Cookie Policy
How we use cookies and similar technologies on the ri-hub.it website and in the Ri-Hub app (app.ri-hub.it and the iPhone and Android apps). Version 3.0 of 16 October 2026.
1. What cookies are
Cookies are small text files that a website saves on your device when you visit it. The browser's localStorage and sessionStorage and the “pixels” of advertising platforms work in a similar way: you will find all of them on this page. Ri-Hub uses them to make the website and the app work (technical cookies) and, only if you allow us, to understand how they are used (analytics) and to measure whether our advertising works (marketing).
2. Cookies on the ri-hub.it website
2.1 Technical cookies (necessary)
They make the website work and remember the choices you make. They do not require consent (Art. 122 of the Italian Privacy Code) and we do not use them to follow you on other websites.
| Name | Whose | What it is for | Duration |
|---|---|---|---|
rihub.cookies | Ri-Hub | Remembers your cookie choice (necessary, analytics, marketing), with the date and the version of the banner. | localStorage, until you change your choice or clear the site data |
NEXT_LOCALE | Ri-Hub | Remembers the language you choose from the language menu. | 1 year |
rh-origine | Ri-Hub | Remembers, only during your visit, which link or campaign brought you here, so the information is not lost if you continue to the app. Without your consent it never becomes a cookie. | sessionStorage, until the tab is closed |
rh-banner-citta, ri_blog_sticky_chiusa | Ri-Hub | Remember that you closed a notice, so we don't show it to you again. | localStorage (city notice); sessionStorage (prompt in articles) |
2.2 Analytics cookies (only with your consent)
They are activated only if you press “Accept all” or switch on “Analytics” in the banner. They tell us which pages are visited and which links to the app are pressed, so we understand what to improve. They are not anonymous: they give your browser a random identifier, which does not contain your name or your email. On the website we do not record sessions (“session replay”) and we do not automatically collect clicks or page text.
| Name | Whose | What it is for | Duration |
|---|---|---|---|
ph_<key>_posthog (cookie and localStorage) | PostHog (EU cloud, eu.i.posthog.com) |
Pages viewed and links to the app pressed, linked to the browser's random identifier. | 1 year |
No cookie (script analytics.ahrefs.com) | Ahrefs Web Analytics (Ahrefs Pte. Ltd., Singapore) | Counts page visits and where they come from. In our checks it writes nothing on the device, but it receives the technical data of the visit (page, referring site, IP address): that is why we load it only with your consent. | — |
_ga, _ga_* | Google Analytics 4 (Google Ireland Limited) | Set up but not active today on the website. If we switch it on, it will start only with your Analytics consent. | 14 months |
2.3 Marketing cookies (only with your consent)
They are activated only if you press “Accept all” or switch on “Marketing” in the banner, and only on the website. They are used to measure whether our advertising works. The pixels start only on pages that do not talk about health (home, about us, how it works, prices, work with us, contacts and legal pages), and from there they receive only the page visit: from articles, conditions, exercises and the other pages about health nothing is sent to Meta or TikTok. From the app we send no event to the pixels of Meta, TikTok or Google, not even the page visit, and the website does not use the Google Ads pixel: Google campaigns are measured only from our server, for people who arrive from a Google ad and have given explicit consent in the app (Privacy Policy, § 5.2).
| Name | Whose | What it is for | Duration |
|---|---|---|---|
_fbp, _fbc | Meta Pixel (Meta Platforms Ireland Ltd.) | Measures the effectiveness of advertising on Facebook and Instagram (website only, only from pages that do not talk about health). | 3 months |
_ttp, _tt_enable_cookie, ttcsid, ttcsid_* | TikTok Pixel (TikTok Technology Limited, Ireland) | Measures the effectiveness of advertising on TikTok (website only, only from pages that do not talk about health). | 13 months |
Providers' privacy policies: facebook.com/privacy/policy, tiktok.com/legal/privacy-policy-eea, policies.google.com/privacy.
2.4 Where you come from: the cookie ri_utm
If you arrive from an ad or from a link with campaign parameters and you have accepted Analytics or Marketing, the website saves in ri_utm the source, medium, campaign and click identifiers (for example gclid, fbclid, ttclid) of your first arrival, for 90 days. The cookie is valid for ri-hub.it and app.ri-hub.it, so we know which channel brought you to us even if you book a few days later. Without consent the information stays only for the length of the visit (rh-origine, above). If you later withdraw both consents, the website deletes it.
2.5 Third-party services
| Provider | When | What it is for | Privacy |
|---|---|---|---|
| Stripe | Only in the app, when you pay or save a card | Secure payment and fraud prevention. Stripe may write its own technical cookies (for example __stripe_mid, __stripe_sid). |
stripe.com/privacy |
| YouTube | The website does not embed YouTube videos: links to our channel open YouTube in another tab. In the app, videos load only when you start them. | Playback of the app's videos, from YouTube's privacy-enhanced mode (youtube-nocookie.com). Video thumbnails come from img.youtube.com. |
policies.google.com/privacy |
| Google and Apple (sign-in) | Sign-in pages of the app | “Continue with Google” and “Continue with Apple” buttons. The Google button loads from accounts.google.com as soon as the page opens; your account data is shared only if you choose to sign in that way. |
policies.google.com/privacy, apple.com/legal/privacy |
3. Technical data of the Ri-Hub app
The app (app.ri-hub.it and the iPhone and Android apps) stores on your device some technical data needed to make it work and to remember your choices. We do not use them to follow you on other websites. The app's analytics (PostHog) follow the rules in point 2.2: they start only with your consent. We send no event from the app to the Meta, TikTok and Google Ads pixels, not even the page visit. In the app PostHog also records clicks on buttons, but never the text they contain or what you type.
| Name | What it is for | Duration |
|---|---|---|
ri-hub-accessToken, ri-hub-refreshToken (cookie) |
Sign-in and session: they keep you signed in to the app, only over encrypted connections (HTTPS). | Until you sign out, at most 1 year |
NEXT_LOCALE (cookie) |
The app language, chosen by you or read from the browser. | 1 year |
ri-cookie-consent-v1 (localStorage) |
Your choice on analytics and marketing in the app, with the date and the version. | Until you change it |
ri_utm (cookie and localStorage; without consent ri_utm_primo and ri_utm_ultimo in sessionStorage) |
Where you came from: source, medium and campaign of the ad or link, click identifiers (for example gclid, fbclid, ttclid), or the website you came from; the cookie keeps your first arrival, localStorage the latest one. They are stored this way only if you accept Analytics or Marketing; without consent they are kept only until the tab is closed. They tell us which channel brought you to us when you book or buy. |
90 days (without consent: until the tab is closed) |
ri-hub.native-push-token (iPhone and Android apps only) |
The device code needed to send you the notifications you have switched on. | As long as the app is installed |
Interface preferences (localStorage, sessionStorage; for example rihub-hub-widget-order) |
Remember the choices you make in the app: order of the tiles, simple mode, closed notices, last payment method chosen, content already read. | Until you clear the app or browser data |
Drafts in progress (localStorage, sessionStorage; for example ri-onboarding-quiz, ri-guest-profile, ri-guest-booking) |
Keep what you are filling in (initial questionnaire, booking before registration, informed consent), so you don't lose it if you close the page. They may contain answers about your health: they stay on your device and we send them to no one until you submit them yourself. | Until you clear the app or browser data |
Good to know. In the app, the source of your visit and PostHog follow the same rules as the website: without your consent the source is kept only until the tab is closed and PostHog does not start. When you register or book, the source of the current visit is saved with your account (Privacy Policy, § 5.4).
4. How to manage your choices
Banner: on your first visit a banner appears with three options:
- Accept all: activates technical cookies, analytics (PostHog and Ahrefs) and marketing cookies (Meta and TikTok, website only).
- Necessary only: enables only the essential technical cookies.
- Customize: you choose, category by category: Necessary, Analytics, Marketing.
Changing your mind: you can change your choice at any time from the “Manage cookies” link at the bottom of every page (and in the app: Settings → Privacy & data). Withdrawing consent is as easy as giving it: on the website, if you switch off a category, we delete the cookies its tools wrote on our domain and reload the page, so the tools already loaded stop.
From your browser: every browser lets you block or delete cookies. See the official guides: Chrome, Firefox, Safari, Edge.
5. Transfers outside the EU
PostHog keeps the data in its cloud in the European Union (eu.i.posthog.com). Ahrefs (Singapore) and Stripe process some data outside the EU on the basis of the Standard Contractual Clauses approved by the European Commission. Meta and Google may process data in the United States on the basis of the EU-US Data Privacy Framework.
TikTok states that it transfers data on the basis of the Standard Contractual Clauses, but the data collected by its pixel may also be accessed from China, by staff of the TikTok group. In May 2025 the Irish data protection authority (Data Protection Commission) fined TikTok 530 million euros precisely for transfers of European users' data to China. Please bear this in mind before accepting the Marketing category.
6. Data controller and retention
The data controller is Ri-Hub S.r.l. Società tra Professionisti: full details and contacts are in the Privacy Policy, § 1, together with the list of providers who process data on our behalf (§ 6). Data collected through analytics are kept for 12 months.
7. Your rights
You have the right to access your data, rectify it, erase it and receive a copy of it, and to withdraw your consent to analytics and marketing at any time. To exercise your rights, write to privacy@ri-hub.it. Full details are in the Privacy Policy, § 8.
8. Changes and versions
We update this page when we add or remove tools that use cookies. If the tools or the purpose for which we ask for your consent change, we show you the banner again. This is version 3.0 of 16 October 2026. Previous versions: 2.0 of 13 October 2026 (marketing cookies), 1.0 of May 2026.