Cookie Policy — Crisol MCP
1. Who is responsible for the use of these cookies?
- Owner: Sara Fernández Velasco
- NIF: 47528322H
- Contact for privacy matters: privacidad@crisolmcp.com
The full identifying details, including the address, are set out in the Legal Notice.
2. What are cookies and similar technologies?
Cookies are small text files that a website stores in your browser to remember information about your visit. This policy also covers similar technologies, such as browser local storage (localStorage), which serve an equivalent function even though they are not technically cookies.
3. What cookies do we use and which ones need your permission?
Your decision is organized into three categories, one per purpose. The first does not need your permission; the other two do, and you can decide on them separately:
- Technical cookies. They are essential for the Site to work: keeping you signed in and protecting forms against attacks. They are exempt from consent in accordance with Article 22(2) of the LSSI-CE (Spain's law on information society services and e-commerce), so we do not ask you about them: we only inform you that they exist, which is exactly what this document does.
- Analytics cookies. They are Google's, and they help us understand how the Site is used and improve it. They need your permission, and they are not installed if you do not give it.
- Advertising measurement cookies. They serve to know whether you arrived from one of our advertisements and whether that visit ended in a sign-up. They need your permission, and today they do not install any additional cookie: the measurement travels within the analytics one. We explain this in point 4.3.
What we still do not do. We do not use remarketing, social media or advertising profiling cookies, and neither do we install advertising cookies properly so called. In our Google configuration, ad personalization, Google Signals and the sending of data of yours to match you with other accounts are disabled. We do not send Google any identifier linking you to your customer account, and this data is never cross-referenced with your identity in Crisol MCP.
The difference matters, and it is the reason the third category exists: one thing is counting how many sign-ups an advertisement brought, which is what we do if you give us permission, and quite another is following you around other sites or building a profile of you in order to show you advertising, which we do not do even with your permission.
If in the future we incorporate cookies of another type, we will update this policy and ask you for consent before installing them.
4. Cookies we use
4.1 Technical cookies (they do not need your consent)
| Name | Owner | Purpose | Duration |
|---|---|---|---|
session |
First-party (Crisol MCP) | Dual function: (a) carrying the token that protects our forms against cross-site request forgery (CSRF) attacks, and (b) keeping you signed in to the panel after entering, whether with the magic link we send you by email or with your password if you have activated it. The protected forms are detailed just below this table | 8 hours |
crisol_consent |
First-party (Crisol MCP) | Remembering the decision you made about cookies, so as not to ask you again on every visit | 24 months maximum |
About the session cookie and why you sometimes see it without having signed in. This cookie is also installed for visitors who do not have an account, but only on the pages that display a protected form (the home page, the waiting list, the sign-in screen, the magic-link confirmation screen and the contracting screen), because it is the act of generating that form's security token that creates the session. If you browse pages without a form — for example, this very policy or the pricing page — it is not installed. It is a cookie strictly necessary to provide you with the service you are requesting, which is submitting that form securely.
Technical details of the first-party cookies. Both are configured with the Secure (they only travel over HTTPS), HttpOnly (they are not accessible from JavaScript) and SameSite=Lax attributes. The session cookie is set to the crisolmcp.com domain, so that it works both on the main domain and on mcp.crisolmcp.com; the consent one is host-only, that is, it is not shared with subdomains. The session travels signed within the cookie itself, it is not stored on our server.
We do not use any other technical cookie: there are no preference cookies (language, visual theme) or infrastructure cookies. We have verified this by measuring the actual server responses, including our content delivery network (Cloudflare), which in this configuration does not install any.
4.2 Analytics cookies (only if you accept them)
| Name | Owner | Purpose | Duration |
|---|---|---|---|
_ga |
Distinguishing one browser from another by means of a pseudonymous identifier, in order to count distinct visitors | 24 months maximum | |
_ga_<our measurement property identifier> |
Retaining the state of the Google Analytics 4 session. The exact identifier is visible among the cookies installed in your browser | 24 months maximum |
What data they collect and what for. A pseudonymous browser identifier (not a name or an email), the pages you visit and in what order, where you arrived at the Site from, your approximate location derived from your IP address (country, region and city, never an exact address) and the characteristics of your device and browser. None of this data includes your name, your email or anything that directly identifies you. We use them solely to know where you visit us from, which content proves useful and which parts of the Site are worth improving.
This data is retained in Google Analytics for 14 months, a period that allows us to compare the evolution of the site over a full annual cycle. Once that period has elapsed, Google deletes it automatically.
Who receives it. Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) acts as data processor on our behalf, under Google's Data Processing Terms. You can consult the details of this transfer in point 5 of our Privacy Policy.
4.3 Advertising measurement (only if you accept it)
This category does not install any additional cookie today. We have verified this by measuring it with a real browser against our own site: with the configuration we use, accepting it adds neither a first-party nor a third-party cookie.
What it does is authorize the measurement that Google Analytics already carries out to be attributed to an advertisement: it makes it possible to recognize that this browser arrived from one of our Google advertisements and that the visit ended in a sign-up. Without that authorization, that relationship is lost and we do not know which advertisements work.
What it does not authorize, even if you accept it: you are not shown personalized advertising, you are not included in remarketing audiences, no data of yours is sent to Google to match you with other accounts, and Google Signals is not enabled. All of that is disabled in our configuration regardless of what you decide.
If this were ever to change and we incorporated techniques that do install advertising cookies, we would update this policy and ask you for permission before doing so, as we say in point 3.
A practical warning: accepting advertising measurement without accepting analytics has no effect whatsoever, because the measurement travels within the analytics one. If you want the former to work, you need to accept the latter as well.
5. Before you accept, nothing is installed
When you enter for the first time, there is no cookie from either of the two optional categories in your browser and no data is sent to Google, not even anonymously. It is not that Google's tags load and wait for your decision: it is that the page we send you does not contain them at all. The decision is made by our server before building the page, not by your browser after receiving it.
As an additional measure, those pages are served with a content security policy (Content-Security-Policy) that prevents the execution of any external script, so that even if someone tried to inject the tag, your browser would block it.
6. How to accept, refuse and change your mind
The first time you enter you will see a notice with two buttons, Refuse and Accept, identical in size and appearance: refusing costs you exactly the same as accepting, a single click, and neither of the two options is highlighted over the other.
If you prefer to decide in more detail, the notice gives you access to the "Configure your cookies" panel, where you will see the three categories:
- Technical cookies — marked as always active, because without them the Site does not work and they are exempt from consent.
- Analytics cookies — you can freely enable or disable them.
- Advertising measurement cookies — you can freely enable or disable them, independently of the previous one.
From there you can use Refuse all, Accept all or Save preferences with whichever combination you choose.
You can change your mind whenever you want, and it is as easy as it was to decide the first time. Once you have decided, you will always see a small button at the bottom labeled "Cookies", which opens that same panel again. You have it at hand while you browse the site; it is only missing from the cookie preferences screen itself, where that panel is already in front of you, and from the sign-in to your account and its private panel. And on the pages that have a footer you will also find the "Cookie preferences" link, which leads to the same place. If you withdraw your consent, whether for one category or for both, we stop applying it immediately; the cookies already in your browser can be deleted from its settings, as explained in point 10.
If you refuse, the Site works normally. No feature is limited, nor access to any content, nor the possibility of contracting the Service. Refusing has no consequence whatsoever for you.
7. Validity of your decision
Your decision has a maximum validity of 24 months. Once that period has elapsed we will ask you again, even if you had already answered before. We will also ask you again, without waiting for that period, if the purposes for which we use cookies change or if we substantially modify this policy.
8. Record of your decision
In order to be able to demonstrate that we respect your choice, we keep a record of each decision on our server. That record contains a random identifier for the decision, the date and time, the version of this policy in force at that moment, the categories you accepted, the language and where you decided from (the initial notice or the preferences panel), as well as the withdrawal date if at any point you change your mind.
We do not store your IP address, or your browser, or any other data that would make it possible to identify you. The identifier is random and is not linked to your customer account, if you have one. The crisol_consent cookie in your browser only carries that identifier and the decision, so that we can show you the pages without consulting the record on every visit.
We retain this record for 36 months from the decision, after which it is automatically deleted. That period covers the 24 months of validity of the consent plus the time during which we may still be required to demonstrate that we obtained it correctly. If you withdraw your consent, the record is not deleted at that moment: the withdrawal date is noted and it is retained for the same period, because we need to be able to demonstrate both that you consented and that we acted on your withdrawal. The legal basis for this specific processing is compliance with a legal obligation (Articles 6(1)(c) and 7(1) GDPR).
9. Browser local storage (not a cookie, but we inform you anyway)
| Item | Purpose | Duration |
|---|---|---|
| Panel AI assistant conversation history | Enable the assistant's chat to work, storing the messages solely in your browser (not on our servers) | Automatically deleted every 24 hours |
10. How do I manage or delete these cookies from my browser?
In addition to the preferences panel in point 6, you can manage and delete cookies from your browser settings. Bear in mind that if you delete or block the technical cookies you may not be able to stay signed in or some forms may stop working correctly.
- Chrome: Settings → Privacy and security → Cookies
- Firefox: Options → Privacy & Security → Cookies and Site Data
- Safari: Preferences → Privacy → Manage Website Data
- Edge: Settings → Cookies and site permissions
For the two optional categories you also have two Google resources available:
- The Google Analytics opt-out browser add-on, which prevents Google Analytics from collecting data on any website you visit. Since our advertising measurement travels within the analytics one, this add-on also covers that second purpose.
- Google's privacy policy, where you can consult how Google processes this information.
11. Changes to this policy
If the type of cookies we use or the purposes for which we use them change, we will update this document and ask you for consent again before installing anything new. The version in force will always be the one published on this page, and the date of its last update appears at the foot.
If you have any questions about this policy, write to us at privacidad@crisolmcp.com.
This is a courtesy translation of the Spanish original. In the event of any discrepancy, the Spanish version published at https://crisolmcp.com/legal/cookies prevails.