Cookie Policy

1 What are cookies?

A cookie is a small text file that a website stores on the user's browser or device when visiting it. Cookies allow, among other things, the site to remember information about the visit (such as preferred language), to improve browsing experience or to measure usage in an aggregated way. In this document, "cookies" also refers to similar technologies (browser localStorage, tags, identifiers and pixels) when used for equivalent purposes.

2 Categories used on carabela.ai

Carabela AI uses an in-house consent management system with four categories. By default, all non-necessary categories are disabled (true opt-in); no analytics, preferences or marketing script is loaded until the user provides explicit consent.

• Necessary (always on): essential for the operation of the site. They include the storage of the consent itself, the browsing session, the language preference and security elements (anti-fraud / CSRF). They do not require consent under art. 22.2 LSSI-CE.
• Analytics: allow aggregated measurement of site usage to improve content. Carabela AI uses Google Analytics 4 with IP anonymisation, and the script is only loaded if the user has consented to this category.
• Preferences: enable functional storage (functionality_storage) to remember interface and UX choices beyond what is strictly necessary.
• Marketing: measure how Carabela AI's advertising campaigns perform — which ad brought each visit and each demo request — and show ads to people who have already visited the site (remarketing; the ad_storage, ad_user_data and ad_personalization signals). Carabela AI uses the Google Ads tag and the Ryze pixel for this, and neither is loaded unless the user has consented to this category.

3 Cookie and storage inventory

The following identifiers and services are actually used on carabela.ai as of the last update of this policy:

Analytics cookies are only installed after the user expressly accepts the corresponding category. The IP address is anonymised (anonymize_ip: true) before being sent to Google.

Marketing cookies, likewise, are only installed if the user accepts the Marketing category. If the user later withdraws that consent, the Ryze pixel stops recording at once and deletes its identifiers, keeping only __ryze_c and __ryze_consent, which record the withdrawal itself.

4 Integrated third-party services

Certain features of the site are provided by external providers that may set cookies or receive connection data when the user interacts with them:

• Google Analytics 4 (Google Ireland Ltd., EU; possible transfers to Google LLC, USA). Active only with consent to the "Analytics" category.
• Google Ads (Google Ireland Ltd., EU; possible transfers to Google LLC, USA). Measures campaign conversions and enables remarketing. Active only with consent to the "Marketing" category.
• Ryze AI (get-ryze.ai) — a pixel that measures advertising campaigns and attributes visits to them. It records page views, where the visit came from, clicks on links and buttons, and form submissions — without reading what the user types into them — along with technical browser data such as screen size. Active only with consent to the "Marketing" category.
• Cal.com — embedded only on the contact page when the user requests to schedule a meeting. The provider may set its own cookies at the moment of interaction.
• Custom chat webhook — managed by Carabela AI; does not install third-party cookies.

Where any of these third parties carries out international data transfers outside the European Economic Area, such transfers are based on the mechanisms provided by the GDPR (adequacy decision, Standard Contractual Clauses or equivalents). Users may consult each provider's policies for further details.

5 Consent management

Cookies that are not strictly necessary will only be installed if the user grants their free, specific, informed and unambiguous consent through the cookie banner displayed on first access or through the configuration panel available at any time.

The user may at any time:

• Accept all cookies.
• Reject all non-necessary cookies.
• Configure granularly the Analytics, Preferences and Marketing categories (the Necessary category is always on and cannot be disabled).
• Modify or withdraw consent at any time.

To reopen the configuration panel, use the permanent "Cookie settings" link available in the site's footer, or click here: open cookie settings.

The consent is stored together with its version and timestamp and automatically expires after 6 months, in line with AEPD recommendations. Once expired, consent is requested again. Withdrawing consent is as easy as granting it and does not affect the lawfulness of processing carried out on the basis of consent prior to its withdrawal.

6 Technical operation (Google Consent Mode v2)

The site implements Google Consent Mode v2 with prior blocking: no non-necessary script runs before consent is obtained. Specifically:

• By default, all consent signals (analytics_storage, ad_storage, ad_user_data, ad_personalization, functionality_storage) are initialised as denied. Only security_storage remains granted, as it is essential for anti-fraud and CSRF protection.
• When the user saves their preferences, gtag('consent','update', …) is executed immediately, updating all signals according to the accepted categories.
• The Google script (gtag.js) is loaded dynamically and only if the Analytics category (Google Analytics 4) or the Marketing category (Google Ads) has been accepted; each identifier is configured only if its own category has been accepted.
• The Ryze pixel is loaded only if the Marketing category has been accepted, and any later change to that category is passed on to it immediately.
• On application load, the system automatically reapplies any previously stored consent to keep a consistent experience across visits.

7 Cookies exempt from consent

In accordance with AEPD guidelines, cookies strictly necessary for the provision of the service expressly requested by the user do not require consent — for example those related to session, security, language preference or the storage of the consent itself.

8 How to disable or delete cookies from the browser

In addition to the site's own configuration panel, users may manage, block or delete the cookies stored on their device through their browser settings:

• Google Chrome: Settings → Privacy and security → Cookies and other site data.
• Mozilla Firefox: Settings → Privacy & Security → Cookies and Site Data.
• Safari: Preferences → Privacy → Manage Website Data.
• Microsoft Edge: Settings → Cookies and site permissions.

Disabling certain cookies may affect the proper operation of the site or the availability of some features.

9 Updates

Carabela AI may modify this Cookie Policy when necessary to adapt it to regulatory or technical changes or to the evolution of the site. Any substantial modification will entail an increase of the consent version and a new request for consent. The date of the last update is shown at the beginning of the document.