This Policy explains which cookies and similar technologies UDISOFTBOX CONSULTORIA E TECNOLOGIA LTDA ("INGESTIA") uses on ingestia.io and in the Platform, what for, for how long, and how you decide. It forms part of the Privacy Policy.
1. The three categories
| Category | Needs your consent? | What for |
|---|---|---|
| Necessary | No | Without them the site does not work: session, security, language and the record of your own cookie choice |
| Analytics | Yes | Measuring audience and understanding usage — includes session recording and heatmaps |
| Advertising | Yes | Measuring campaigns and remarketing on advertising platforms |
Analytics and advertising start out declined. Nothing is activated before you choose, and there is no pre-selected option in the banner.
2. Necessary — always active
These are set by INGESTIA itself or by the authentication library:
| Cookie | Purpose | Duration |
|---|---|---|
ingestia_consent | Stores YOUR cookie choice. It is the cookie that makes a refusal stick | 1 year |
ingestia.locale | The language you chose (Portuguese, English or Spanish) | session/persistent |
authjs.session-token (and the __Secure- variant) | Keeps you signed in. Without it, every click would ask for the password again | session |
authjs.csrf-token | Cross-site request forgery protection — a security cookie | session |
authjs.callback-url | Returns you to the right page after signing in | session |
Legal basis: performance of the contract and legitimate interest in security. There is no way to refuse these and still use the Platform — which is why the law does not require consent for them.
3. Analytics — only with consent
| Vendor | What it does | Typical cookies |
|---|---|---|
| Google Analytics 4 | Measures audience: pages viewed, source, path taken | _ga, _ga_<id> |
| Google Tag Manager | Loads the measurement tags according to your consent | — |
| Microsoft Clarity | Records the session and builds heatmaps: replays mouse movements, clicks and scrolling on the public pages | _clck, _clsk |
| The Platform's own telemetry | Measures whether essential tasks are completed, using a closed event vocabulary and no personal data in the payload | — |
Session recording is the most invasive item on this list, and that is why it is named for what it does rather than by euphemism. It does not run on the entry screens.
4. Advertising — only with consent
| Vendor | What it does | Typical cookies |
|---|---|---|
| Meta (Pixel and Conversions API) | Campaign measurement and remarketing. Without your consent, INGESTIA also does not send your hashed e-mail, IP address or user agent from the server | _fbp, _fbc |
| Google Ads | Attributes campaign conversions | _gcl_* |
| Trafegix | Attributes media campaigns | defined by the vendor |
The names above are the ones those vendors use in documented form. The exact set is defined by them and may change without notice to INGESTIA — the category and the purpose, which is what your consent decides, do not change.
The location, role and data involved for each vendor are set out in the Subprocessor List.
5. How to choose, change and withdraw
- Choose: in the banner, on your first visit. You may accept, decline, or choose category by category.
- Change or withdraw, at any time: through the Cookie preferences link in the website footer. The procedure is the same one used to grant it — withdrawing is no harder than accepting, as the Brazilian data protection authority requires.
- Effect of withdrawal: the tags stop receiving data from then on. INGESTIA propagates the refusal to the vendors through their own consent mechanisms; what was collected earlier follows each vendor's retention policy.
- In your browser: you can delete and block cookies through your browser settings. Blocking the necessary ones may prevent use of the Platform.
6. Entry screens
On the sign-in, sign-up and password recovery screens the banner is not displayed and nothing is granted: only necessary cookies apply there. This was a deliberate decision — asking for advertising consent from someone trying to reach their account is asking at the worst possible moment.
7. Inside the authenticated area
There are no advertising tags inside the Platform. Product telemetry respects the same consent cookie, and the absence of a recorded choice counts as no.
8. Questions
Data protection officer: Encarregado de Dados (DPO) — encarregado@ingestia.io · Channel: privacidade@ingestia.io