# Cookie Policy for the evolus.ai website **evolus.ai showcase website** **Version 1.2** **Published on 2 October 2026, effective from 2 October 2026** **SHA-256 hash of the text: [HASH SHA-256]** This page lists the cookies and the other information that the evolus.ai website saves in your browser, and the tools that read information from your device, explains what they are for and how you can choose or delete them. It is provided pursuant to art. 122 of the Italian Personal Data Protection Code (Codice in materia di protezione dei dati personali, Legislative Decree no. 196/2003), to articles 13 and 14 of Regulation (EU) 2016/679 ("GDPR") and to the Guidelines on cookies and other tracking tools of 10 June 2021 (Linee guida cookie e altri strumenti di tracciamento del 10 giugno 2021) of the Italian Data Protection Authority (Garante per la protezione dei dati personali). In short: the strictly necessary technical tools are always active; the Umami statistics do not use cookies and do not require consent; Google Analytics, Google Ads and the Meta Pixel work only if you accept them in the banner, and until then they are not even loaded; heatmaps and session recordings (“Experience analysis”) do not use cookies, but work only if you turn them on in the banner. The way we process the personal data collected by the website is described in the website's privacy notice, published at https://evolus.ai/en/website-privacy. --- ## 1. Who we are {#titolare} The controller is CodeDesign S.r.l., with registered office at Via Nino Pesce 38, 18018 Taggia (IM), VAT No. IT01739830089 ("we"). For any question about this page, write to privacy@codedesign.it. --- ## 2. Cookies and browser storage: what they are {#cosa-sono} Cookies are small text files that a website saves in your browser and reads again on later visits. The browser also offers other spaces with the same function, such as local storage (localStorage), in which a website can save information that remains even after the page is closed. On this page we call them together "tools". They fall into two broad groups: - **technical tools**, strictly necessary to run the website or a feature you have expressly asked for: they do not require your consent; - **non-technical tools**, for example third-party statistics or advertising tools, or tools that record how you use the pages: they can be used only with your consent. The consent rules do not apply only to cookies: they also apply to programs that read information from your device without saving anything in the browser, such as the heatmaps and session recordings described in section 8. A cookie is "first-party" if it is set by the website you are visiting, "third-party" if it is set by another domain. --- ## 3. The banner and your choices {#banner} On your first visit a banner asks whether you accept the three optional categories described below: **Statistics** (Google Analytics), **Marketing** (Google Ads and Meta Pixel) and **Experience analysis** (heatmaps and session recordings). - With **“Accept all”** you turn on all three categories; with **“Reject all”**, which is equally prominent, you turn on neither. - With **“Customize”** you choose the categories one by one. - Closing the banner with the **X** is the same as rejecting everything. Until you make a choice, and if you reject, the website does not load any Google or Meta program, does not send any data to Google or Meta and does not collect heatmaps or session recordings. You can use the website exactly like someone who accepts. We save your choice in a technical cookie (evolus_consent, section 4) for 6 months: during this period the banner is not shown to you again, unless the tools used or the conditions described on this page change significantly. After 6 months, the banner asks you to choose again. With this version of the page, which adds the Meta Pixel to the “Marketing” category, the banner is shown once again to everyone, including those who had already chosen. **You can change your mind at any time** from the “Cookie preferences” link at the bottom of every page of the website. Withdrawing consent does not make unlawful what was done before, but from that moment Google and Meta no longer receive data from the website (the website also deletes the Meta Pixel cookies); if you withdraw experience analysis, the page reloads and from that moment the website stops collecting heatmaps and recordings. The Google and Meta cookies already present in the browser are deleted from the browser settings (section 10). --- ## 4. Technical tools, always active {#tecnici} These tools are used to run the website and to remember the choices you make. They do not require your consent (art. 122, paragraph 1, of the Italian Privacy Code). | Name | Type | Set by | Purpose | Duration | |---|---|---|---|---| | evolus_consent | First-party cookie | evolus.ai | Remembers the choices you made in the banner: the version of this page they refer to, the categories accepted (Statistics, Marketing, Experience analysis) and the date of the choice | 6 months | | NEXT_LOCALE | First-party cookie | evolus.ai | Remembers the language you choose from the language menu or the language notice, when it differs from your browser's, and uses it when you come back to evolus.ai | 1 year | To open evolus.ai in your language, we read the language set in your browser, without storing it. --- ## 5. Cookieless statistics: Umami {#umami} We measure visits with Umami, a statistics tool that we install and manage ourselves, on our own server in Germany. **Umami does not set cookies and does not save anything in your browser.** It does not follow you on other websites, does not create profiles and does not disclose data to third parties. The Umami program, downloaded from our domain, reads from the browser only the information needed to describe the visit: the page, the referring page, the language, the screen size and the page loading and response times (the so-called “Core Web Vitals”), which help us find slow pages. Our server uses your IP address to derive the approximate location and to calculate a visit code that changes every month, then discards it without saving it. The details are in the website's privacy notice, at https://evolus.ai/en/website-privacy. This is why we do not ask for your consent: the Italian Data Protection Authority's Guidelines of 10 June 2021 treat as equivalent to technical tools the analytics tools used only by the website operator, which produce aggregate statistics, do not combine the data with other information and do not disclose them to third parties. If you do not want to be counted, turn on the “Do Not Track” signal in your browser settings: the website respects it and does not send the statistics. You can also object by writing to privacy@codedesign.it. Heatmaps and session recordings, which use the same Umami, work instead only with your consent: they are described in section 8. --- ## 6. Statistics, only with your consent: Google Analytics {#statistiche} If you accept the **Statistics** category, the website loads Google Analytics 4 to measure in more detail how it is used: how many people come back, where they come from, which pages and which features they use. Google Analytics sets these cookies on our domain: | Name | Type | Set by | Purpose | Duration | |---|---|---|---|---| | _ga | First-party cookie | Google Analytics, on evolus.ai | Distinguishes visitors with a random identifier | 2 years | | _ga_Q9MW4DBB55 | First-party cookie | Google Analytics, on evolus.ai | Keeps the state of the visit session | 2 years | Some browsers delete these cookies earlier if you do not come back to the website: for example Safari after 7 days. For this purpose Google Ireland Limited processes the data on our behalf. For visitors located in the European Union, Google states that it uses the IP address only to derive the approximate location, on servers in Europe, and that it deletes it without logging it. User-level and event-level data are deleted by Google after 14 months. Google may also process data in the United States, on the basis of the EU-US Data Privacy Framework, under which Google LLC is certified. The legal basis is your consent (art. 6.1.a GDPR and art. 122 of the Italian Privacy Code), which you can withdraw at any time from the “Cookie preferences” link. --- ## 7. Marketing, only with your consent: Google Ads and Meta Pixel {#marketing} ### Google Ads If you accept the **Marketing** category, we allow Google to: - measure whether you arrive on the website from one of our Google ads and whether the visit ends with a contact request (conversion); - add you to audience lists, to show you our ads on Google and on the websites that partner with Google. On our domain Google sets these cookies: | Name | Type | Set by | Purpose | Duration | |---|---|---|---|---| | _gcl_au | First-party cookie | Google Ads, on evolus.ai | Links visits and contact requests to the ads, to measure their results | 90 days | | _gcl_aw | First-party cookie | Google Ads, on evolus.ai | Remembers the click code when you arrive from a Google ad | 90 days | | _gcl_gs | First-party cookie | Google Ads, on evolus.ai | Remembers the information about the click when you arrive from a Google ad | 90 days | For these purposes Google may also set and read its own cookies on its domains (for example doubleclick.net or google.com), as an independent controller. The complete and up-to-date list of Google's advertising cookies, with their durations, is published at https://business.safety.google/adscookies/. Google Ireland Limited and Google LLC process these data according to their own rules, published at https://policies.google.com/privacy; you can also manage personalised ads at https://myadcenter.google.com. The transfer of data to the United States takes place on the basis of the EU-US Data Privacy Framework, under which Google LLC is certified. The legal basis is your consent (art. 6.1.a GDPR and art. 122 of the Italian Privacy Code), which you can withdraw at any time from the “Cookie preferences” link. ### Meta Pixel If you accept the **Marketing** category, the website also loads the Meta Pixel of Meta Platforms Ireland Limited (Ireland), only after your consent. The pixel records the pages you visit and the successful submission of the contact form, without the content of the message or your contact details, together with technical information about the browser and the device and the IP address, in order to: - measure how well our campaigns on Facebook and Instagram perform; - show our ads to people who have visited the website. On our domain the pixel sets these cookies: | Name | Type | Set by | What it is for | Duration | |---|---|---|---|---| | _fbp | First-party cookie | Meta Pixel, on evolus.ai | Identifies the browser, to link visits to Meta ads and measure their results | 90 days | | _fbc | First-party cookie | Meta Pixel, on evolus.ai | Remembers the click code when you arrive from one of our ads on Facebook or Instagram (it appears only in that case) | 90 days | If you are logged in to Facebook or Instagram, Meta may also use its own cookies on its domains. We do not send Meta emails, telephone numbers or any other data you enter on the website, and the pixel's automatic events are turned off. The pixel is never loaded on the shared board page. For the collection and transmission of data through the pixel, CodeDesign and Meta Platforms Ireland Limited are joint controllers (art. 26 GDPR), under Meta's joint controllership agreement (“Controller Addendum”); for subsequent processing Meta acts as an independent controller, under its own privacy policy, published at https://www.facebook.com/privacy/policy, and you can also exercise your rights with Meta. The data received by Meta are kept according to Meta's retention periods. The transfer of data to the United States takes place on the basis of the EU-US Data Privacy Framework, under which Meta Platforms, Inc. is certified. The legal basis is your consent (art. 6.1.a GDPR and art. 122 of the Italian Privacy Code), which you can withdraw at any time from the “Cookie preferences” link: from that moment the pixel no longer sends data to Meta and the website deletes the _fbp and _fbc cookies. --- ## 8. Experience analysis, only with your consent: heatmaps and session recordings {#analisi-esperienza} If you turn on the **Experience analysis** category, the website uses two additional features of Umami, on the same server as the statistics: we install and manage it ourselves, at Hetzner Online GmbH in Germany, without third parties. - **Heatmaps**: the program collects the position of clicks on the page, how far you scroll down the page, the size of the window and of the page and the page path, without the part of the address after the “#” symbol. We look at them in aggregate form and keep them for 12 months. - **Session recordings**: the program records how you use the pages (clicks, scrolling, mouse movements, moving from one page to another) and the content of the page as it appears on your screen, including the conversation with Evo and the notes on its board on the home page. It never records the content of the fields you fill in, the Evolus chat on the other pages, the shared board page or the audio of your voice; texts that repeat your email address or your phone number on the screen are hidden. Each recording stops automatically after 5 minutes at most and is kept for 30 days. **These features do not use cookies and do not save anything in your browser**: your choice is remembered in the technical cookie evolus_consent (section 4). We use them only with your consent because the program reads from your device information that goes beyond what is strictly necessary. If your browser sends the “Do Not Track” signal, nothing is recorded. Heatmaps and recordings are viewed only by us, to understand what does not work and to improve the website: they are not used to profile you, we do not combine them with other data and we do not disclose them to third parties. The details are in the website's privacy notice, at https://evolus.ai/en/website-privacy. The legal basis is your consent (art. 6.1.a GDPR and art. 122 of the Italian Privacy Code), which you can withdraw at any time from the “Cookie preferences” link. To ask us to delete a recording of your visit before it expires, write to privacy@codedesign.it. --- ## 9. Evo and the Evolus chat: browser storage {#memoria-locale} Evo, the assistant on the home page, and the Evolus chat on the other pages save some information in your browser's local storage. They are not cookies: they are not automatically sent to our server with every request, and you can delete them as explained in section 10. ### Evo | Name | Type | Set by | Purpose | Duration | |---|---|---|---|---| | evo-memory-v1 | Local storage, first-party | evolus.ai | Remembers the industry, plan and name of the company you talked about with Evo, to pick up the conversation on your next visit. It is saved only if you turn on the optional “Remember me next time” switch among Evo's controls, which is your consent; as long as it exists, the switch shows as on | 30 days from the last update, then Evo deletes it; you can delete it earlier by turning the switch off or from the browser settings | Evo's memory is not strictly necessary: without it Evo works in the same way, but does not remember the previous conversation. This is why we save it only with your consent (art. 122 of the Italian Privacy Code), which you give by turning on the “Remember me next time” switch, off by default, and withdraw by turning it off: the memory is deleted immediately. ### The Evolus chat The chat saves its information under names that start with evw: followed by the code of the website's chat. It writes them only when you use it. | Name | Type | Set by | Purpose | Duration | |---|---|---|---|---| | evw:…:cid, evw:…:title, evw:…:msgs, evw:…:last | Local storage, first-party | Evolus chat | Keep the ongoing conversation (code, title, messages and time of the last message), so you can continue it when you change page | Deleted when you come back to the website after 30 minutes of inactivity or when you start a new conversation | | evw:…:prefs | Local storage, first-party | Evolus chat | Remembers the preferences you choose in the chat: theme, sounds, text size | Until you delete it | | evw:…:leadDone, evw:…:leadSkipped, evw:…:leadName | Local storage, first-party | Evolus chat | Remember whether you have already left or skipped your contact details in the chat, so as not to ask you for them again, and the name you gave, to greet you | Until you delete them | | evw:…:dismissed, evw:…:proactiveDismissed, evw:…:reopen | Local storage, first-party | Evolus chat | Remember whether you closed the chat or its welcome message; reopen the chat on the next page when it is the chat itself that takes you there | Until you delete them; reopen is deleted on the next page | These are technical or functionality tools, linked to a feature you have chosen to use, and do not require consent. The chat program is downloaded from the servers of the Evolus platform (api.evolus.ai) only after your first interaction with the page; the processing of the messages is described in the website's privacy notice, at https://evolus.ai/en/website-privacy. --- ## 10. How to delete cookies and browser storage {#cancellare} - **Consent to Google Analytics, Google Ads, the Meta Pixel and experience analysis**: from the “Cookie preferences” link at the bottom of every page. - **Evo's memory**: by turning off the “Remember me next time” switch among Evo's controls. - **Chat conversation**: with the command to start a new conversation, inside the chat. - **Everything the website has saved**: from the browser settings, usually in the section dedicated to privacy or to site settings, under “Cookies and site data”. By deleting the data of evolus.ai you remove both the cookies and the local storage; on your next visit the banner will ask you to choose again. Every browser explains how to do this in its own help pages, if you search for “clear cookies and site data”. --- ## 11. Your rights {#diritti} Besides choosing and withdrawing consent as described above, you can exercise the rights provided for by articles 15 to 22 of the GDPR by writing to privacy@codedesign.it, and you can lodge a complaint with the Italian Data Protection Authority (https://www.garanteprivacy.it). The details are in the website's privacy notice, at https://evolus.ai/en/website-privacy. --- ## 12. Changes to this page {#modifiche} We update this page when the tools used by the website change. We publish each new version on this page, with the version number and the date. If the tools that require consent change significantly, the banner asks you to choose again. --- CodeDesign S.r.l., evolus.ai website. Registered office: Via Nino Pesce 38, 18018 Taggia (IM), VAT No. IT01739830089. Data protection contact: privacy@codedesign.it. Text of the cookie policy: https://evolus.ai/en/cookie-policy.