Cookie policy

The site is available in Spanish and English. On your first visit we detect the language from the settings your browser sends, without storing any cookie.

If you select a language manually, we store that choice in a cookie named `NEXT_LOCALE` so we can honour it on later visits. It is a technical cookie: it holds only a two-letter language code, lasts one year, and is not used to identify you, profile you, or share information with third parties.

Submitting the contact form requires a check on the origin of the request. This is part of how the site works and is not used to identify or profile visitors.

Only if you sign in to the client area, the API server (api.xdatacore.com) stores a technical cookie named `xdc_refresh` that keeps your session open. It is strictly necessary for that service: it is HttpOnly (no script can read it), travels only over HTTPS to the API itself, lasts at most 14 days and is deleted when you sign out.

The sign-in page offers "Sign in with Google". Only on that page do we load Google’s sign-in component (Google Identity Services), which communicates with Google and may use Google’s own cookies under Google’s privacy policy. No other page of the site loads it.

When enabled, the "Work with us" page loads Cloudflare Turnstile to check that the form is sent by a person. It is loaded only on that page, is not used for advertising, and Cloudflare processes the necessary technical data under its own privacy policy.

The free QR code generator page (`/qr`) shows Google AdSense ads, which is what lets us offer the generator at no cost. No other page on the site loads them.

The ads are not personalised: Google Consent Mode’s advertising signals (`ad_storage`, `ad_user_data` and `ad_personalization`) are always sent as denied, so Google neither writes nor reads advertising cookies and does not use your history to choose the ad. To show the ad, count it and prevent fraud, Google receives the technical data inherent to any web request (IP address, browser and page) and processes it under its own privacy policy.

The link or text you type in the generator is never sent to Google or to our servers.

We use Google Analytics 4, integrated through Firebase, to learn which pages are visited and which content is useful. The service is provided by Google, acting as a processor on our behalf.

Measurement runs in one of two modes, depending on your choice, using Google Consent Mode. Until you accept it, storage is denied: no measurement cookie is written, no identifier is generated, and only aggregate measurements are sent, which cannot recognise you across pages or across visits. Those requests do include the IP address and the page visited, because both are inherent to any web request, and Google does not retain them in a form that can identify you.

If you accept measurement, two cookies are written on this domain. Neither holds your name, your email address, or anything else you have given us:

On your first visit we show a notice with two options: accept measurement, or continue without cookies. Neither is emphasised over the other, and both dismiss the notice.

You can change your decision at any time from the "Measurement preferences" link in the footer, which reopens the notice and states which option is currently in effect. The change applies immediately, with no page reload.

If you withdraw consent, we stop using the `_ga` and `_ga_KQB4DXM976` cookies and also delete any that had been written from your browser.

Your decision is stored in your browser’s local storage under the key `xdc-analytics-consent`, together with the date you made it. It is not a cookie: it is never sent with a request, and it stays until you clear this site’s data.

We set no advertising or remarketing cookies, and we embed no social networks, maps, videos or other third-party resources that use them, with the sole exceptions of Google sign-in on the client-access page, the anti-spam check on "Work with us" when enabled, and the non-personalised ads on the QR generator, described above. Google Consent Mode’s advertising signals (`ad_storage`, `ad_user_data` and `ad_personalization`) are always sent as denied, whatever you answer.

We also do not sell or pass browsing data to third parties, and we do not build profiles for advertising targeting.

You can configure your browser to block or delete cookies, and you can clear this site’s data at any time. If you delete the language cookie, the site will simply detect the language from your browser settings again. If you delete the record of your measurement decision, we will ask again, and until you answer, measurement keeps running without cookies.

Google also offers a browser opt-out add-on that stops Google Analytics from collecting data on any website that uses it.