1. What cookies and similar technologies are
These are files or identifiers that a website stores or accesses on the device. They enable maintaining a session, remembering preferences, protecting forms, measuring usage, or attributing campaigns. This policy also covers local storage, pixels, SDKs, identifiers and equivalent techniques.
2. Data controller
Stefany Alejandra Cesar Funes, NIE Z1026100Y, with registered address at Calle Murta 19, Paterna, Valencia, Spain. Contact: privacidad@nexolicit.com.
3. Categories
- Necessary: they enable security, authentication, privacy preferences, load balancing and functions expressly requested. They do not require consent when they meet legal requirements.
- Preferences: they remember non-essential options. When they respond to a user-requested choice and are not reused, they may be technical; in other cases, consent is required.
- Analytics: they measure browsing, performance and conversions. They remain disabled until consent is given.
- Marketing: they attribute campaigns, create audiences or personalize advertising. They remain disabled until consent is given.
4. Inventory and active technologies
| Name | Provider | Purpose | Duration | Base / status |
|---|---|---|---|---|
nexolicit_session | NexoLicit | Authenticate the user and maintain a secure session. | 30 days or until you log out | Strictly necessary. |
nexolicit_csrf | NexoLicit | Prevent request forgery and protect account actions. | 30 days or until you log out | Strictly necessary. |
nexolicit_cookie_preferences_v1 (local storage) | NexoLicit | Keep acceptance, rejection and the selected configuration. | 12 months | Necessary to remember the choice. |
| Technical security and delivery identifiers | Vercel and Cloudflare | Serve the website, distribute traffic, prevent abuse and maintain availability. | Session or short technical period, depending on the identifier | Strictly necessary when the provider issues them. |
_ga and _ga_* | Google Analytics 4 | Measure aggregate website usage and conversions. | Up to 2 years | Analytics; blocked until consent. |
_clck and _clsk | Microsoft Clarity | Maintain a pseudonymous browser identifier and group pages into one session to generate heatmaps and masked session replays. | Up to 1 year (_clck) and 1 day (_clsk), depending on provider configuration | Analytics; blocked until consent. |
CLID, ANONCHK, MR, MUID and SM, where applicable | Microsoft Clarity | Technical identifiers and synchronization needed for experience measurement after consent. | Between the session and 390 days, depending on the identifier and Microsoft configuration | Analytics; blocked until consent. Advertising storage remains denied. |
gclid, _gcl_* and equivalent identifiers, where applicable | Google Ads | Attribute advertising clicks and connect them with registrations measured in Google Analytics 4. | Up to 90 days, depending on configuration and browser | Marketing; blocked until consent. |
_fbp and, where applicable, _fbc | Meta Platforms | Attribute campaigns and measure visits and registrations through Meta Pixel. | Up to 3 months | Marketing; blocked until consent. |
Google Analytics 4, Microsoft Clarity, Google Ads attribution and Meta Pixel are only activated when the person accepts the corresponding category. Clarity requires analytics consent, uses strict masking and does not connect before consent; Microsoft advertising storage remains denied. Rejecting or withdrawing consent stops new non-essential measurements.
5. Consent management
On the first visit, three visible actions are offered simultaneously: accept all, reject the non-necessary ones, and configure. Rejecting is no more complex than accepting. There are no pre-checked boxes and no prior installation of analytics or marketing.
The selection is stored for twelve months, unless there are significant changes or you withdraw it earlier. The fixed preferences button lets you reopen the panel and change your choice with the same ease.
Withdrawing does not automatically remove identifiers already stored by third parties; the site revokes or deletes the controllable ones and the user can also delete them from the browser.
6. Configuration panel
The panel lets you enable or disable non-necessary categories. Strictly necessary cookies remain enabled because without them, certain requested functions could not be provided securely. Each category will include a clear description and access to this policy.
7. Third parties and transfers
Vercel and Cloudflare may receive IP addresses, headers, device information and technical metadata to deliver and protect the site. Google Ireland Limited, Microsoft Ireland Operations Limited and Meta Platforms Ireland Limited may receive online identifiers, IP address, browser, device, URL, referrer and measurement events only after consent for the corresponding category, for the purposes described in the inventory. Microsoft Clarity records navigation interactions with strict masking; this implementation does not use personalized identification or send names, email addresses, company names, tax IDs or form contents. Meta Pixel likewise does not receive those fields. See the Microsoft Privacy Statement.
When processing involves a transfer outside the European Economic Area, the safeguards described in the Privacy Policy apply, such as adequacy decisions, the EU-U.S. Data Privacy Framework where applicable, or standard contractual clauses and complementary measures. Any new analytics, advertising, chat or embedded-content technology will require classification, inventory updates and pre-blocking when consent is required.
8. Control from the browser
In addition to the panel, the user can block or delete cookies from Chrome, Firefox, Safari, Edge or another browser. The path changes by version; it is normally found under Privacy and security, Cookies or Site data. Full blocking may prevent authenticated access or necessary functions.
9. Free plan and rejection
Rejecting non-necessary cookies will not prevent you from browsing the website, registering, using an account or accessing the free plan. Plan differences reflect the agreement — for example, a 21-day delay — and not whether tracking is accepted.
10. Audit and updates
NexoLicit periodically reviews the website and re-audits it after changes to tags, consent, authentication, payments, chat, videos or embedded content. The policy and the panel are updated in sync. Scripts are not added via a tag manager without classification and pre-blocking when required.
11. Contact
For questions about cookies or privacy: privacidad@nexolicit.com. To exercise rights regarding personal data derived from these technologies, consult the Privacy Policy.