Cookie Policy.
Last updated: October 15, 2026
This notice explains how ilcartaista.com, operated by Nexa Media Group S.r.l. (data controller — Via dei Normanni 30/1, 84085 Mercato San Severino (SA), Italy, tax code and VAT no. 06390400650, privacy@nexamediagroup.it), uses cookies and similar technologies under Article 122 of Legislative Decree 196/2003, the Italian Data Protection Authority’s guidelines on cookies and other tracking tools of June 10, 2021, Regulation (EU) 2016/679 and, for users in Switzerland, Article 45c of the Federal Telecommunications Act and the nFADP.
1. What cookies are
Cookies are small text files that the website stores on a user’s device. Similar technologies (local storage, pixels and device identifiers) work in a comparable way and are treated in the same way in this notice.
2. How we collect consent
On your first visit, the iubenda banner lets you accept all, reject all or customize your choices by purpose and, where available, by individual provider. Closing the banner keeps only the categories enabled by the selected settings. The Site’s analytics and advertising tags are configured to activate only after consent has been given for the relevant purpose.
You can change or withdraw your preferences at any time using the “Cookie preferences” link at the bottom of each page. The banner will not be shown again for six months unless there are significant changes to the processing or providers.
Consent is managed through iubenda Privacy Controls and Cookie Solution. Google Analytics 4 tags are linked to analytics, while Google AdSense and advertising and affiliate services are linked to marketing. They activate after the banner records your consent.
3. Cookies we use
3.1 Technical cookies (always active; consent not required)
| Name | Provider | Purpose | Duration |
|---|---|---|---|
| Session cookie | Il Cartaista (first party) | Keep the account signed in (HttpOnly, Secure, SameSite=Lax) | Length of the sign-in session |
_iub_cs-* | iubenda | Store the preferences selected in the banner | 1 year |
site_gate | Il Cartaista (first party) | Access to password-protected preview areas, when enabled | Session length |
ilcartaista_admin_theme (local storage) | Il Cartaista (first party) | Remember the light or dark theme chosen in the admin area | Until deleted |
ilcartaista:miles-partners:v1:*, ilcartaista:miles-tour:v2:* (local storage) | Il Cartaista (first party) | Remember the partner programmes chosen in the Miles Calculator and whether you have seen the tour | Until deleted |
| Stripe payment page | Stripe (checkout.stripe.com domain) | Only when you buy points or a plan: Stripe uses technical and anti-fraud cookies on its own domain, under its privacy policy | Set by Stripe |
| Cloudflare Turnstile | Cloudflare Inc. | Bot protection on the registration form; it does not set profiling cookies and processes only technical data and IP address | Duration of the verification |
3.2 Analytics cookies (consent required)
| Name | Provider | Purpose | Duration |
|---|---|---|---|
_ga | Google Analytics 4 | Distinguish users pseudonymously | 2 years |
_ga_<ID> | Google Analytics 4 | Maintain session state | 2 years |
Google Analytics 4 does not record or store the IP addresses of users in the European Union. Data is retained in the Analytics property for 14 months. Google Signals is disabled. Google Privacy Policy: policies.google.com/privacy
3.3 Advertising and profiling cookies (consent required)
| Name | Provider | Purpose | Duration |
|---|---|---|---|
__gads, __gpi | Google AdSense | Measure and limit ad frequency | 13 months |
__eoi | Google AdSense | Security and prevention of advertising fraud | 6 months |
IDE, DSID (domain doubleclick.net) | Personalized advertising and measurement | up to 13 months | |
| Variable advertising cookies and identifiers | Adsterra e Infolinks | Delivery, measurement and possible personalization of ads | Varies by ad and provider |
| Affiliate cookies and identifiers, including those set by stores | Skimlinks e network/negozi partner | Attribute clicks and purchases to affiliate links | Varies by partner and store |
| Cookies from other advertising providers | Providers that may be listed in the “Cookie preferences” panel | Advertising and measurement | Set by the individual provider |
Cookies from advertising and affiliate services may be set only after consent to the marketing purpose. Names and retention periods depend on the ads actually displayed, the browser and the partners involved. Policies: Google, Adsterra, Infolinks and Skimlinks. You can change your preferences using the “Manage cookie preferences” button.
3.4 Services without profiling cookies
- Google Search Console: used by the controller to verify site ownership and monitor indexing; it does not set cookies on users’ devices.
- Google Wallet: activated only when a user selects “Save to Google Wallet”; card data is sent to Google as described in the Privacy Policy.
- Maps and geocoding (OpenStreetMap / Nominatim): displaying maps sends the IP address to OpenStreetMap servers to load map tiles; no profiling cookies are set.
4. Il Cartaista app for iOS and Android
The app does not use advertising cookies or device advertising identifiers (IDFA/AAID) and does not track activity across third-party apps or websites, so it does not show the iOS tracking prompt. The app contains no Google Analytics, AdSense or other advertising SDKs: Community listings are internal content published by users.
To work, the app stores on the device, in the system’s secure storage (Keychain on iOS, Keystore on Android) or in local storage: the session token, the push notification token, notification and Face ID/Touch ID lock preferences, the offline list of recently viewed places, reminders you set, the programmes chosen in the Miles Calculator and the state of widgets and Live Activities. For in-app purchases, the RevenueCat SDK keeps the app user ID and purchase status on the device. These are technical tools necessary for the service you request and do not require consent; they are deleted when you sign out or uninstall the app.
In-app maps use Apple Maps on iOS and Google Maps on Android: loading a map sends the IP address and the area displayed to the relevant provider under its privacy policy. Device permissions (location, camera, photos, microphone and notifications) are described in the Privacy Policy and can be managed in your phone settings.
5. Browser controls
In addition to the Site’s controls, you can delete or block cookies in your browser settings (Chrome, Firefox, Safari or Edge). Blocking technical cookies may prevent you from signing in to your account.
6. Transfers and your rights
Some providers, including Google, Infolinks and Skimlinks, may process data in countries outside the EU/EEA under the safeguards described in their respective policies and the Site’s Privacy Policy. For information about your rights and how to contact the controller, please refer to the Privacy Policy. Questions: privacy@nexamediagroup.it.