Cookie Policy
What we store in your browser, for how long, on what legal basis, and how to change your mind. No fine print: the table below is generated from the same inventory the site uses to delete a category's cookies when you switch it off.
On this page
What cookies are
A cookie is a small file a site writes to your browser to remember something between one page and the next. In this policy the word also covers equivalent technologies — local storage, pixels and device identifiers — because the law looks at the effect on your device, not at the name of the technique.
Some are set by us, on the domain you are reading. Others are set by third parties we use to measure audience and ad performance. The table below says, one by one, who sets what and for how long.
Cookies we use
The complete list, by category. A new cookie lands here in the same commit that lands it on the site.
Requiredalways on
They make the site work: they hold the language of the domain and your own cookie choice. Without them this window would come back on every page.
| Cookie | Set by | Lifetime | What for |
|---|---|---|---|
| ccx-consent | CCX Messages | 182 days | Stores your cookie choice so we do not ask again on every page. |
| ccx-site-locale-override | CCX Messages | 365 days | Remembers the language you picked in the language switcher, so you are not sent back to your country's site. |
| ccx-interno | CCX Messages | 365 days | Marks devices used by the CCX team so internal visits stay out of the site statistics. It is only set when a team member opens the internal measurement link. |
Audience measurementoptional
They count how many people visit each page and where they came from, in aggregate. We use that to decide what to improve — never to identify who is reading.
| Cookie | Set by | Lifetime | What for |
|---|---|---|---|
| _ga | 730 days | Tells visitors apart anonymously so visits can be counted. | |
| _ga_* | 730 days | Keeps the measurement session state for this property. |
Advertisingoptional
They connect a click on a Google, Facebook or Instagram ad to the contact request that follows, so we learn which campaign brings real customers, and they let us show our ads to people who have visited the site. Without them we advertise blind — and your browsing stays exactly the same.
| Cookie | Set by | Lifetime | What for |
|---|---|---|---|
| ccx-attr | CCX Messages | 90 days | Records which ad or campaign brought you here, so a contact is credited to the right source. |
| _gcl_au | 90 days | Links a click on a Google ad to the contact request made afterwards. | |
| _fbp | Meta | 90 days | Identifies the browser so Meta (Facebook and Instagram) can measure ads and build audiences of people who visited the site. |
| _fbc | Meta | 90 days | Links a click on a Facebook or Instagram ad to the contact request made afterwards. |
Legal basis per category
Required cookies do not need permission: without them the site cannot deliver what you asked for. That is the exemption in art. 5(3) of the ePrivacy Directive in Europe, and the reading of the ANPD cookie guidance in Brazil.
Where the basis is consent, nothing happens before your click: the measurement script itself is only downloaded after a yes. Refusing means no request leaves this site towards Google or Meta servers.
- Required — performing the service you asked for. There is no way to refuse without breaking the site.
- Audience measurement — consent (GDPR art. 6(1)(a)) for visitors from the European Union, the European Economic Area, the United Kingdom or Switzerland, or from a location we cannot identify; legitimate interest (LGPD art. 7, IX) for visitors from any other country, Brazil included, always with a one-click opt-out.
- Advertising — consent, in every country. Never on by default.
Third parties and international transfers
Audience measurement and ad performance use Google Analytics 4 and Google Ads, provided by Google Ireland Limited. When the corresponding category is on, those services may process data outside your country, including in the United States.
Advertising also uses the Meta pixel and the Meta Conversions API, which measure ads on Facebook and Instagram and build audiences of people who visited the site. With advertising on, when you submit a form we send Meta the email address and phone number you entered as a hash (SHA-256), so Meta can tell whether the contact came from an ad. In Europe, that collection and transfer are carried out as joint controllers with Meta Platforms Ireland Limited, under Meta's Controller Addendum.
The transfer relies on the European Commission Standard Contractual Clauses and on the adequacy decision of the EU-US Data Privacy Framework, which Google and Meta take part in. With measurement and advertising switched off, no request is made to Google or Meta servers from this site.
We do not sell data, we embed no social network buttons or content, and we embed no third-party content recommender. The only social network item on the site is the Meta pixel, and only with advertising on.
How to change or withdraw
The preferences button sits in the footer of every page, and at the top of this one. Withdrawing costs the same single click as consenting — which is what GDPR art. 7(3) and LGPD art. 8, §5 require.
When you switch a category off, we delete its cookies from your browser. Merely stopping new ones would not be enough: the old identifier would still be valid.
Your browser can also block and delete cookies on its own. And if it sends the Global Privacy Control signal, we treat that as a refusal of everything optional, with no click needed from you.
To exercise data subject rights — confirmation, access, correction, deletion, portability and objection — use the privacy channel shown on this page. You may also lodge a complaint with your national data protection authority or with the ANPD.
How long things last
Every cookie has its own lifetime, shown in the table above. Your consent is valid for 182 days: after that we ask again, because consent that never expires is exactly what European authorities have been penalising.
The record of your choice is kept for 5 years. That is not the cookie: it is the proof that we asked and of what you answered, required by GDPR art. 7(1). It is pseudonymous and stores the IP address in anonymised form.
If the text of this policy changes in any meaningful way, the version changes with it, earlier consent stops being valid, and the question comes back.
Changes to this policy
A new cookie, a new purpose or a new provider land in this table on the same day they land on the site — the table is generated from the inventory the code itself reads to delete the cookies of a category you switch off.
The version shown at the top identifies the text that was live when you decided, and it is the one recorded alongside your consent.
Related documents
This policy covers what stays in your browser. How we handle data overall is in the Privacy Policy.