Cookie Policy
Cookies and browser storage on castelo-ai.com
Last updated:
Summary
- Necessary: they keep you signed in, protect the site against bots and remember your language and your cookie choice. If you install the app, they also store its files so it opens quickly and tells you when you are offline. They are always on.
- Functional: they let Google offer you one-tap sign-in (Google One Tap) and let us remember how you last signed in. We only use them if you accept them.
- We use no measurement or advertising cookies.
- You can change your choice at any time in Cookie preferences, at the bottom of every page. We honor your browser’s Global Privacy Control signal.
1. What cookies and similar technologies are
A cookie is a small file a site keeps in your browser. Browsers also let sites keep data with similar technologies: local storage (localStorage), tab storage (sessionStorage), which is deleted when you close the tab, and the browser database (IndexedDB). In this policy we call all of them “cookies”, except where the difference matters.
First-party cookies are the ones Castelo keeps and third-party cookies are the ones another company, such as Google, sets or reads, even when they sit on our domain. Necessary cookies make the site work securely; functional cookies add conveniences you can refuse without losing any feature.
Today Castelo sets no first-party cookies on this site: what we keep is in your browser’s local storage. The only cookies are Google’s and are described below.
This policy applies to castelo-ai.com (while the domain move is completed, also to castelo-ai-prod.web.app) and complements the “Cookies, local storage and measurement” section of the Privacy Policy, which explains how we handle your personal data.
2. Which cookies we use
This is the complete list. For each one we say who sets it, what it is for and how long it lasts.
2.1 Necessary (always on)
Without them you could not sign in or send forms securely, so they cannot be turned off from the cookie banner. You can delete them from your browser (how).
| Name | Set by | Purpose | Duration |
|---|---|---|---|
| Firebase Authentication session (IndexedDB “firebaseLocalStorageDb”, key “firebase:authUser:…”) | Castelo, with Google’s Firebase Authentication as processor (first party) | Keeping you signed in so you do not have to sign in again. | Until you sign out |
| Sign-in in progress (sessionStorage: “firebase:pendingRedirect:…”, “firebase:redirectUser:…”, “castelo.auth.redirect”, “castelo.auth.draftEmail” and “castelo.auth.unavailable.…”) | Castelo (first party) | Completing a Google, Facebook or Microsoft sign-in: the provider you chose, the e-mail address you typed, so it is not lost, and which providers are not available yet. | Deleted when you close the tab |
| Sign-in domain (castelo-ai-prod.firebaseapp.com) | Castelo, with Google’s Firebase Authentication as processor (first party, on a technical domain) | The Google, Facebook and Microsoft sign-in window and frame keep temporary data there to bring you back to this site signed in. | While the sign-in completes |
| “castelo.auth.session” (localStorage) | Castelo (first party) | The value “1” when someone is signed in on this device, with no personal data; so we show “Abrir Castelo” (open Castelo) instead of “Entrar” (sign in) and do not offer you Google One Tap once you are signed in. | Until you sign out |
| “castelo.emailForSignIn” (localStorage) | Castelo (first party) | Your e-mail address, only while you complete an e-mail-link sign-in. | Up to 24 hours; sooner if the sign-in completes or you sign out |
| “castelo.auth.verifySent” (localStorage) | Castelo (first party) | Your account id and the time the confirmation e-mail was sent from this browser, so we can tell you “Te enviamos un enlace” (we sent you a link). | Up to 3 days, or until you sign out; every send replaces it |
| “castelo:chunk-reload-at” (sessionStorage) | Castelo (first party) | The time of the last automatic page reload after we publish a new version of the site, so the page is not reloaded over and over. No personal data. | Deleted when you close the tab |
| Installable app cache (service worker “/sw.js” and Cache Storage “castelo-static-<version>” and “castelo-pages-<version>”) | Castelo (first party) | Storing the site’s files (code, styles, icons and the “Sin conexión” (offline) page) and a copy of the pages you open, with no personal data, so the installed app opens faster and shows a clear page when you are offline. Only active if you install Castelo or open the app (/app) on this device. | Until the next version of the site, which deletes the previous one; at most 30 pages. Also deleted when you clear the site’s data |
| “castelo-locale” (localStorage) | Castelo (first party) | The language you chose for the pages. | Until you clear the site’s data |
| “castelo.consent” (localStorage) | Castelo (first party) | Your choice about functional cookies: the version of this policy, whether you accepted them, the date, how you decided (banner, preferences panel or Global Privacy Control signal) and whether your browser was sending that signal when you decided. | 12 months; then we ask again |
| App Check token (IndexedDB “firebase-app-check-database”) | Castelo, with Google’s Firebase App Check as processor (first party) | Proof that requests to sign-in and to the forms come from this site and not from an automated program. | Renewed automatically while you use the site; each token expires shortly |
| “_GRECAPTCHA” (cookie on www.google.com) and “_grecaptcha” (localStorage) | Google, as Castelo’s processor (third party) | reCAPTCHA Enterprise’s risk analysis, which tells people apart from automated programs. | The cookie, up to 6 months (set by Google); “_grecaptcha”, until you clear the site’s data |
| Firebase SDK log (IndexedDB “firebase-heartbeat-database”) | Castelo, with Google’s Firebase as processor (first party) | The days on which the Firebase SDK was used, to tell Google which versions the site uses. It contains no personal data. | The last 30 days of use, at most |
Firebase Authentication, App Check and reCAPTCHA only load on the sign-in pages (including the links we e-mail you), in the app (/app), including your account page, when you use Google One Tap and when you send the pilot request form.
2.2 Functional (only if you accept them)
They make the site more convenient. If you do not accept them, everything works the same: you can sign in with the “Continuar con Google” (Continue with Google) button or any other method.
| Name | Set by | Purpose | Duration |
|---|---|---|---|
| Google One Tap (script accounts.google.com/gsi/client and the “g_state” cookie on our domain) | Google, which runs its sign-in as an independent controller (third party) | Offering you one-tap sign-in with your Google account. To show the prompt, Google recognizes your Google session through its own cookies; “g_state” keeps the state of the prompt, for example whether you closed it, so it is not shown again for a while. | “g_state”, up to 6 months (set by Google) |
| “castelo.auth.lastMethod” (localStorage) | Castelo (first party) | The last method you used to sign in on this device (for example, “google”), to mark it as “Último usado” (last used). No personal data. | Until you withdraw your consent or clear the site’s data |
Until you decide, functional cookies are off and we do not load the Google One Tap script. If you withdraw your consent, we delete “castelo.auth.lastMethod” and the “g_state” cookie from your browser, close the Google One Tap prompt and stop loading its script. The cookies Google keeps on its own domains are managed in your Google account or your browser.
2.3 Measurement and advertising
We use no measurement, analytics or advertising cookies or technologies, and no social media pixels. If we ever add them, we will first update this policy and ask for your choice in the cookie banner.
3. How to decide
The first time you visit the site we show you a banner with three options with the same styling: “Aceptar todas” (accept all), “Solo necesarias” (necessary only) and “Configurar” (customize). The banner does not block the page: you can keep browsing and decide later.
3.1 Cookie preferences
You can change your choice at any time from Cookie preferences, at the bottom of every page: necessary cookies are shown as always on and functional cookies have their own switch. We keep your choice for 12 months; after that, or if we change this policy in a relevant way, we will ask you again.
3.2 Global Privacy Control
If your browser sends the Global Privacy Control signal, we take it as your choice to use necessary cookies only, even if you accepted them before: we tell you once, without the full banner. If you want, you can turn functional cookies on in Cookie preferences; if you do so while the signal is on, we respect that choice.
3.3 From your browser
You can also block or delete this site’s cookies and data in your browser’s privacy settings. If you delete the necessary ones, you will have to sign in again and choose your preferences; without session storage and without reCAPTCHA you will not be able to sign in or send forms.
4. Third parties
reCAPTCHA Enterprise and Firebase App Check. Google Cloud services we use to protect sign-in and forms against bots. Google handles them as Castelo’s processor (Privacy Policy).
Firebase Authentication. The Google Cloud service that manages castelo-ai.com accounts and sign-ins, also as Castelo’s processor (providers).
Google One Tap. Provided by Google Identity Services. Google runs its sign-in as an independent controller and handles that information under its own privacy policy (Google sign-in and Google One Tap). We only load its script if you accept functional cookies.
Sign-in windows. If you choose Google, Facebook or Microsoft, that provider’s window uses its own cookies, under its own policies.
We do not sell or share the information in these cookies for advertising.
5. Changes to this policy
We will publish any change on this page with its update date and record it in the change history at the end. If we add cookies that need your choice, we will ask you before using them.
The “Last updated” date at the top of this page shows the current version.
6. Contact
For any question about this policy or your personal data:
- Controller
- CASTELO TECH S.A.P.I. de C.V.
- Registered address
- La Jolla 15, Col. Los Ángeles, Monterrey, Nuevo León, C.P. 64753, México
- Personal data requests (ARCO)
- Castelo’s Personal Data Protection team
- contacto@castelotech.com
See also the Privacy Policy. This policy is a translation of the Spanish version (Política de cookies), which is the binding one.
Change history
- : First version.