Cookie Policy — Crisol MCP
1. Who is responsible for the use of these cookies?
- Owner: Sara Fernández Velasco
- NIF: 47528322H
- Contact for privacy matters: privacidad@crisolmcp.com
The full identifying details, including the address, are set out in the Legal Notice.
2. What are cookies and similar technologies?
Cookies are small text files that a website stores in your browser to remember information about your visit. This policy also covers similar technologies, such as browser local storage (localStorage), which serve an equivalent function even though they are not technically cookies.
3. What cookies do we use and which ones need your permission?
We use two types of cookies, and only one of them needs your consent:
- Technical cookies. They are essential for the Site to work: keeping you signed in and protecting forms against attacks. They are exempt from consent in accordance with Article 22(2) of the LSSI-CE (Spain's law on information society services and e-commerce), so we do not ask you about them: we only inform you that they exist, which is exactly what this document does.
- Analytics cookies. They are Google's, and they help us understand how the Site is used and improve it. These do need your permission, and they are not installed if you do not give it.
What we do not do. We do not use advertising, remarketing, social media or advertising profiling cookies. In our Google Analytics configuration, advertising features, Google Signals and ad personalization are disabled, and we do not send Google any identifier linking you to your customer account. The analytics data is never cross-referenced with your identity in Crisol MCP.
If in the future we incorporate cookies of another type, we will update this policy and ask you for consent before installing them.
4. Cookies we use
4.1 Technical cookies (they do not need your consent)
| Name | Owner | Purpose | Duration |
|---|---|---|---|
session |
First-party (Crisol MCP) | Dual function: (a) carrying the token that protects our forms against cross-site request forgery (CSRF) attacks — the contact form on the home page, the waiting list form and the sign-in form —, and (b) keeping you signed in to the panel after entering with the magic link we send you by email | 8 hours |
crisol_consent |
First-party (Crisol MCP) | Remembering the decision you made about cookies, so as not to ask you again on every visit | 24 months maximum |
About the session cookie and why you sometimes see it without having signed in. This cookie is also installed for visitors who do not have an account, but only on the pages that display a protected form (the home page, the waiting list, the sign-in screen and the contracting screen), because it is the act of generating that form's security token that creates the session. If you browse pages without a form — for example, this very policy or the pricing page — it is not installed. It is a cookie strictly necessary to provide you with the service you are requesting, which is submitting that form securely.
Technical details of the first-party cookies. Both are configured with the Secure (they only travel over HTTPS), HttpOnly (they are not accessible from JavaScript) and SameSite=Lax attributes. The session cookie is set to the crisolmcp.com domain, so that it works both on the main domain and on mcp.crisolmcp.com; the consent one is host-only, that is, it is not shared with subdomains. The session travels signed within the cookie itself, it is not stored on our server.
We do not use any other technical cookie: there are no preference cookies (language, visual theme) or infrastructure cookies. We have verified this by measuring the actual server responses, including our content delivery network (Cloudflare), which in this configuration does not install any.
4.2 Analytics cookies (only if you accept them)
| Name | Owner | Purpose | Duration |
|---|---|---|---|
_ga |
Distinguishing one browser from another by means of a pseudonymous identifier, in order to count distinct visitors | 24 months maximum | |
_ga_G4V3XE55JS |
Retaining the state of the Google Analytics 4 session in our measurement property | 24 months maximum |
What data they collect and what for. A pseudonymous browser identifier (not a name or an email), the pages you visit and in what order, where you arrived at the Site from, your approximate location derived from your IP address (country, region and city, never an exact address) and the characteristics of your device and browser. None of this data includes your name, your email or anything that directly identifies you. We use them solely to know where you visit us from, which content proves useful and which parts of the Site are worth improving.
This data is retained in Google Analytics for 14 months, a period that allows us to compare the evolution of the site over a full annual cycle. Once that period has elapsed, Google deletes it automatically.
Who receives it. Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) acts as data processor on our behalf, under Google's Data Processing Terms. You can consult the details of this transfer in point 5 of our Privacy Policy.
5. Before you accept, nothing is installed
When you enter for the first time, there is no analytics cookie in your browser and no data is sent to Google, not even anonymously. It is not that Google's tags load and wait for your decision: it is that the page we send you does not contain them at all. The decision is made by our server before building the page, not by your browser after receiving it.
As an additional measure, those pages are served with a content security policy (Content-Security-Policy) that prevents the execution of any external script, so that even if someone tried to inject the tag, your browser would block it.
6. How to accept, refuse and change your mind
The first time you enter you will see a notice with two buttons, Refuse and Accept, identical in size and appearance: refusing costs you exactly the same as accepting, a single click, and neither of the two options is highlighted over the other.
If you prefer to decide in more detail, the notice gives you access to the "Configure your cookies" panel, where you will see the two categories:
- Technical cookies — marked as always active, because without them the Site does not work and they are exempt from consent.
- Analytics cookies — you can freely enable or disable them.
From there you can use Refuse all, Accept all or Save preferences with whichever combination you choose.
You can change your mind whenever you want, and it is as easy as it was to decide the first time. Once you have decided, you will always see a small button at the bottom labeled "Cookies", which opens that same panel again. You have it at hand while you browse the site; it is only missing from the cookie preferences screen itself, where that panel is already in front of you, and from the sign-in to your account and its private panel. And on the pages that have a footer you will also find the "Cookie preferences" link, which leads to the same place. If you withdraw your consent, we stop installing analytics cookies immediately; those already in your browser can be deleted from its settings, as explained in point 10.
If you refuse, the Site works normally. No feature is limited, nor access to any content, nor the possibility of contracting the Service. Refusing has no consequence whatsoever for you.
7. Validity of your decision
Your decision has a maximum validity of 24 months. Once that period has elapsed we will ask you again, even if you had already answered before. We will also ask you again, without waiting for that period, if the purposes for which we use cookies change or if we substantially modify this policy.
8. Record of your decision
In order to be able to demonstrate that we respect your choice, we keep a record of each decision on our server. That record contains a random identifier for the decision, the date and time, the version of this policy in force at that moment, the categories you accepted, the language and where you decided from (the initial notice or the preferences panel), as well as the withdrawal date if at any point you change your mind.
We do not store your IP address, or your browser, or any other data that would make it possible to identify you. The identifier is random and is not linked to your customer account, if you have one. The crisol_consent cookie in your browser only carries that identifier and the decision, so that we can show you the pages without consulting the record on every visit.
We retain this record for 36 months from the decision, after which it is automatically deleted. That period covers the 24 months of validity of the consent plus the time during which we may still be required to demonstrate that we obtained it correctly. If you withdraw your consent, the record is not deleted at that moment: the withdrawal date is noted and it is retained for the same period, because we need to be able to demonstrate both that you consented and that we acted on your withdrawal. The legal basis for this specific processing is compliance with a legal obligation (Articles 6(1)(c) and 7(1) GDPR).
9. Browser local storage (not a cookie, but we inform you anyway)
| Item | Purpose | Duration |
|---|---|---|
| Panel AI assistant conversation history | Enable the assistant's chat to work, storing the messages solely in your browser (not on our servers) | Automatically deleted every 24 hours |
10. How do I manage or delete these cookies from my browser?
In addition to the preferences panel in point 6, you can manage and delete cookies from your browser settings. Bear in mind that if you delete or block the technical cookies you may not be able to stay signed in or some forms may stop working correctly.
- Chrome: Settings → Privacy and security → Cookies
- Firefox: Options → Privacy & Security → Cookies and Site Data
- Safari: Preferences → Privacy → Manage Website Data
- Edge: Settings → Cookies and site permissions
For analytics cookies you also have two Google resources available:
- The Google Analytics opt-out browser add-on, which prevents Google Analytics from collecting data on any website you visit.
- Google's privacy policy, where you can consult how Google processes this information.
11. Changes to this policy
If the type of cookies we use or the purposes for which we use them change, we will update this document and ask you for consent again before installing anything new. The version in force will always be the one published on this page, and the date of its last update appears at the foot.
If you have any questions about this policy, write to us at privacidad@crisolmcp.com.
This is a courtesy translation of the Spanish original. In the event of any discrepancy, the Spanish version published at https://crisolmcp.com/legal/cookies prevails.