exempt from consent

In accordance with AEPD guidelines, cookies strictly necessary for the provision of the service expressly requested by the user do not require consent — for example those related to session, security, language preference or the storage of the consent itself.

8How to disable or delete cookies from the browser

In addition to the site's own configuration panel, users may manage, block or delete the cookies stored on their device through their browser settings:

• Google Chrome: Settings → Privacy and security → Cookies and other site data.
• Mozilla Firefox: Settings → Privacy & Security → Cookies and Site Data.
• Safari: Preferences → Privacy → Manage Website Data.
• Microsoft Edge: Settings → Cookies and site permissions.

Disabling certain cookies may affect the proper operation of the site or the availability of some features.

9Updates

Carabela AI may modify this Cookie Policy when necessary to adapt it to regulatory or technical changes or to the evolution of the site. Any substantial modification will entail an increase of the consent version and a new request for consent. The date of the last update is shown at the beginning of the document.