Italiano
EnglishCookie Policy and tracking technologies
Which cookies and similar tools we use on supportfast.ai and app.supportfast.ai, what they are for, how to manage them and how to withdraw consent at any time.
Contents
- What cookies are
- Data controller
- Categories of cookies
- Technical cookies
- Analytics cookies
- Marketing cookies
- Third-party embeds
- Analytics in the console
- 8 bis. Widget on Customers’ websites
- Consent management
- Disabling cookies in your browser
- Transfers outside the EU
- Data subject rights
- Changes
- Contacts
This Cookie Policy describes the cookies and similar tracking technologies (web beacons, pixels, device identifiers, local storage) used by Stepcode SRL on the websites supportfast.ai and app.supportfast.ai. It is drawn up pursuant to Article 122 of Italian Legislative Decree 196/2003 and to the measure of the Italian Data Protection Authority of 10 June 2021 on cookies.
This document supplements the Privacy Policy and should be read together with it for the full picture of the processing carried out.
1.What cookies and similar tools are
Cookies are small text files that the websites you visit save on your device to store information useful to their operation and to your preferences, or for statistical and marketing purposes. They may be set by the site visited (first-party cookies) or by third-party domains through embedded content (third-party cookies).
Tools similar to cookies
In addition to traditional cookies, technologically different tools performing similar functions may be used on our sites. The rules on consent apply to those tools as well.
- Local Storage and Session Storage: storage areas in the browser used to save preferences and session state.
- Pixels and web beacons: transparent images used to record the opening of a page or an e-mail.
- Device identifiers: unique strings associated with the browser or device.
- Fingerprinting: a recognition technique based on the combination of device characteristics. Stepcode does not use fingerprinting.
Where this document refers generically to “cookies”, the term should be understood as also covering the similar tools listed above, unless otherwise specified.
2.Data controller
The controller of the data collected through cookies is Stepcode SRL, having its registered office at Via Valpolicella 238, 37015 Sant’Ambrogio di Valpolicella (VR), Italy, VAT IT05205700239.
For any request relating to cookies or to the exercise of rights under the GDPR, please write to info@supportfast.ai.
3.Categories of cookies used
Under the Italian Data Protection Authority’s Guidelines of 10 June 2021, cookies fall into three categories which are treated differently as regards consent.
- Technical cookies (Cat. 1): necessary for the operation of the site or for the provision of a service expressly requested by the user. No prior consent required.
- Analytics cookies (Cat. 2): used to collect statistics on the use of the site. Prior consent required, save where the data is anonymised and under the controller’s exclusive control.
- Profiling and marketing cookies (Cat. 3): used to track the user in order to build profiles and display targeted advertising. Prior consent is always required, and must be freely given, specific and informed.
4.Technical cookies
Technical cookies are necessary for the proper operation of the site and the console and for the provision of the service requested by the user. Pursuant to Article 122 of Italian Legislative Decree 196/2003, the use of these cookies does not require prior consent.
The sites supportfast.ai and app.supportfast.ai use technical cookies strictly necessary for operation (user session management, authentication in the console, protection against CSRF attacks, storage of language and theme preferences, storage of the choices expressed by the user on the consent banner). These cookies are first-party, last only for the session or for the periods strictly necessary, and are not used for profiling or marketing purposes.
5.Analytics cookies
Analytics cookies are used to collect aggregate information on the number of visitors, the most viewed pages and browsing behaviour, in order to improve the site and its content. They require the user’s prior consent and are enabled only after that consent has been obtained through the banner.
5.1 Google Analytics 4 and Google Tag Manager
Third party: Google Ireland Ltd., privacy policy.
Statistical analysis service provided by Google, integrated through Google Tag Manager. GTM does not set profiling cookies directly but manages the loading of other tags. IP address anonymisation is enabled for Google Analytics 4.
| Name | Purpose | Duration |
|---|---|---|
_ga |
Distinguishes unique users by assigning a random identifier | 2 years |
_ga_<ID> |
Persists the GA4 session state for the specific container | 2 years |
5.2 PostHog
PostHog Inc., EU region (Frankfurt), privacy policy.
Product analytics tool used both on the public website supportfast.ai and within the console app.supportfast.ai. It collects usage events (clicks, navigation, features used) to analyse aggregate user behaviour, improve the product and identify usability problems. Configured in the EU region: the data remains in European territory. Data is processed in pseudonymised form and the IP address is truncated. For users authenticated in the console, PostHog acts as a processor for Stepcode (see the sub-processors page).
| Name | Purpose | Duration |
|---|---|---|
ph_<projectKey>_posthog |
PostHog device identifier for event tracking | 1 year |
ph_current_project_token |
Token of the PostHog project in use | 1 year |
5.3 Microsoft Clarity
Microsoft Ireland Operations Ltd., privacy policy.
Behaviour analysis tool provided by Microsoft, used exclusively on the public website supportfast.ai. It records heatmaps and anonymised sessions (with automatic masking of sensitive content) in order to improve usability. Microsoft acts as an independent controller and may also use the data for its own purposes, in accordance with Microsoft’s privacy statement.
| Name | Purpose | Duration |
|---|---|---|
_clck |
Persists the user’s Clarity ID | 1 year |
_clsk |
Links multiple page views into a single session | 1 day |
CLID |
Clarity identifier | 1 year |
MUID |
Identifies unique Microsoft users | 1 year |
SM |
MUID synchronisation across Microsoft domains | Session |
6.Marketing and profiling cookies
Marketing cookies track the user’s activity on our site and on other sites in order to build a profile and display relevant advertisements. They always require the user’s prior, freely given, specific and informed consent.
6.1 Meta Pixel (Facebook)
Meta Platforms Ireland Ltd., privacy policy.
Tracking pixel provided by Meta which makes it possible to measure the effectiveness of advertising campaigns on Facebook and Instagram and to create custom audiences for retargeting.
| Name | Purpose | Duration |
|---|---|---|
_fbp |
Identifies the browser in order to deliver advertising on Facebook | 3 months |
_fbc |
Stores the last click that led to the site | 2 years |
fr |
Facebook’s principal advertising cookie (facebook.com domain) | 3 months |
tr |
Conversion tracking pixel | Session |
7.Cookies from embedded third-party content
The website supportfast.ai embeds third-party content and functionality which, once loaded, may set their own cookies on the user’s device. Activation is subject to the user’s consent, where required.
7.1 Stripe (checkout and payments)
Stripe Payments Europe Ltd., privacy policy.
Stripe handles payments for the service. The cookies are used to prevent fraud and ensure the security of transactions. As this is a security function essential to the provision of the service requested by the user, these cookies are treated as technical cookies once the user initiates a payment.
| Name | Purpose | Duration |
|---|---|---|
__stripe_mid |
Uniquely identifies the device for fraud prevention | 1 year |
__stripe_sid |
Identifies the current payment session | 30 minutes |
7.2 Calendly (demo booking)
Calendly LLC, privacy policy.
Booking tool used to schedule demos and meetings with the sales team. When the user opens the booking widget, the supplier may set cookies to maintain the state of the booking.
| Name | Purpose | Duration |
|---|---|---|
_calendly_session |
Persistence of the Calendly session during booking | 21 days |
__Host-_calendly_session |
Session security token (secure variant) | 21 days |
7.3 Wistia (embedded video)
Wistia, Inc., privacy policy.
Tutorial and demonstration videos are hosted on Wistia and embedded through its player. When the user starts playing a video, Wistia sets cookies to store playback preferences and video quality and to generate aggregate viewing statistics.
| Name | Purpose | Duration |
|---|---|---|
wistia |
Stores preferences and settings of the Wistia player | 1 year |
wistia-video-progress-<id> |
Stores the playback position of individual videos | 1 year |
8.Analytics in the console app.supportfast.ai
Within the authenticated console, in addition to technical cookies, PostHog is active in order to analyse aggregate use of the product’s features. PostHog acts as a processor for Stepcode under Article 28 GDPR and is configured in the EU region (Frankfurt). Details are on the sub-processors page and in the DPA.
8 bis.The Supportfast widget on Customers’ websites
The Supportfast chat widget is deployed on Customers’ websites as an iframe served from the domain app.supportfast.ai. It follows that the technical elements necessary for the chat to function are written by the browser to the app.supportfast.ai origin, and not to the domain of the site hosting the widget.
The server response that loads the widget does not set any cookie. The elements used are limited to browser local storage (localStorage and sessionStorage) on the origin indicated above:
| Category | Purpose | Duration |
|---|---|---|
| Technical session and conversation identifier | Maintaining continuity of the conversation from one message to the next and across page reloads, associating responses with the correct session | Session storage: until the browser tab is closed. Local storage: until the user clears the site’s data |
| Technical error diagnostics | Correlating application errors to ensure the stability of the service, without identifying the user and without conversation content | Until the browser tab is closed |
These are exclusively strictly necessary technical tools for providing the chat service that the user requests by opening the widget. They are not used for profiling, do not track the user across third-party sites and do not feed advertising purposes: they therefore fall within the consent exemption provided for by Article 122 of Italian Legislative Decree 196/2003 and by the Italian Data Protection Authority’s Guidelines of 10 June 2021, without prejudice to the obligation to provide information.
Customers installing the widget are required to account for it in their own cookie notice. The current list of the specific keys written by the widget, with their precise duration, is provided by Stepcode on request by writing to info@supportfast.ai.
9.Consent management
On first access to supportfast.ai and app.supportfast.ai, the user is shown a consent banner allowing them to:
- Accept all cookies (technical, analytics, marketing).
- Reject non-technical cookies with a single click, immediately visible and given equal prominence to the accept button.
- Customise their choices by category of cookie.
The banner is operated through a consent management platform (CMP) compliant with the Italian Data Protection Authority’s Guidelines of 10 June 2021.
Characteristics of consent collection
- Consent is freely given, specific and informed: there is no “blanket” consent and no consent by scrolling.
- Until consent is given, only technical cookies are enabled.
- If the user closes the banner without expressing a choice, this is treated as a refusal of non-technical cookies. The banner is not shown again for at least 6 months, save in the event of substantial changes to the conditions.
- Consent may be withdrawn at any time as easily as it was given, through the “Change preferences” link at the foot of every page and at the start of this Cookie Policy.
- Consent is requested again every 6 months or when substantial changes occur.
Refusing non-technical cookies does not affect access to the site or the use of essential services. Certain ancillary features (embedded video, browsing statistics, advertising retargeting) may be unavailable or reduced.
10.How to disable cookies in your browser
Irrespective of the choices expressed on the banner, users may configure their browser to accept, reject or delete cookies. Links to the official instructions for the main browsers:
- Google Chrome: support.google.com/chrome/answer/95647
- Mozilla Firefox: support.mozilla.org
- Safari (macOS): support.apple.com
- Safari (iOS): support.apple.com/HT201265
- Microsoft Edge: support.microsoft.com/edge
- Opera: help.opera.com
For advertising cookies, behavioural advertising preferences can also be managed through the YourOnlineChoices platform (EDAA) or, for United States suppliers, through NAI and DAA.
11.Transfers of data outside the European Union
Certain third-party cookies are set by suppliers that may process data outside the European Economic Area (EEA), principally in the United States. Such transfers take place on the basis of appropriate safeguards under Chapter V of the GDPR:
| Supplier | Transfer basis |
|---|---|
| Google (GA4, GTM) | EU-U.S. Data Privacy Framework (DPF) + SCC |
| Meta (Pixel) | EU-U.S. Data Privacy Framework (DPF) + SCC |
| Microsoft (Clarity) | EU-U.S. Data Privacy Framework (DPF) + SCC |
| PostHog | Intra-EU (Frankfurt) |
| Calendly | Standard Contractual Clauses (SCC) |
| Wistia | Standard Contractual Clauses (SCC) |
| Stripe | SCC + DPF |
The DPF certification status of individual United States suppliers can be verified on the official register at dataprivacyframework.gov.
12.Data subject rights
In relation to the processing carried out through cookies, users may exercise at any time the rights laid down in Articles 15 to 22 GDPR: access to the data collected, rectification and erasure, restriction of processing, objection to processing, withdrawal of consent, and the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).
To exercise these rights, write to info@supportfast.ai. For full details please refer to the Privacy Policy, Section 12.
13.Changes to this Cookie Policy
Stepcode SRL reserves the right to update this Cookie Policy to reflect changes in the cookies used, regulatory developments or supplier updates. The version in force is always available on this page, with the date and version number shown prominently in the header.
In the event of substantial changes (e.g. the introduction of new categories of cookies or new third-party suppliers), the consent banner is shown to the user again in order to obtain fresh express consent.
14.Contacts
- Controller: Stepcode SRL, Via Valpolicella 238, 37015 Sant’Ambrogio di Valpolicella (VR), Italy
- VAT: IT05205700239
- Data protection e-mail: info@supportfast.ai
- Certified e-mail: stepcode@pec.it