Cookie Policy for the evolus.ai website

1. Who we are

The controller is CodeDesign S.r.l., with registered office at Via Nino Pesce 38, 18018 Taggia (IM), VAT No. IT01739830089 ("we"). For any question about this page, write to privacy@codedesign.it.

2. Cookies and browser storage: what they are

Cookies are small text files that a website saves in your browser and reads again on later visits. The browser also offers other spaces with the same function, such as local storage (localStorage), in which a website can save information that remains even after the page is closed. On this page we call them together "tools".

They fall into two broad groups:

• technical tools, strictly necessary to run the website or a feature you have expressly asked for: they do not require your consent;
• non-technical tools, for example third-party statistics or advertising tools, or tools that record how you use the pages: they can be used only with your consent.

The consent rules do not apply only to cookies: they also apply to programs that read information from your device without saving anything in the browser, such as the heatmaps and session recordings described in section 8.

A cookie is "first-party" if it is set by the website you are visiting, "third-party" if it is set by another domain.

3. The banner and your choices

On your first visit a banner asks whether you accept the three optional categories described below: Statistics (Google Analytics), Marketing (Google Ads and Meta Pixel) and Experience analysis (heatmaps and session recordings).

• With “Accept all” you turn on all three categories; with “Reject all”, which is equally prominent, you turn on neither.
• With “Customize” you choose the categories one by one.
• Closing the banner with the X is the same as rejecting everything.

Until you make a choice, and if you reject, the website does not load any Google or Meta program, does not send any data to Google or Meta and does not collect heatmaps or session recordings. You can use the website exactly like someone who accepts.

We save your choice in a technical cookie (evolus_consent, section 4) for 6 months: during this period the banner is not shown to you again, unless the tools used or the conditions described on this page change significantly. After 6 months, the banner asks you to choose again. With this version of the page, which adds the Meta Pixel to the “Marketing” category, the banner is shown once again to everyone, including those who had already chosen.

You can change your mind at any time from the “Cookie preferences” link at the bottom of every page of the website. Withdrawing consent does not make unlawful what was done before, but from that moment Google and Meta no longer receive data from the website (the website also deletes the Meta Pixel cookies); if you withdraw experience analysis, the page reloads and from that moment the website stops collecting heatmaps and recordings. The Google and Meta cookies already present in the browser are deleted from the browser settings (section 10).

4. Technical tools, always active

These tools are used to run the website and to remember the choices you make. They do not require your consent (art. 122, paragraph 1, of the Italian Privacy Code).

To open evolus.ai in your language, we read the language set in your browser, without storing it.

5. Cookieless statistics: Umami

We measure visits with Umami, a statistics tool that we install and manage ourselves, on our own server in Germany. Umami does not set cookies and does not save anything in your browser. It does not follow you on other websites, does not create profiles and does not disclose data to third parties.

The Umami program, downloaded from our domain, reads from the browser only the information needed to describe the visit: the page, the referring page, the language, the screen size and the page loading and response times (the so-called “Core Web Vitals”), which help us find slow pages. Our server uses your IP address to derive the approximate location and to calculate a visit code that changes every month, then discards it without saving it. The details are in the website's privacy notice, at https://evolus.ai/en/website-privacy.

This is why we do not ask for your consent: the Italian Data Protection Authority's Guidelines of 10 June 2021 treat as equivalent to technical tools the analytics tools used only by the website operator, which produce aggregate statistics, do not combine the data with other information and do not disclose them to third parties.

If you do not want to be counted, turn on the “Do Not Track” signal in your browser settings: the website respects it and does not send the statistics. You can also object by writing to privacy@codedesign.it.

Heatmaps and session recordings, which use the same Umami, work instead only with your consent: they are described in section 8.

6. Statistics, only with your consent: Google Analytics

If you accept the Statistics category, the website loads Google Analytics 4 to measure in more detail how it is used: how many people come back, where they come from, which pages and which features they use. Google Analytics sets these cookies on our domain:

Some browsers delete these cookies earlier if you do not come back to the website: for example Safari after 7 days.

For this purpose Google Ireland Limited processes the data on our behalf. For visitors located in the European Union, Google states that it uses the IP address only to derive the approximate location, on servers in Europe, and that it deletes it without logging it. User-level and event-level data are deleted by Google after 14 months. Google may also process data in the United States, on the basis of the EU-US Data Privacy Framework, under which Google LLC is certified.

The legal basis is your consent (art. 6.1.a GDPR and art. 122 of the Italian Privacy Code), which you can withdraw at any time from the “Cookie preferences” link.

7. Marketing, only with your consent: Google Ads and Meta Pixel

Google Ads

If you accept the Marketing category, we allow Google to:

• measure whether you arrive on the website from one of our Google ads and whether the visit ends with a contact request (conversion);
• add you to audience lists, to show you our ads on Google and on the websites that partner with Google.

On our domain Google sets these cookies:

For these purposes Google may also set and read its own cookies on its domains (for example doubleclick.net or google.com), as an independent controller. The complete and up-to-date list of Google's advertising cookies, with their durations, is published at https://business.safety.google/adscookies/. Google Ireland Limited and Google LLC process these data according to their own rules, published at https://policies.google.com/privacy; you can also manage personalised ads at https://myadcenter.google.com. The transfer of data to the United States takes place on the basis of the EU-US Data Privacy Framework, under which Google LLC is certified.

The legal basis is your consent (art. 6.1.a GDPR and art. 122 of the Italian Privacy Code), which you can withdraw at any time from the “Cookie preferences” link.

Meta Pixel

If you accept the Marketing category, the website also loads the Meta Pixel of Meta Platforms Ireland Limited (Ireland), only after your consent. The pixel records the pages you visit and the successful submission of the contact form, without the content of the message or your contact details, together with technical information about the browser and the device and the IP address, in order to:

• measure how well our campaigns on Facebook and Instagram perform;
• show our ads to people who have visited the website.

On our domain the pixel sets these cookies:

If you are logged in to Facebook or Instagram, Meta may also use its own cookies on its domains. We do not send Meta emails, telephone numbers or any other data you enter on the website, and the pixel's automatic events are turned off. The pixel is never loaded on the shared board page. For the collection and transmission of data through the pixel, CodeDesign and Meta Platforms Ireland Limited are joint controllers (art. 26 GDPR), under Meta's joint controllership agreement (“Controller Addendum”); for subsequent processing Meta acts as an independent controller, under its own privacy policy, published at https://www.facebook.com/privacy/policy, and you can also exercise your rights with Meta. The data received by Meta are kept according to Meta's retention periods. The transfer of data to the United States takes place on the basis of the EU-US Data Privacy Framework, under which Meta Platforms, Inc. is certified.

The legal basis is your consent (art. 6.1.a GDPR and art. 122 of the Italian Privacy Code), which you can withdraw at any time from the “Cookie preferences” link: from that moment the pixel no longer sends data to Meta and the website deletes the _fbp and _fbc cookies.

8. Experience analysis, only with your consent: heatmaps and session recordings

If you turn on the Experience analysis category, the website uses two additional features of Umami, on the same server as the statistics: we install and manage it ourselves, at Hetzner Online GmbH in Germany, without third parties.

• Heatmaps: the program collects the position of clicks on the page, how far you scroll down the page, the size of the window and of the page and the page path, without the part of the address after the “#” symbol. We look at them in aggregate form and keep them for 12 months.
• Session recordings: the program records how you use the pages (clicks, scrolling, mouse movements, moving from one page to another) and the content of the page as it appears on your screen, including the conversation with Evo and the notes on its board on the home page. It never records the content of the fields you fill in, the Evolus chat on the other pages, the shared board page or the audio of your voice; texts that repeat your email address or your phone number on the screen are hidden. Each recording stops automatically after 5 minutes at most and is kept for 30 days.

These features do not use cookies and do not save anything in your browser: your choice is remembered in the technical cookie evolus_consent (section 4). We use them only with your consent because the program reads from your device information that goes beyond what is strictly necessary. If your browser sends the “Do Not Track” signal, nothing is recorded.

Heatmaps and recordings are viewed only by us, to understand what does not work and to improve the website: they are not used to profile you, we do not combine them with other data and we do not disclose them to third parties. The details are in the website's privacy notice, at https://evolus.ai/en/website-privacy.

The legal basis is your consent (art. 6.1.a GDPR and art. 122 of the Italian Privacy Code), which you can withdraw at any time from the “Cookie preferences” link. To ask us to delete a recording of your visit before it expires, write to privacy@codedesign.it.

9. Evo and the Evolus chat: browser storage

Evo, the assistant on the home page, and the Evolus chat on the other pages save some information in your browser's local storage. They are not cookies: they are not automatically sent to our server with every request, and you can delete them as explained in section 10.

Evo

Evo's memory is not strictly necessary: without it Evo works in the same way, but does not remember the previous conversation. This is why we save it only with your consent (art. 122 of the Italian Privacy Code), which you give by turning on the “Remember me next time” switch, off by default, and withdraw by turning it off: the memory is deleted immediately.

The Evolus chat

The chat saves its information under names that start with evw: followed by the code of the website's chat. It writes them only when you use it.

These are technical or functionality tools, linked to a feature you have chosen to use, and do not require consent. The chat program is downloaded from the servers of the Evolus platform (api.evolus.ai) only after your first interaction with the page; the processing of the messages is described in the website's privacy notice, at https://evolus.ai/en/website-privacy.

10. How to delete cookies and browser storage

• Consent to Google Analytics, Google Ads, the Meta Pixel and experience analysis: from the “Cookie preferences” link at the bottom of every page.
• Evo's memory: by turning off the “Remember me next time” switch among Evo's controls.
• Chat conversation: with the command to start a new conversation, inside the chat.
• Everything the website has saved: from the browser settings, usually in the section dedicated to privacy or to site settings, under “Cookies and site data”. By deleting the data of evolus.ai you remove both the cookies and the local storage; on your next visit the banner will ask you to choose again.

Every browser explains how to do this in its own help pages, if you search for “clear cookies and site data”.

11. Your rights

Besides choosing and withdrawing consent as described above, you can exercise the rights provided for by articles 15 to 22 of the GDPR by writing to privacy@codedesign.it, and you can lodge a complaint with the Italian Data Protection Authority (https://www.garanteprivacy.it). The details are in the website's privacy notice, at https://evolus.ai/en/website-privacy.

12. Changes to this page

We update this page when the tools used by the website change. We publish each new version on this page, with the version number and the date. If the tools that require consent change significantly, the banner asks you to choose again.