Cookie and storage policy

1. Technical privacy approach

Candy Art Mérida’s digital platform follows minimum data collection and technical transparency. It does not trade in user profiles, include invasive advertising networks or share browsing habits with advertising intermediaries.

2. Optional site analytics

The public site offers Google Analytics 4 and Google Tag Manager to measure visits and interactions. These scripts load only after you choose “Accept analytics”. Rejecting analytics does not prevent site access.

If accepted, Google may receive technical browsing data and use its own cookies under its policies. The site does not use this measurement for personalized advertising. Withdraw your choice using “Cookie preferences” in the footer. This stops new events; the full effect on third-party scripts applies after reloading the page. Existing cookies can be cleared in the browser.

3. Browser local storage

The site uses localStorage and sessionStorage on your device for operational functions:

• Customizer drafts (candy_borrador_pinata / candy_borrador_tocado): temporarily keep choices from the step-by-step creator so visiting another section does not lose your design progress.
• Request attempt identifier (candy_intento_*): a temporary random key prevents duplicate requests after a network interruption or double click.
• Navigation memory (sessionStorage): temporarily keeps the scroll position when returning from a product page to the catalog.
• Analytics preference (candy_analytics_consent): remembers whether you accepted or rejected Google Analytics.

4. Internal administration cookie

The internal panel uses the technical candy_sesion cookie:

• Internal scope: it is generated and used only in the internal administration panel (/panel) when authorized workshop staff sign in.
• Security: it is issued with HttpOnly, Secure and SameSite=Strict attributes to restrict script access and cross-site use.
• Public visitors: people browsing the public catalog do not receive this administration cookie.

5. Technical interaction metrics

The site records general anonymous events through its own /api/eventos endpoint to understand interest and improve performance. Actions include category views, starting the customizer and WhatsApp clicks, associated with an event date.

The content sent to this endpoint does not include names or phone numbers. As with any web request, the server receives technical connection data.

6. Managing or clearing storage

Browser drafts and session data are stored on your device. You can remove them using your browser’s privacy or history settings to clear cache and local storage.

For technical questions about the site, contact WhatsApp +52 999 279 0907.