Cookie policy
Updated 8 October 2026
Operator: Moflet AI S.L. · NIF B73210072 · Paseo de la Castellana, 91, 28046 Madrid · [email protected]
Moflet AI uses essential cookies so the platform works (session and sign-in security) and to remember your cookie preference. Only if you accept analytics cookies do we also use HubSpot tracking cookies on public pages, to measure website use and know which channel contacts come from. Processing detail is in the Privacy policy.
Essential cookies
Required for the service or to store your cookie choice. They do not need marketing consent.
- Authentication session (NextAuth): keeps your session after you sign in with Zitadel or, in development, with a local token. It is httpOnly and expires with the session or when you sign out. Provider: Moflet AI.
- CSRF / OIDC / PKCE: temporary cookies in the sign-in flow that protect the identity provider's return. They are removed when login completes. Provider: Moflet AI.
moflet_consent: stores your analytics cookie preference (granted or denied). Duration: 6 months (180 days). Provider: Moflet AI (first-party). Not a HubSpot cookie.
Analytics / tracking (require consent)
These are set only after you accept analytics cookies in the banner, and only on public pages (never on /app, /login, or /invite). The HubSpot script (https://js-eu1.hs-scripts.com/149484340.js, EU1 portal) loads only with your consent and when tracking is enabled in the environment. If tracking is off, these cookies do not appear.
| Name | Purpose | Duration | Provider |
|---|---|---|---|
__hstc | Main visitor tracking | 6 months | HubSpot |
hubspotutk | Visitor identity (GUID) to deduplicate contacts | 6 months | HubSpot |
__hssc | Session tracking | 30 minutes | HubSpot |
__hssrc | Detect browser restart / new session | End of session | HubSpot |
How to manage them
You can block or delete cookies in your browser settings. If you block the essential cookies, sign-in will stop working. For analytics, change your preference in the site cookie banner (or delete moflet_consent and reload so the banner appears again).
More on personal data in the privacy policy.