Cookie Policy

1. Who is responsible

Citeon is provided by Ferrarix di Patrizia Rossi, Via della Stazione 13, 04015 Priverno (LT), Italy, VAT (P.IVA) IT03365170590. Questions: hello@citeon.ai. How we handle personal data in general is in our Privacy Policy.

2. Your choice

When you first visit, a banner offers two equal choices: Accept or Essential only. Nothing is pre-selected and the site works fully either way. Closing the banner is not a choice, so nothing optional runs until you pick one.

You can change your mind at any time with Cookie settings, which is also at the bottom of every page. If you switch from Accept to Essential only, we remove the analytics cookies our site set, tell Microsoft Clarity to erase its cookies, and reload the page so no analytics script keeps running. Your choice is saved in your browser (see citeon-consent below). If what Accept covers ever changes, we ask you again.

So we can prove your choice if ever asked, we also keep a record of it on our server: a random ID created in your browser, what you chose for each service, the banner version and the time. It contains no IP address, name or email.

3. Essential: always on

These are needed for the site to work or to remember a choice you made. They need no consent.

• sb-…-auth-token (cookie, may be split into numbered parts), set by Supabase, our login provider, only when you sign in. Keeps you signed in. Lasts up to 400 days, or until you sign out.
• active_ws (cookie), only in the dashboard. Remembers which workspace you last opened. Lasts 1 year.
• view_as (cookie), only for Citeon staff helping a customer inside the dashboard. Lasts 8 hours.
• citeon-consent (browser storage). Remembers your cookie choice, when you made it and a random ID that links your choices together. Stays until you clear your browser storage.
• citeon-theme (browser storage). Remembers light, dark or device theme. Stays until you clear it.
• citeon.sidebar and citeon.traffic.period (browser storage), only in the dashboard. Remember the sidebar state and the chosen period on the traffic page. Stay until you clear them.

4. Analytics: only after Accept

• Google Analytics 4 (Google). Counts visits and page views, with IP anonymisation on. Cookies _ga and _ga_<id>, which Google states last 2 years (browsers may shorten this).
• Microsoft Clarity (Microsoft). Shows how pages are used, including recordings of clicks, scrolls and mouse movement, so we can find what confuses people. It sets _clck and _clsk on our site and, per Microsoft, cookies on Microsoft domains (CLID, MUID, ANONCHK, MR, SM). We tell Clarity that analytics is allowed and advertising is not.
• Citeon Pulse (our own). Counts page views, where visits come from (including AI assistants), time on page and scroll depth. It sets no cookies and stores nothing in your browser. Our server turns your IP address and browser type into a code that changes every day, keeps that code and your country, and does not keep the IP address itself.

5. Other requests your browser makes

Some pages load small things from other services. These set no cookies from our side, but your browser does send them your IP address:

• Company logos in reports and the dashboard come from Brandfetch or Google’s favicon service, which receive the domain name of the logo shown.
• Error monitoring (Sentry, EU region) receives technical error reports when something breaks, without names or email addresses.
• Bot protection (Vercel BotID) checks, on the audit and contact forms, that a person and not a script is sending them.

6. Blocking cookies in your browser

You can also block or delete cookies in your browser settings. If you block essential ones, signing in to the dashboard will not work.

7. Changes

We update this page when we add or remove a cookie or script, and change the date at the top.