Widemile Cookie Policy

Last updated: 24 July 2026

This Cookie Policy explains how Centola Engineering S.r.l. uses cookies, browser local storage, pixels and similar technologies on widemile.ai and the Widemile web application. It forms part of the Widemile Privacy Policy.

1. Controller and contact

The controller is Centola Engineering S.r.l., Contrada Ponzanello Mamurrano 35, 04023 Formia (LT), Italy.

Contact: info@centolaengineering.com.

2. What these technologies are

Cookies are small text files stored by a website in the browser. Local storage is browser memory used to retain settings or application data. Pixels and software development kits can transmit technical and interaction information to a service provider. In this Policy, “trackers” refers collectively to these technologies.

First-party technologies are set from the Widemile domain. Third-party technologies are provided by another organisation and may allow that organisation to receive information from the browser.

3. Consent and legal basis

Strictly necessary technologies are used because they are required to provide a service requested by you, keep the application secure, maintain authentication and remember your privacy choices. They cannot be disabled through the preference centre.

Analytics and marketing technologies are optional and are activated in production only after the corresponding consent. Refusing them does not prevent access to the core service. You may change your choice at any time using Cookie Settings in the website footer.

Widemile records the selected categories, a random browser consent identifier, the policy version and the date of the choice in first-party browser storage. To demonstrate and honour the choice, Widemile also sends a minimal consent event to a restricted, append-only server log. The event contains the random identifier, selected category, grant, refusal or withdrawal, policy version, source, language and server timestamp. It does not include a full IP address, user agent or device fingerprint.

We ask for a new choice when the policy materially changes or, in any event, after the configured consent period expires. Server consent evidence is retained only for as long as reasonably necessary to demonstrate the choice and manage related legal claims, after which it is deleted or irreversibly anonymised.

4. Strictly necessary technologies

Widemile consent record

• Names: cookie-consent-store.v2 and widemile-consent-events-pending.v1.
• Provider: Widemile.
• Storage: first-party local storage.
• Purpose: remember whether analytics and marketing trackers are permitted, retain a random consent identifier and document the version and time of the choice.
• Duration: up to 6 months, unless deleted sooner or replaced after a policy change.

Widemile consent evidence log

• Name: /api/privacy/consent-events and consent_events.
• Provider: Widemile.
• Storage: restricted Widemile server database.
• Purpose: maintain an auditable history of grants, refusals and withdrawals without using advertising identifiers or device fingerprinting.
• Data: random browser consent identifier, optional account identifier after sign-in, category, choice, previous choice, policy version, interaction source, language and server timestamp.
• Duration: for as long as reasonably necessary to demonstrate the choice and until related legal limitation periods expire; records are then deleted or irreversibly anonymised.

Supabase authentication

• Names: sb-<project>-auth-token and any numbered chunks or related authentication keys.
• Provider: Supabase.
• Storage: first-party cookies.
• Purpose: sign-in, session continuity, token rotation and account security.
• Duration: up to 30 days of inactivity; access tokens inside the session expire and are rotated more frequently.

Application state and preferences

• Names: Widemile feature-specific local-storage or session-storage keys.
• Provider: Widemile.
• Storage: first-party local or session storage.
• Purpose: retain drafts, selected workspace or project, editor layout, dismissed notices, upload-consent status and other settings explicitly requested through the application.
• Duration: for the browser session or until the related data is deleted, the feature is reset or browser storage is cleared.

Payment security

• Names: Stripe security, checkout and fraud-prevention identifiers used on Stripe-hosted checkout pages.
• Provider: Stripe.
• Storage: cookies or similar technologies on Stripe domains.
• Purpose: securely complete payments, prevent fraud and maintain checkout state.
• Duration: session-based or persistent according to the security purpose and Stripe’s current cookie configuration.

5. Analytics technologies

Analytics trackers are disabled by default and are used only after analytics consent.

PostHog

• Names: ph_<project>_posthog and related PostHog local-storage identifiers.
• Provider: PostHog, EU ingestion endpoint where configured.
• Storage: browser local storage; Widemile configures PostHog not to use cookie persistence.
• Purpose: consented page and feature analytics, product improvement and error diagnosis.
• Data: random or account-linked identifier after sign-in, visited product area, interactions, device/browser information, IP-derived network information and error diagnostics. Private project content is not intentionally included in analytics events.
• Duration: up to 12 months, unless consent is withdrawn or browser storage is cleared sooner.

6. Marketing, conversion and affiliate technologies

These technologies are disabled by default and are used only after marketing consent.

Google Ads

• Names: _gcl_au, _gcl_aw, _gcl_dc and related Google advertising identifiers where created.
• Provider: Google Ireland Limited or the applicable Google entity.
• Purpose: attribute registrations or purchases to advertising campaigns, measure conversions and prevent duplicate measurement.
• Duration: up to 90 days for first-party conversion identifiers configured by Widemile; Google-domain identifiers may have different durations under Google’s policy.

X Ads

• Names: personalization_id, muc_ads, guest_id and related pixel identifiers where created.
• Provider: X Corp. or the applicable X entity.
• Purpose: advertising attribution, campaign measurement and audience reporting.
• Duration: session-based or up to 24 months depending on the identifier and X configuration.

TradeDoubler

• Names: tduid and related referral or affiliate identifiers where created.
• Provider: TradeDoubler.
• Purpose: attribute visits and purchases to an affiliate or referral campaign and calculate commissions.
• Duration: up to 12 months depending on the campaign configuration.

Mediavine Grow

• Names: Grow identifiers and related browser-storage keys where created.
• Provider: Mediavine, Inc.
• Purpose: audience, referral and engagement functionality enabled for Widemile campaigns.
• Duration: session-based or up to 12 months depending on the enabled Grow feature.

7. What happens before and after your choice

Before a choice is made, Widemile keeps optional analytics and marketing trackers disabled. If you accept a category, the relevant providers may receive the current page URL, referrer, IP address, browser/device information and interaction or conversion data.

If you withdraw consent, Widemile stops sending new optional events from subsequent page activity. Previously stored identifiers may remain until they expire or are removed. You can clear them immediately through browser settings; reloading the page after withdrawing consent prevents already loaded third-party scripts from continuing in the current page session.

8. Browser controls

Most browsers allow you to view, delete or block cookies and site data. Blocking strictly necessary cookies or storage may prevent sign-in, saved projects, checkout or other requested features from working correctly.

Browser-level “Do Not Track” signals are respected where supported by the relevant tracker, but Cookie Settings remain the primary control for Widemile optional technologies.

9. Updates

We update this Policy when trackers, purposes, providers or retention periods change. The date at the top identifies the current version.

10. Contact

For questions about cookies or your choices, contact info@centolaengineering.com.