This Cookie Policy explains which cookies and similar technologies we use on infinithink.it and in the Infinithink platform, what they are used for and how you can manage your choices. It supplements our Privacy Policy.
The controller is Lorenzo Locantore, who runs a sole proprietorship under the Italian flat-rate tax regime and trades under the Infinithink brand, with business address at Via Marta Tana 19, 46043 Castiglione delle Stiviere (MN), Italy, VAT number IT04570230989. For any question, you can write to info@infinithink.it.
1. What cookies and similar technologies are
Cookies are small text files that a website stores on your device and reads again on later visits. Similar technologies, such as the browser's local storage (localStorage and sessionStorage), work in a comparable way. Unless stated otherwise, in this policy we refer to all of them as "cookies".
Cookies can be distinguished by who sets them and by how long they last.
- First-party cookies are set by infinithink.it, while third-party cookies are set by other domains, such as those of our service providers.
- Session cookies are deleted when you close the browser, while persistent cookies remain on your device until they expire or you delete them.
2. Legal framework and consent
We apply Article 122 of the Italian Personal Data Protection Code (Legislative Decree 196/2003, the "Italian Data Protection Code"), the Guidelines on cookies and other tracking tools issued by the Italian Data Protection Authority (Garante per la protezione dei dati personali) on 10 June 2021, and Regulation (EU) 2016/679 (GDPR). The main rules are as follows.
- Technical cookies, which are strictly necessary to provide the service you have requested, do not require consent.
- Analytics cookies require consent, unless they meet the conditions set by the Italian Data Protection Authority to be treated as technical cookies. For greater protection, we ask for your consent for all the analytics cookies we use.
- Profiling and marketing cookies always require consent.
In section 3, for each category, we also state the legal basis for processing the data collected.
On your first visit, a banner lets you accept all cookies, reject all non-essential cookies (also by closing the banner with the X), or choose by category. The buttons to accept and to reject are equally prominent. Continuing to scroll or browse does not count as consent. Non-essential cookies are activated only after you consent.
You can withdraw your consent at any time, as easily as you gave it, as explained in section 6. Withdrawing consent does not affect the lawfulness of the use of cookies based on consent before its withdrawal.
3. Cookies we use
3.1 Technical cookies (no consent required)
| Name | Provider | Purpose | Duration |
|---|---|---|---|
| infinithink_session | Infinithink (first party) | keeps your session active and remembers your login and chosen language while you browse | 2 hours from your last activity |
| XSRF-TOKEN | Infinithink (first party) | protects forms against cross-site request forgery (CSRF), on pages where it is used | 2 hours from your last activity |
| remember_web_ followed by an identification code | Infinithink (first party) | keeps you logged in if, when you log in, you select the option to stay logged in ("Remember me" or "Ricordami") | up to 400 days, or until you log out |
| infinithink_cookie_consent | Infinithink (first party) | stores your cookie choices so that we do not ask you again at every visit | 6 months |
| __cf_bm | Cloudflare, Inc. (USA) | distinguishes people from bots and protects the site from abusive traffic | 30 minutes |
| cf_clearance | Cloudflare, Inc. (USA) | records that you have passed a security check, when one is shown | for the period set for the check, typically 30 minutes |
| _cfuvid | Cloudflare, Inc. (USA) | applies traffic limits fairly to visitors sharing the same IP address | session |
| __stripe_mid | Stripe Payments Europe, Limited (Ireland) | prevents fraud during payment, set only on pages where the Stripe payment form is loaded | 1 year |
| __stripe_sid | Stripe Payments Europe, Limited (Ireland) | prevents fraud during payment, set only on pages where the Stripe payment form is loaded | 30 minutes |
Cloudflare protects the site and manages its traffic. Its cookies are set only when the relevant security and traffic management features are active. Cloudflare may also use other cookies that are strictly necessary for these features, as described in the Cloudflare documentation.
Stripe processes payments. During payment, Stripe may set other cookies on its own domains, as described in the Stripe Cookie Policy. For fraud prevention, Stripe also collects information about your device and browser and acts as an independent controller under its own privacy policy.
These cookies are exempt from consent under Article 122(1) of the Italian Data Protection Code, because they are strictly necessary for the site and the features you request to work. The data collected is processed to provide the features you request, such as logging in to your account and making payments (Art. 6(1)(b) GDPR), for our legitimate interest in the security of the site, in the case of XSRF-TOKEN and the Cloudflare cookies (Art. 6(1)(f) GDPR), and, for infinithink_cookie_consent, to respect your choices and be able to demonstrate them, as required by Art. 7(1) GDPR and Article 122 of the Italian Data Protection Code (Art. 6(1)(c) GDPR). For its own anti-fraud cookies, Stripe relies on the legal basis stated in its own privacy policy.
3.2 Browser local storage used for functional purposes (no consent required)
In the logged-in area of the platform, we use the browser's local storage to remember your interface preferences and to make your work faster. This data stays in your browser and is not automatically sent to our servers. These technologies are exempt from consent under Article 122(1) of the Italian Data Protection Code, because they only serve the interface features you use, and the data is processed to provide the Service to you (Art. 6(1)(b) GDPR).
| Key | Purpose | Duration |
|---|---|---|
| lqdDarkMode | remembers whether you prefer the light or dark theme | until you clear it |
| lqdNavbarShrinked, lqd-navbar-shrinked | remember whether the side menu is expanded or collapsed | until you clear them |
| keys ending in lqdCustomizerStyle | remember your customisations of the interface appearance | until you clear them |
| docsViewMode, socialMediaPostsViewMode | remember the display mode you chose for some lists, for example grid or list view | until you clear them |
| lqd-announcement-dismissed | remembers the notices you have already closed in the dashboard | until you clear it |
| promptHistory | keeps the prompts you recently sent in the chat, so that you can quickly reuse them | until you clear it |
| fslightbox-types | stores the type of content shown in image and video galleries, so that it is displayed correctly | until you clear it |
| headear-recent-lunch, headear-recent-search-keys (sessionStorage) | remember the tools you recently opened and the searches you recently made in the search bar | until you close the browser tab |
| connectToAgentStore:<number> | in the website chat (Infinithink Assistant), remembers whether you asked to talk to a person in that conversation | until you delete it |
The Infinithink Assistant, the website chat, only uses technical tools, such as the session cookie and the key shown in the table, to keep the conversation while you move between pages. They are needed for the service you request by opening the chat and do not require consent. Chat messages are processed as described in the Privacy Policy. In the dashboard, real-time notifications on the progress of tasks use a technical connection with Pusher, without profiling cookies.
If you use a shared device, log out of your account and clear your browsing data when you finish, so that your preferences and recent prompts do not remain on the device.
3.3 Analytics cookies (only with your consent)
| Name | Provider | Purpose | Duration |
|---|---|---|---|
| referer_session_id | Infinithink (first party) | internal, aggregated statistics on where visits come from. The cookie records, on your first visit, the address of the page you came from, for example a search engine or a social network | 139 days |
| _ga | Google Ireland Limited (Google Analytics 4) | distinguishes visitors in order to produce aggregated statistics on visits and use of the site | 13 months |
| _ga_8DE4HZVVBT | Google Ireland Limited (Google Analytics 4) | keeps the state of your browsing session for statistical purposes | 13 months |
| _clck | Microsoft Corporation (Microsoft Clarity) | distinguishes visitors in order to produce heatmaps and aggregated statistics on how pages are used | 1 year |
| _clsk | Microsoft Corporation (Microsoft Clarity) | links page views into a single browsing session | 1 day |
These cookies are set, and the Google Analytics code is loaded, only after you consent. If you do not consent, we do not send any data to Google Analytics. We use Google Analytics only for aggregated statistics, with Google Signals, links to Google's advertising services and data sharing with Google for advertising purposes turned off, and we do not use it to profile you. The legal basis is your consent, under Article 122 of the Italian Data Protection Code and Art. 6(1)(a) GDPR. If the safeguard for transferring data to the United States ceased to apply and no other safeguard provided for by the GDPR could be adopted, we would turn off Google Analytics. You can read how Google uses data collected on its partners' sites on the dedicated Google page. You can also install the Google Analytics opt-out browser add-on.
With the same consent to the "Analytics cookies" category we also use Microsoft Clarity, a service provided by Microsoft Corporation, to produce heatmaps and recordings of browsing sessions, to understand how people use the site and the platform, for example where they click and how far they scroll, so that we can make our pages clearer. The Clarity code is loaded, and these cookies are set, only after you consent, and it is not loaded on administration pages. Input fields are masked and, in the logged-in area and on the login and sign-up pages, text is masked as well, in order to reduce the risk of passwords, conversation content, documents and customer data being recorded. We do not use Clarity to profile you or for advertising purposes. Microsoft Corporation processes the data on our behalf, as our service provider, under the Clarity terms, and may also process it in the United States, on the basis of the EU-U.S. Data Privacy Framework for certified providers and otherwise the standard contractual clauses. The legal basis is your consent, under Article 122 of the Italian Data Protection Code and Art. 6(1)(a) GDPR, which you can withdraw at any time from "Cookie settings". You can read how Microsoft processes data in the Microsoft privacy statement and on the Clarity privacy page.
3.4 Marketing and profiling cookies
Only with your consent to the "Marketing cookies" category, we use the Meta Pixel and the Meta Conversions API to measure the results of our advertising campaigns on Facebook and Instagram (page visits, sign-ups, checkout starts, purchases) and to show our ads to people who visited the site.
| Name | Provider | Purpose | Duration |
|---|---|---|---|
| _fbp | Meta Platforms Ireland Limited (Meta Pixel) | distinguishes browsers to measure the results of our ads | 3 months |
| _fbc | Meta Platforms Ireland Limited (Meta Pixel) | remembers the click on one of our ads, only if you arrive from one | 3 months |
The pixel code is loaded, and these cookies are set, only after you consent. With the same consent our server tells Meta about sign-ups and purchases, with the IP address, the browser type and, only as a SHA-256 hash, the email address and an internal account code. Meta may also process this data in the United States under the EU-US Data Privacy Framework. The legal basis is your consent, under Article 122 of the Italian Privacy Code and Article 6(1)(a) GDPR, and you can withdraw it at any time from "Cookie settings". For the data collected with the pixel we are joint controllers with Meta Platforms Ireland Limited for the collection and transmission, as set out in Meta's Controller Addendum. Meta's further processing is described in the Meta Privacy Policy.
3.5 Embedded content and sharing buttons
As at the date of this policy, we do not embed third-party content that sets cookies, such as videos or maps, in our pages. If we do so in the future, we will load such content only after you consent and we will update this policy.
The buttons for sharing blog articles on social networks are plain links and do not set cookies. If you use them, you are taken to the social network's website, which applies its own privacy policy and cookie policy.
3.6 Resources loaded from third parties
Some pages load fonts from the Google Fonts service provided by Google. To deliver the fonts to your browser, Google receives your device's IP address and some technical information about your browser, and may also process them in the United States, on the basis of the EU-U.S. Data Privacy Framework under which Google LLC is certified. According to Google, the service does not set cookies. The legal basis is our legitimate interest in displaying the pages correctly (Art. 6(1)(f) GDPR).
On the sign-up page, we use Cloudflare Turnstile to distinguish people from automated programs. To do so, Cloudflare, Inc. receives your IP address and some information about your browser and device. Turnstile does not set profiling cookies. The cf_clearance cookie, where set, is described in section 3.1. The legal basis is our legitimate interest in the security of the Service and in preventing abuse (Art. 6(1)(f) GDPR).
4. Chatbots installed on our customers' websites
Business customers can install an Infinithink chatbot on their own websites. The widget may use the browser's local storage or technical cookies on those websites, for example to keep the conversation open while the visitor browses. This Cookie Policy does not apply to business customers' websites. For data processed through the widget, we act as a processor on behalf of the business customer under the Data Processing Agreement and we do not use these technologies for our own purposes. Each business customer, as controller, is responsible for informing its own visitors about the cookies and similar technologies used by the widget and, where required, obtaining their consent. On request, by writing to info@infinithink.it, we provide business customers with the list of technologies used by the widget, with the name, type, duration and purpose of each.
The widget shows, at the latest at the start of the first interaction, a notice informing visitors that they are interacting with an artificial intelligence system. The business customer can change its wording but cannot turn it off, as described in the AI Transparency Notice.
5. Where the data is processed and how long we keep it
Data collected through first-party cookies is stored on the servers that host the site and the platform, which are provided by Hostinger and located in Frankfurt, Germany. All requests to the site, including the first-party cookies your browser sends, pass through the network of Cloudflare, Inc., which protects the site and manages its traffic and may also process them outside the European Economic Area (EEA).
Data collected through third-party cookies and resources is also processed by the respective providers, namely Cloudflare, Inc., Stripe, which acts as an independent controller for fraud prevention, and Google (Google Ireland Limited and Google LLC) and Microsoft Corporation (for Microsoft Clarity). Where these providers process data in the United States, the transfer is based on Commission Implementing Decision (EU) 2023/1795 on the EU-U.S. Data Privacy Framework, for providers certified under it, and otherwise on the standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914. Further details are available in our Privacy Policy.
In addition to how long cookies remain on your device, as shown in the tables in section 3, the data collected is kept as follows.
- Google Analytics event-level and visitor-level data is kept for 2 months, in line with the Google Analytics 4 data retention setting. After that period, it is only available in aggregated statistical reports.
- Microsoft Clarity data (heatmaps and recordings) is kept for 30 days, except for items we mark to keep longer, up to 13 months, in line with the Clarity retention setting.
- Data on where visits come from, collected through referer_session_id, is kept on our servers for no longer than 12 months, is used only in aggregated form and is not linked to your account. After that period, only aggregated and anonymous statistics remain.
- The technical and security logs we keep on our servers are deleted within 90 days, as stated in our Privacy Policy.
- Your cookie choice is stored only in the infinithink_cookie_consent cookie on your device, for 6 months.
- Where providers process data as independent controllers, such as Stripe for fraud prevention, they keep it in accordance with their own privacy policies.
6. How to manage your choices
You can change or withdraw your choices at any time using the "Cookie settings" link in the footer of every page of the site and of the platform, which reopens the preferences panel. If you withdraw your consent, we stop using analytics cookies and delete the first-party ones already set (_ga, _ga_8DE4HZVVBT, referer_session_id, _clck and _clsk).
We will ask for your choices again only if the cookies we use change significantly, if we cannot tell whether you have already made a choice, for example because you deleted your cookies, or when 6 months have passed since your last choice.
You can also delete or block cookies and local storage in your browser settings. Blocking technical cookies may prevent parts of the site from working, such as logging in to your account and making payments. Guides for the main browsers are listed below.
7. Your rights
With regard to personal data processed through cookies, you have the rights set out in Articles 15 to 22 of the GDPR, including the rights of access, rectification, erasure, restriction, objection and data portability, where applicable. You can exercise them by writing to info@infinithink.it.
You can withdraw your consent to analytics cookies at any time using the "Cookie settings" link, as explained in section 6. You can object at any time, on grounds relating to your particular situation, to processing based on our legitimate interest, such as processing for the security of the site. Google Analytics statistical data is not linked to your name. To exercise your rights over this data, tell us the value of the _ga cookie in your browser, so that we can identify the data and, if you ask, delete it using the Google Analytics tools.
We reply without undue delay and in any case within one month of receiving your request. This period may be extended by two further months in the cases provided for in Art. 12(3) GDPR, in which case we will inform you within the first month. You also have the right to lodge a complaint with the Italian Data Protection Authority or with the supervisory authority of the EU Member State where you live or work. Full details are available in our Privacy Policy.
8. Changes to this Cookie Policy
We may update this Cookie Policy, for example if the cookies we use or the applicable rules change. The date of the last update is shown at the top of this page. If the changes concern cookies that require consent, we will ask for your consent again through the banner.
9. Language, legal framework and contact
This Cookie Policy is provided under Regulation (EU) 2016/679 (GDPR) and Italian data protection law, in particular Article 122 of the Italian Data Protection Code, and in line with the Italian Data Protection Authority's Guidelines of 10 June 2021. This does not affect the rights granted to you by the law of the country where you live. It is available in Italian and English with the same content. In the event of any conflict between the two versions, the Italian version prevails, provided that any doubt as to interpretation is resolved in your favour.
For more details on how we process personal data, see our Privacy Policy. For any question, write to info@infinithink.it.
Questions about this document? Write to info@infinithink.it.