Cookie and storage statement

Der Dokumententext ist auf Englisch. Eine Übersetzung folgt.

Version 2026-10

1. In short

• Necessary cookies keep you signed in to the app (dashboard.azimea.com) and remember your choices, including your choice about cookies. Under Article 5(3) of the ePrivacy Directive and Article 4 paragraph (6) of Romanian Law 506/2004, storage that is strictly necessary to provide a service you asked for needs no consent. They are always on.
• Statistics (Azimea Analytics and Google Analytics) and advertising (Google Ads) are used only if you agree. Until you choose, and if you refuse, no detailed Azimea events are sent and Google’s scripts are not loaded.
• We count requests for published site pages on our server without a visitor identifier, IP address, full URL or raw referrer in the traffic report. This count includes visits without analytics consent and can still include automated requests we fail to recognise.
• When you first visit, a short note asks you to choose: accept all, refuse all, or choose per category. Refusing is as easy as accepting. You can change your mind at any time from Cookie settings (in the footer of azimea.com and in the account menu of the app). The note comes back after six months, and whenever this statement changes.
• docs.azimea.com uses no cookies, analytics or advertising tools. The fonts on all our sites are served by us.

2. Cookies

Necessary (always on)

The record of your choice. Each time you choose, we keep a record of it, as the GDPR asks us to be able to show that a consent was given: the random id from the azimea_consent cookie, the version of this statement, your answer for statistics and for advertising, whether you chose on azimea.com or in the app, and the time. It does not include your IP address, your browser or anything else that identifies you, and it is deleted after 12 months.

Statistics (only with your consent)

Azimea Analytics records the public page path (without URL parameters), the time, a random session ID, the random ID in your consent cookie, a limited traffic-source and medium category, an optional campaign slug, and an explicit event such as a page view, a submitted lead form, an account creation or an activated subscription. App conversions use fixed event paths, not the address of the account page or its query. It does not record form contents, email addresses, IP addresses or full referrers. The session ID and source are kept in session storage for the browser tab and removed when statistics consent is withdrawn. We use these records to count consenting browsers, sessions, pages and conversions. They are deleted from our database after 90 days.

Separately, our web server counts successful requests for published pages by page, minute and limited source category. The reduced access log contains no visitor ID, IP address, cookie, full URL or raw referrer and is rotated within 48 hours; minute totals are retained for 2 days and daily totals for 90 days. We exclude recognisable bots from human totals.

We use Google Analytics 4 to count visits to azimea.com, see which pages are read and which sources and campaigns bring visitors, and to count sign-ups and purchases of a plan. Besides page views, it records a few interactions on the page: how far you scroll, clicks on links to other sites, searches on the site, file downloads, embedded videos played and forms started or sent (never what you type in them). What it receives: the page and the page you came from, the campaign in the link, the browser, device and screen size, an approximate location (country and city, derived from the IP address, which Google Analytics does not store for visitors in the EU) and a random identifier kept in the cookies below.

We switched off Google signals and the use of these data for advertising personalisation, and we do not share them with Google for its own purposes (the account’s data sharing settings are off, except access by Google’s technical support when we ask for help). Google Analytics keeps the events for 14 months, then deletes them; reports keep only aggregated figures.

Advertising (only with your consent)

We use Google Ads to measure whether our ads bring sign-ups and purchases (conversions), and to show our ads to people who visited azimea.com (remarketing).

Without a cookie. When you click a link on the page you landed on to create an account, the campaign of that visit travels in the link itself (src=), with no cookie and whatever your choice. When you sign up, we keep with your company where it came from (the first and the last campaign or site before the sign-up) to measure our own marketing; Google’s click id is deleted from our records after 90 days.

Where Google tags load. On azimea.com, on every page after you agree. In the app, only at the moment you create an account and when you pay for a plan, to count that event; the rest of the app, and the data you keep in it, are never sent to Google.

Google as a recipient. Google Ireland Limited processes these data for us; some may be transferred to Google LLC in the United States, which is certified under the EU-US Data Privacy Framework. For advertising measurement Google also acts on its own behalf, as described in Google’s privacy policy and in how Google uses information from sites. (under verification)

3. Browser storage in the app

These keys are read only by the app inside your browser, to show your language, theme and layout. They exist because of a choice you made in the app (you chose the language, hid a column or dismissed a notice) and are used for nothing else. (under verification)

4. Emails sent through Azimea

When our customers send emails through the Service, an email can contain (a) an invisible image (a “tracking pixel”) that tells the sender whether and when the email was opened, and (b) links that pass through our tracking server that tell the sender whether a link was clicked. These are not cookies, but under the EU ePrivacy Directive (Article 5(3)) and the national laws that implement it, loading such an image or following such a link can count as accessing information on the recipient’s device. Whether the sender needs the recipient’s consent depends on the country and on the purpose. The French data protection authority, for example, expects consent for open tracking in marketing emails.

For each open or click we record the time, the link and the browser identification string. We do not store the IP address on that record. We mark opens that look like automatic loading by mail programs or scanners (“machine opens”) so that statistics are not inflated. After 25 months the browser identification and the link to the person are removed from old records, which remain only as anonymous counts.

Who decides. Our customer, the sender, decides whether to use tracking, tells its recipients about it and asks for consent where the law requires it. We act on the sender’s instructions. The Service lets the sender, for the whole workspace, switch tracking off, measure only the people who agreed, or measure everyone except those who said no, and switch click counting off on its own; the sender passes on the consent it collected. (under verification) For our own purposes (protecting the shared sending reputation and detecting abuse) we use delivery results and complaint data, as the Privacy policy describes.

Links that a recipient uses to manage their own subscription (unsubscribe and preference links) are personal to the recipient, always signed, and used only to carry out the choice the recipient makes.

If you receive an email sent through Azimea and do not want it tracked, ask the sender (named in the email), or use the “do not measure me” link in the footer of every email that measures. You can also block remote images in your mail program, which stops the pixel from loading. Some customers use web fonts, which makes the recipient’s email program contact the font provider.

5. Our customers’ own shops

If a customer installs the Azimea plugin or script on its shop, it stores a cart token in the visitor’s browser (key azimea_cart_v1, or session storage on some platforms) so abandoned carts can be recovered. The token is sent to our servers, so the ePrivacy rules on storage and access apply. The customer decides to use it and is responsible for the cookie information and the visitor’s consent on its own shop. Our plugin documentation explains how to load the token only after consent (under verification). We do not use the token for any purpose of our own.

6. How to control cookies

Open Cookie settings in the footer of azimea.com or in the account menu of the app to change your choice; when you withdraw consent we delete the Google cookies set on our domain and stop loading Google’s scripts. Google’s own cookies on its domains can be managed in Google’s ad settings. You can also delete or block cookies in your browser. If you block the strictly necessary cookies, you cannot sign in.

7. Contact

Questions: privacy@azimea.com.

Drafting note for the lawyer: azimea.com and the app now ask for consent for Google Analytics 4 and Google Ads (Consent Mode v2, basic implementation: Google’s script is not loaded at all before consent). The note offers “Accept all” and “Reject all” with equal weight and a per-category choice; “Cookie settings” is in the footer and in the app’s account menu. Open questions: (1) is azimea.auth, renewed for up to 14 days, strictly necessary without a “keep me signed in” choice (WP29 Opinion 04/2012)? (2) do the persistent localStorage preferences need more than the sentence in section 3? (3) Italy’s Garante (April 2026) allows an anonymised aggregate open rate without consent; the CNIL (April 2026) does not: which line does the Service follow for all EU recipients? (4) watch the Digital Omnibus (Article 5(3) into the GDPR) and the Romanian bill 256/2026. (5) the Privacy policy must name Google as a recipient and describe the transfer; is Google a processor (Analytics) and an independent controller (Ads remarketing), and is the Google Ads Data Processing Terms acceptance enough? (6) settled 2026-10-12: the consent cookie lasts 6 months (the CNIL’s recommendation, Stripe’s practice; Brevo, MailerLite, Omnisend and Mailchimp keep 12-13 months), and each choice is logged without IP or browser data for 12 months as proof of consent (Art. 7(1) GDPR).