Cookie Policy

Version 2026-10, effective 2026-10-15

Data Protection Officer For questions about your personal data or to exercise your privacy rights, contact our Data Protection Officer at dpo@guidalia.com

This Cookie Policy explains which cookies and similar technologies (browser local storage, session storage and IndexedDB) are used on Guidalia's websites, and which third-party services are contacted when you visit them. It is provided by Guidalia SRL, Via Livorno 54/2, 50142 Firenze, Italy, VAT 07560660487, the data controller. How we process personal data more broadly is described in our Privacy Policy: https://guidalia.com/legal/privacy

This policy covers the websites guidalia.com, app.guidalia.com, live.guidalia.com, create.guidalia.com, tickets.guidalia.com and admin.guidalia.com. Our mobile apps are covered by the Privacy Policy.

How we use cookies

We follow the Italian Data Protection Authority (Garante) guidelines on cookies and other tracking tools of 10 June 2021.

• Technical cookies and storage are needed to provide a service you asked for: signing in, keeping you signed in, remembering your language, protecting forms and accounts from abuse, completing a payment. They do not need your consent.
• Audience statistics without cookies. On guidalia.com, app.guidalia.com, live.guidalia.com, create.guidalia.com and tickets.guidalia.com we use Plausible Analytics (Plausible Insights OÜ, EU). Plausible sets no cookies and stores nothing on your device. It counts page views in aggregate form and does not identify you, so it does not need your consent.
• Analytics cookies (consent only). Only app.guidalia.com and live.guidalia.com use analytics cookies: Google Analytics (Firebase Analytics, Google Ireland Ltd / Google LLC). They are never set, and the Google Analytics script is not even loaded, unless you choose "Accept all" or switch Analytics on in the cookie banner.
• No marketing or advertising cookies are used on any Guidalia website.

Only app.guidalia.com and live.guidalia.com show a cookie banner, because they are the only sites with an optional category (Analytics). Closing the banner with the X keeps Analytics off. You can change your choice at any time with the "Privacy preferences" button on those sites; if you have an account in the Guidalia app, also from Account, Privacy and consents.

Cookies and storage by website

Durations are maximums. "Session" means the item is deleted when you close the browser.

guidalia.com

Technical:

• .AspNetCore.Antiforgery.<id> (cookie, Guidalia): protects our forms (contact, applications, support) against cross-site request forgery. Set only on pages with a form. Session.
• .AspNetCore.Culture (cookie, Guidalia): remembers the language you pick with the language selector. Set only if you use it. 1 year.

Third-party services contacted:

• Cloudflare Turnstile (Cloudflare Inc.): anti-spam check on pages with a form only. Your browser loads the check from challenges.cloudflare.com, and when you submit a form we send your IP address to Cloudflare to verify it. Cloudflare does not use it for advertising.
• Plausible Analytics: cookieless audience statistics, see above.

app.guidalia.com (Guidalia app on the web)

Technical:

• guidalia_consent (cookie, Guidalia, shared with live.guidalia.com): stores your cookie choice (Analytics on or off), the Cookie Policy version you saw, the date of your choice and a random identifier that links your choice to our consent register (proof of consent). If you sign in, the identifier is linked to your account so your choice follows you across devices. 12 months, after which we ask again.
• guidalia_anon (cookie, Guidalia): random identifier that keeps content you unlocked without an account (for example through a QR code or a shared link). 12 months.
• Firebase Authentication (IndexedDB "firebaseLocalStorageDb", Google): keeps you signed in. Until you sign out.
• Firebase App Check and Google reCAPTCHA Enterprise (IndexedDB "firebase-app-check-database"; cookie _GRECAPTCHA on www.google.com, Google): checks that requests come from our genuine website and not from bots. Required to use the service. _GRECAPTCHA: 6 months.
• Firebase Installations, Remote Config, heartbeat (IndexedDB "firebase-installations-database", "firebase_remote_config", "firebase-heartbeat-database", Google): an installation identifier used for service configuration, diagnostics and security. Until you clear site data.
• Local storage and session storage (Guidalia): your language, the progress of an email sign-in link, links to open after sign-in, your trip planning dates, pending purchases and notices you dismissed. Local storage stays until you clear site data; session storage is deleted when you close the tab.
• Stripe (cookies __stripe_mid, 1 year, and __stripe_sid, 30 minutes; Stripe Inc.): fraud prevention, set only if a card payment needs an extra verification step (3-D Secure).

Analytics (only with your consent):

• _ga and _ga_XJS3D65BJ0 (cookies, Google Analytics): distinguish visitors and sessions to produce usage statistics. 2 years. Ad features are switched off.

Third-party services contacted:

• Google Maps Platform (Google): loaded only when a page shows a map.
• Wikipedia (Wikimedia Foundation): short descriptions of places are loaded from Wikipedia when you open them. It sets no cookies on our site.
• Sentry (Functional Software Inc., EU data region) and Azure Application Insights (Microsoft): crash reports and service diagnostics. They set no cookies.
• Plausible Analytics: cookieless audience statistics, see above.

live.guidalia.com (Guidalia Live on the web)

Technical:

• guidalia_consent, Firebase Authentication, Firebase App Check and Google reCAPTCHA Enterprise (including _GRECAPTCHA), Firebase Installations, Remote Config, heartbeat: as described for app.guidalia.com.
• Local storage and session storage (Guidalia): your language, the progress of an email sign-in link, the Live join code you followed, a checkout in progress and pending credit purchases. Local storage stays until you clear site data; session storage is deleted when you close the tab.

Analytics (only with your consent):

• _ga and _ga_2PPCFDBV9N (cookies, Google Analytics): as described for app.guidalia.com. 2 years.

Third-party services contacted:

• LiveKit (LiveKit Inc.): carries the audio of live sessions you join or host. It sets no cookies.
• Stripe Checkout (Stripe Inc.): you are redirected to Stripe's payment page when you buy credits; Stripe's own cookie policy applies there.
• Sentry, Azure Application Insights, Plausible Analytics: as described for app.guidalia.com.

create.guidalia.com (Creator Studio)

Technical:

• Firebase Authentication and Firebase App Check and Google reCAPTCHA Enterprise (including _GRECAPTCHA): as described for app.guidalia.com.
• guidalia-web-device-id (local storage, Guidalia): random identifier for this browser, used to manage your active sessions. Until you clear site data.
• guidalia-email-for-signin (local storage, Guidalia): your email address while an email sign-in link is pending. Deleted once you sign in.
• guidalia-ui-culture (local storage, Guidalia): the language you chose. Until you clear site data.
• Application cache (Cache Storage, Guidalia): stores the application files so the site loads faster.

Third-party services contacted:

• Google Maps Platform (Google): loaded only when you open a map or a place search.
• Plausible Analytics: cookieless audience statistics, see above.

tickets.guidalia.com (Guidalia Tickets)

Technical:

• Firebase Authentication and Firebase App Check and Google reCAPTCHA Enterprise (including _GRECAPTCHA): as described for app.guidalia.com.
• guidalia-email-for-signin (local storage, Guidalia): as described for create.guidalia.com.
• blazorCulture (local storage, Guidalia): the language you chose. Until you clear site data.
• Application cache (Cache Storage, Guidalia): as described for create.guidalia.com.

Third-party services contacted:

• Plausible Analytics: cookieless audience statistics, see above.

admin.guidalia.com (internal staff tool)

Used only by Guidalia staff. Technical only:

• Firebase Authentication and Firebase App Check and Google reCAPTCHA Enterprise (including _GRECAPTCHA): as described for app.guidalia.com.
• guidalia-web-device-id and guidalia-email-for-signin (local storage, Guidalia): as described for create.guidalia.com.
• Application cache (Cache Storage, Guidalia).

Third-party services contacted: Google Maps Platform (Google), on pages that show a map.

Google services and your Google account

Google reCAPTCHA Enterprise runs in a frame served by www.google.com. If you are signed in to a Google account in the same browser, your browser also sends Google's own account cookies to that frame and to the Google sign-in pages you open. Those cookies are set and controlled by Google under Google's Privacy Policy (https://policies.google.com/privacy) and Cookie Policy (https://policies.google.com/technologies/cookies), not by Guidalia.

Transfers outside the EU

Some of the providers above are based in, or may access data from, the United States (Google, Cloudflare, Stripe, LiveKit). Transfers rely on the EU-US Data Privacy Framework or on the European Commission's Standard Contractual Clauses. See our Privacy Policy for details.

Managing cookies

• On app.guidalia.com and live.guidalia.com, use the "Privacy preferences" button to switch Analytics on or off at any time. Switching it off stops Google Analytics; the _ga cookies already set expire on their own or can be deleted from your browser.
• You can delete cookies and site data, or block cookies, in your browser settings. Blocking technical cookies and storage may prevent sign-in and other features from working.
• We ask for your choice again after 12 months, or sooner if this policy changes in a way that affects it.

Changes to this policy

We update this policy when the cookies or services we use change. The version and effective date are shown on this page, and the consent register records which version each choice refers to.