What these technologies do
Cookies, local storage and session identifiers store information in a browser. Some enable login, language settings and security; analytics tools measure use. Classification depends on purpose, not merely the technology’s name.
Necessary tools currently used
Strictly necessary functions do not require analytics consent. Blocking them can prevent login or preferences from working. Cloudflare may use additional technical security mechanisms according to the service and checks enabled; their operation and duration follow the particular tool used.
| Function | Duration/configuration |
|---|---|
| Technical analytics consent preference: localStorage sg:privacy-consent | Remembers acceptance or refusal for six calendar months to respect your choice |
| Session cookie: __Secure-sg-native.session_token | Up to 8 hours, unless logged out or revoked sooner |
| Additional second-factor confirmation | 10-minute authorisation window, not a cookie retention period |
| Local storage: sg-locale; aa.active-organization.<userId>; siti-client-tour:v1:<userId> | Until changed or browser local storage is cleared |
| Cloudflare and Turnstile protection | For delivery, protected access and abuse prevention, depending on the actual tool used |
Analytics only with your consent
Analytics is optional and requires an explicit choice. The consent panel offers Accept all optional, Necessary only and Customize; settings also provide Save preferences. On a first visit, closing without accepting leaves optional measurement disabled. Browsing, scrolling or accepting service terms is not consent. Basic mode blocks Google tags and requests, including cookieless pings, before Analytics consent or after refusal. Analytics alone does not enable Google Ads measurement; that separate choice requires Analytics. Events missed before consent or while the tag is unavailable are discarded, never replayed.
GA4 data, cookies and settings
With Analytics consent, we measure public-page navigation, permitted client-area page categories, scroll depth, relevant clicks, opening the assistant, starting text or voice interaction, ending a voice session and application milestones. Parameters use fixed action, stage, channel, language and outcome categories, never what you type or say. The generate_lead event means the server has confirmed an actually submitted application; creating a draft, opening a form or clicking Submit is not a lead. Earlier analytics grants do not cover this expanded scope and require a new choice. Valid earlier refusals retain their original expiry and do not create a new request to delete an existing quality journal.
We exclude administration, login, authentication, internal search, raw private URLs and identifying page content. Permitted client-area navigation uses fixed page categories and titles, with UUIDs, customer/order identifiers and private path segments removed. Application measurement uses fixed milestones, never form answers or an application identifier. Unapproved query values and URL fragments are removed and the referrer is not sent. Only with both Analytics and the separate Google Ads measurement choice may the permitted click identifiers gclid, gbraid and wbraid and validated campaign labels in utm_source, utm_medium, utm_campaign, utm_id, utm_term, utm_content be retained for attribution. Each campaign label is limited to 100 characters and must pass character checks; recognisable URL, email and contact-like values are rejected. Do not put personal data in campaign labels. All other query values remain excluded. We send explicitly selected events; GA4 may add technical user, session and engagement events. Enhanced Measurement, Google Signals, User-ID, user-provided data, enhanced conversions, personalised advertising, remarketing and BigQuery exports remain disabled. Google Ads measurement needs the additional choice described below. Production and development use separate properties under the same consent rules.
After Analytics consent, the main Google tag loader and GA4 event requests pass through /metrics/ on our website’s domain via Google Tag Gateway on Cloudflare and are forwarded to Google. Forwarding uses technical request information, including the visitor’s IP address and approximate geographic data from Cloudflare when available. The Google tag loaded after consent may also send individual health-check requests directly to Google domains. The gateway does not change your consent choices; Google Ads measurement still requires separate permission.
| Setting or tool | Purpose and duration |
|---|---|
| Timezone and currency | Europe/Rome; EUR |
| _ga | Pseudonymous browser identifier, only after consent; 180 days |
| _ga_<ID> | GA4 session state, only after consent; 180 days |
| localStorage sg:analytics:submitted:v1 | Optional Analytics duplicate-submission guard: up to 200 opaque application identifiers stay only in this browser and are never sent to Google. They are used for duplicate detection for 180 days; older entries are discarded on the next successful submission, and the record is cleared when Analytics is withdrawn. Local storage has no automatic physical expiry. |
| _gcl_* | Only if Google sets advertising measurement cookies after the separate Ads choice. Google documents a standard 90-day lifespan; actual use depends on the enabled product and browser. Site-managed cookies are removed on Ads withdrawal. |
| Analytics cookie scope and renewal | Host only, without sharing across subdomains; cookie_update=false. Browsers may shorten their lifespan |
| User/event data in GA4 | 14 months; reset on new activity off; periodic Google deletion |
| Enhanced Measurement | Off; explicitly selected page views, scrolls, clicks, assistant actions and application milestones, plus possible technical GA4 events |
| Granular location/device data and optional Google sharing | Disabled for the account/properties used for this analytics |
| Google Signals, User-ID and user-provided data | Disabled |
| Google Ads measurement; personalisation and exports | Ads measurement requires Analytics and separate consent; sharing starts only after account setup and linking. No personalisation, remarketing or BigQuery export |
| Consent mode and pre-consent events | Basic; no tag, request or event to replay before acceptance |
Choice, duration and withdrawal
Your choice is valid for six calendar months in the current browser and on the current host, without automatically extending its expiry on each visit. You can change or withdraw it at any time through the cookie settings in the footer. A new choice is requested on expiry; it may be requested earlier if processing conditions change materially or the preference can no longer be retrieved, for example after clearing browser storage. Refusal does not prevent use of the service.
Withdrawal stops subsequent collection and removes analytics cookies managed by this site. It does not invalidate earlier lawful processing or automatically delete data already held in GA4: contact info@siti.gratis for a data request. Cookie lifespan, preference duration and retention on Google systems are separate periods.
Browser controls
You can clear cookies and local storage in browser settings, which may log you out and reset preferences. Blocking cookies is not a substitute for exercising rights over previously processed data. Our cookie controls do not govern external services you visit independently.
Controller and further information
Wake Up Italy SRL is the controller. Contact info@siti.gratis about trackers or data requests. The Privacy notice describes recipients, international transfers, retention, rights and complaints. The linked Google and Italian Garante sources explain how the services work and the applicable rules.
One optional Analytics choice
Analytics in Cookie settings covers Google Analytics 4, the internal comparison of public text assistant outcomes and the optional quality journal for new messages and available voice transcripts. Chat and form contents are not sent to Google Analytics. Authorized administrators review the separate journal to improve tests, knowledge and instructions; no audio is stored and no automatic model training takes place.
The browser’s Analytics choice lasts six months. Each journal and access key expire within the original 90 days from activation; new messages do not extend the period. Recording stops at expiry with no automatic renewal. A new journal needs a new explicit acceptance of Analytics in Cookie settings. Earlier analytics grants do not cover this combined scope; valid refusals retain their original expiry. The separate AI service consent remains in chat. Private questionnaire continuations are excluded from this journal.
Optional text assistant variant comparison
On siti.gratis, this consent also allows internal comparison of public text assistant variants and their link to saved, submitted and approved applications. Refusing does not restrict the assistant.
After access verification and renewed consent, we may randomly assign a first-contact and next-step variant. This tab stores a random key; a private database stores variant, language, milestone times and a technical application link, not chat or form contents. These are pseudonymous, not anonymous data. The analysis window is 90 days without renewal; expired rows are excluded from reports and removed by scheduled cleanup. Administrators see totals; submission and approval come from server events, not AI answers. The link and application outcome are not sent to Google Analytics. Withdrawal stops collection and requests deletion of the accessible link in this tab; a network error does not count as confirmed deletion. Other requests: info@siti.gratis. Existing applications and contracts are unchanged. The unified Analytics choice also controls the quality journal described in its own section; withdrawal requests its deletion for the current user. Earlier analytics grants do not cover the new scope; valid refusals remain respected. The comparison covers public text conversation only, not voice or private account workflows; results do not prove increased sales. The variant covers the first contact in the current guest session, not the customer's full history. Participation keys are not restored after reload or account sign-in. A separate deletion-only key remains in this tab until the original 90-day expiry and cannot continue tracking. Failed deletion requests are retried when returning to the app or reconnecting.