This Cookie Policy explains which cookies and which local storage Custodio Legal uses on its public site and inside the product, what each one is for, how long it lasts and how you decide about the ones that are not necessary. It names every cookie exactly as the code writes it, so you can check it in your own browser. It is governed by Ley 1581 de 2012, Colombia's data protection statute, and Decreto 1377 de 2013 (compiled into Decreto 1074 de 2015), by Ecuador's Ley Orgánica de Protección de Datos Personales (LOPDP) and its Reglamento (Decreto Ejecutivo 904 de 2023), by the Dominican Republic's Ley núm. 172-13, by Costa Rica's Ley N° 8968 and its Reglamento (Decreto Ejecutivo N° 37554-JP), by Uruguay's Ley N° 18.331, as amended by Ley N° 19.670, by Argentina's Ley 25.326 and its Decreto 1558/2001, and by Brazil's Lei nº 13.709/2018 (Lei Geral de Proteção de Dados Pessoais, LGPD). The rules are named as their own official gazettes publish them, in Spanish, so you can check each one against the source.

## 1. What cookies and local storage are {#section1}

Cookies are small text files that the site leaves on your device (computer, tablet or phone) and that the browser sends back with every request to the same site. They serve to recognise your session, remember a preference or protect a form. A "session" cookie disappears when you close the browser; a "persistent" one lasts until the date it declares or until you delete it.

Local storage (`localStorage`) is a similar space in the browser, with two differences: only the code of the page you are looking at writes and reads it, it does not travel to the server with requests, and it does not expire on its own — it stays until you or the browser delete it.

## 2. What we use cookies for {#section2}

Custodio Legal uses cookies and local storage for four things only:

- (a) Authentication and security: keeping you signed in, protecting forms against forged requests and securing sign-in with Google or with Microsoft;
- (b) Preferences: remembering your language, your theme (light or dark) and the decisions you already made, such as your answer to the cookie notice;
- (c) Campaign measurement: knowing which link brought a firm to the site. It has two halves and they are not alike. Ours is a first-party cookie that stores the labels the link already carried, the name of the site you came from and the address of the page you came in through, with no identifier of you (section 3). The other is the Google Ads tag, which is limited to the public site and only loads if you accept advertising (section 4);
- (d) Measuring the use of the public site: knowing, in aggregate figures, which pages and which guides are read and which ones help, so we can write better ones. Two third-party tools do it, described in section 4: Google Analytics 4, which only loads if you accept analytics, and Cloudflare Web Analytics, which writes none. Inside the product, Google Analytics 4 measures a single moment, and only if you accepted analytics: the instant an account is created (section 4).

None of these purposes serves to read what you do with your matters: the Google tag is not loaded on any screen of the product except at the instant you have just created your account, and then it only says that the account was created (section 4); and Cloudflare Web Analytics counts page visits without seeing their content.

## 3. First-party cookies and local storage {#section3}

These are all the cookies Custodio Legal writes. Nine are necessary for what they do and the tenth —our own campaign-measurement cookie— carries no identifier, although, if you create an account, what it stores becomes associated with your firm (section 3); none serves advertising or follows you outside the site.

| Cookie | What it is for | Duration |
|---|---|---|
| `law_flow_session` | Keeps you signed in. It carries a random identifier; the server does not store that identifier but a keyed fingerprint of it. | Up to 7 days from sign-in, or until you sign out. |
| `_csrf` | Protects every form and every submission against requests forged from another site. | Up to 24 hours. |
| `lang` | Remembers the language you want to read the site and the product in. | 1 year. |
| `flash_notice` | Carries a read-once notice between a redirect and the page that shows it, for example the result of linking your Google account. | 1 minute; deleted once shown. |
| `oauth_state` | Protects sign-in with Google or with Microsoft: it checks that the reply of the provider you chose matches the request that left your browser. | 5 minutes. |
| `oauth_consent` | During sign-up with Google or with Microsoft, remembers that you ticked the acceptance of the terms and the data-processing authorisation before leaving for the provider you chose. | 5 minutes. |
| `oauth_link_state` | Protects linking your Google account from your account settings. | 5 minutes. |
| `oauth_nonce` | Protects sign-in with Microsoft: it keeps a random value, bound to that of `oauth_state`, which Microsoft returns inside its reply, and checks that the reply was issued for this request and is not an old one being replayed. | 5 minutes. |
| `oauth_return` | If you came to sign in from the screen where you authorize an external assistant connected through MCP, remembers which authorization to return to when sign-in with Google or with Microsoft finishes. It is bound to the value of `oauth_state` and only returns to that screen. | 5 minutes. |
| `law_flow_attribution` | Remembers which link you arrived through, so we can tell which of our own campaigns brings firms in. It stores only the labels the link itself carried in the address (`utm_source`, `utm_medium`, `utm_campaign`, `utm_content`), the **name of the site** you came from —not the particular page you were reading on it— and the **address of our page** you came in through, without whatever follows the question mark: `/guias/consulta-de-procesos`, for instance, so we can tell which of our guides brings firms in. **It carries no identifier of you**: two people arriving through the same link to the same page write exactly the same value, so it cannot count visitors and cannot recognise you if you return. **If you create an account while the cookie exists, what it stores is copied to your firm's record**, and from that moment it is associated with the firm and with whoever registered it (section 5). It is only written if you arrived through a labelled link or from another site, never if you type the address; and only the first time. | 30 days. |

All ten share the same attributes: `HttpOnly` (no script on the page can read them), `Secure` (they travel only over HTTPS) and `SameSite=Lax` (the browser does not send them with requests that another site originates).

In addition, we keep in your browser's local storage:

- `theme`: the light or dark theme you chose, on the site and in the product;
- `cookieConsent`, `cookieConsentVersion` and `cookieConsentDate`: your answer to the public site's cookie notice —which purposes you accepted: analytics, advertising, both or neither—, the version of the question you answered and the date you answered. It is what keeps us from asking you again and what decides whether the Google tag loads and for what, on the site and at the instant of sign-up;
- `upgrade-banner-dismissed`: inside the product, that you already closed the notice inviting you to change plan.

None of these values travels to the server. They stay until you delete them from the browser settings or, for `cookieConsent`, from the "Cookie preferences" link (section 6).

## 4. Third-party cookies and measurement: Google Ads, Google Analytics and Cloudflare {#section4}

On the pages of the public site — home, about, contact, security, pricing, judicial monitoring, guides and these legal documents — we load the Google Ads tag if you accept advertising: it is what lets us know which campaign brought a firm to us. The Google Ads tag is not loaded on the sign-in and sign-up screens nor on any screen of the product: advertising measures campaigns, not what a lawyer does with their matters. The sign-up reaches Google Ads by another path, described in the paragraph "Sign-up" below.

**The Google tag does not load until you decide.** While you have not answered the cookie notice, or if you choose "Essential only" or close it, the site requests no file from Google and sends it nothing: neither cookies nor cookieless pings. The notice asks you about two purposes separately: **analytics**, which is Google Analytics 4, and **advertising**, which is Google Ads. When you accept at least one, the tag loads with the Google consent state (Consent Mode v2) that matches what you accepted: analytics grants analytics storage; advertising grants ad storage, ad user data and ad personalisation. What you did not accept stays denied, ad data redaction stays on, and only the Google service of what you accepted is configured: if you accept analytics alone, the tag does not configure Google Ads and sends it nothing.

Only if you accept advertising —with "Accept all" or by choosing it— does the tag configure Google Ads, and only from that moment: it writes `_gcl_au` on our domain, to attribute the visit to the click on an ad, and may write `IDE` on Google's domain to measure and personalise ads. Their duration is set by Google and published in its cookie policy; as of this version, `_gcl_au` lasts 90 days and `IDE` 13 months. Google LLC (United States) is responsible for its own cookies and for the processing it carries out with them, under its own privacy policy. We do not sell your personal data to advertisers and we do not use the content of your matters for advertising.

**Google Analytics 4.** Through the same tag —no additional script is loaded— we measure the use of the public site with Google Analytics 4: which pages and which guides are visited, how far they are scrolled, which links lead out to other sites, which videos are played and which files are downloaded. We deliberately keep site-search measurement and form-interaction measurement switched off, so that no case number and no text you type into a form travels to Google. On the public site it only loads if you accept analytics —with "Accept all" or by choosing it—; without it nothing is configured or sent. With it, it writes `_ga` on our domain, to tell one browser from another across visits, and `_ga_<id>`, to keep the state of the measurement session; Google sets their duration at 2 years (Google Analytics documentation consulted on September 23, 2026), and browsers may shorten it. For this measurement Google acts as a processor on our behalf, under its Data Processing Terms, which we have accepted; in the account we have switched off the four options for sharing Analytics data with Google for its own products and services, its modelling, its technical support and its recommendations. The Analytics property is linked to our own Google Ads account to see the site's metrics there and to count as a conversion the sign-up described in the next paragraph; we do not import Analytics audiences to show you ads (remarketing), and Google signals —which associates the measurement with signed-in Google accounts— is switched off. The event and user data of this measurement are kept in Analytics for 14 months, the period we set in the property; after that period Google deletes them. The figures we see are aggregate: we do not join them to your product account.

**Sign-up.** Inside the product, the Google tag is loaded at a single moment —when you have just created your account, with email and password, with Google or with Microsoft— and only if you accepted analytics in the site's cookie notice. It then configures Google Analytics 4 —not the Google Ads tag— without sending a page view, and sends a single event, the sign-up event (`sign_up`), with the method you signed up with and the address of the screen without whatever follows the question mark, except the campaign labels of the link you arrived through; never your name, your email or an identifier of your account or your firm. It applies the choice the cookie notice stored: with analytics accepted it may write or read `_ga` and `_ga_<id>`, the cookies described in the previous paragraph; without it, the tag does not load and the event is not sent. We import that event into our Google Ads account as a conversion, to know which campaign brings new accounts. Whoever signs in with an account that already existed, or works in the product, does not load the tag.

**Cloudflare Web Analytics.** Our site is served through Cloudflare, and Cloudflare Web Analytics counts page views in aggregate —which page, which site the visit came from, what kind of browser and device, how long it took to load— so we know what is read and whether the site responds quickly. **It writes no cookies and does not use local storage**, and it assigns no identifier to your browser. As in any web request, the transmission also carries your IP address. Cloudflare, Inc. (United States) provides it as a processor on our behalf.

## 5. Legal basis and scope {#section5}

Custodio Legal is offered in Argentina, in Brazil, in Colombia, in Costa Rica, in Ecuador, in the Dominican Republic and in Uruguay. The use of cookies is governed by Ley 25.326 and its Decreto 1558/2001 in Argentina, by Lei nº 13.709/2018 (LGPD) in Brazil, by Ley 1581 de 2012 and Decreto 1377 de 2013 in Colombia, by Ley N° 8968 and its Reglamento (Decreto Ejecutivo N° 37554-JP) in Costa Rica, by the LOPDP and its Regulation in Ecuador, by Ley núm. 172-13 in the Dominican Republic, and by Ley N° 18.331 and its amending Ley N° 19.670 in Uruguay.

The first nine first-party cookies of section 3 and the local storage do not require your consent: they are necessary to provide the service you yourself request — signing in, protecting your submissions, reading the site in your language — (LOPDP, article 7, number 5) and, for the session and your account, they are covered by the data-processing authorisation you grant when you register (Ley 1581 de 2012, article 9). On their own they do not say who you are: they carry a random identifier or a language code. You can delete them from the browser; without them sign-in and the forms stop working.

The tenth, `law_flow_attribution`, does not require it either, and it is worth saying exactly why. While it lives only in your browser it stores the labels the link you arrived through already carried written in the address, the name of the site you came from and the address of our page you came in through; it contains no identifier, does not tell your browser from anybody else's and does not allow recognising you inside or outside the site. **But if you create an account while it exists, that content is stored with your firm's record**, and from that moment it is data associated with the firm and with whoever registered it: which link it came through. We use it to know which of our posts bring firms in; only the internal administration funnel reads it, it is not sent to Google or to any third party and it is not used for advertising. That use falls within the authorisation you grant when you register and follows the rules of the Personal Data Processing Policy. You can delete the cookie from the browser before registering and lose nothing: it takes part in no service.

The Google tag of section 4 —Google Analytics 4 and Google Ads— only loads with your prior, express and informed consent, which you grant separately for each purpose: analytics for Google Analytics 4 and advertising for Google Ads (Ley 1581 de 2012, article 9; LOPDP, articles 7, number 1, and 8). Before you decide nothing is loaded or sent, because not every law of the seven countries gives us a basis for that transmission other than your consent. Choosing "Essential only" or closing the notice grants neither, and in that state the tag does not load. You can withdraw your consent at any time (section 6); the withdrawal does not affect what was processed while it was in force.

Cloudflare Web Analytics writes nothing on your device —it leaves no cookies and does not use local storage—, so the cookie rule does not ask for your consent. That does not mean it processes no data: every request carries your IP address, like any web request. What grounds it is a legitimate interest in knowing which pages of the site are read and whether they respond well, and what limits it is what we receive: only aggregate page-view figures, with no identifier of your browser and nothing that would serve to recognise you. Cloudflare provides it as a processor on our behalf (section 4).

## 6. Managing your preferences and withdrawing consent {#section6}

You have four ways to decide:

- (1) The cookie notice shown the first time you visit the public site: "Accept all" accepts analytics and advertising; "Choose" lets you accept only one of the two; "Essential only" and closing the notice accept neither and the Google tag does not load. If we change what the notice asks, we ask you again: an answer given to an earlier question stops counting and, until you answer the new one, the tag does not load;
- (2) The "Cookie preferences" link, in the footer of every page of the public site: it deletes the answer stored in your browser, shows the notice again so you can decide anew and, if the Google tag was loaded, tells it that its four purposes are denied and stops sending to each service from that instant. It is the way to withdraw the consent you gave. Cookies Google had already written stay in your browser until they expire or until you delete them from its settings, which is where they live;
- (3) Your browser settings, which let you view, delete and block cookies site by site;
- (4) A browser extension for managing cookies.

Blocking the first-party cookies of section 3 prevents signing in and using the forms.

## 7. Retention and security {#section7}

Each cookie lasts what section 3 declares and not a day longer: the session cookie, up to 7 days or until you sign out; the form-protection cookie, up to 24 hours; the language cookie, 1 year; our own campaign-measurement cookie, 30 days; the Google and Microsoft sign-in cookies, 5 minutes; the read-once notice, 1 minute. The data Google Analytics 4 collects with your consent are kept for 14 months (section 4). Local storage does not expire on its own. The session cookie carries a random identifier the server does not keep in the clear, and every first-party cookie travels only over HTTPS and out of reach of the page's scripts.

## 8. Changes to this policy, version and contact {#section8}

The version of this policy in force is 0.0.14, effective as of October 30, 2026. Version 0.0.14 names sign-in with Microsoft, which the product offers next to Google's: it adds to section 3 the `oauth_nonce` cookie, necessary and lasting 5 minutes, which protects that sign-in, and says that `oauth_state` and `oauth_consent` also serve it. It also names `oauth_return`, which sign-in with Google already wrote to return to an external assistant's authorization and which this policy did not name; it serves Microsoft's in the same way. It changes neither what the cookie notice asks you, nor any measurement or advertising cookie, nor any duration. It replaces 0.0.13, of October 11, 2026. Version 0.0.13 stops loading the Google tag before you decide: until this version it was loaded on the public site with consent denied and sent Google cookieless pings with your IP address, the page, the referrer and the browser, and now nothing is loaded or sent until you accept a purpose (sections 4 and 5). It also splits what the cookie notice asks you into two purposes, analytics and advertising, which you can accept one without the other (sections 3, 4 and 6). Because what the notice asks you changes, it asks you again even if you had already answered. It adds no cookie and changes no duration. It replaces 0.0.12, of October 10, 2026. Version 0.0.12 corrects two statements in section 5. The first said that `law_flow_attribution` does not process personal data of yours and cannot be joined to anything; that is not so when you create an account while the cookie exists, because its content is stored with your firm's record, and the policy now says so in sections 3 and 5. The second grounded Cloudflare Web Analytics only on writing nothing on your device; it now also says that it processes your IP address and on what that processing is grounded. It adds no cookie, changes no duration and does not change what the cookie notice asks you. It replaces 0.0.11, of October 1, 2026. Version 0.0.11 describes in section 4 the one moment the Google tag is loaded inside the product —the instant an account is created, to send Google Analytics 4 the sign-up event under the same consent— and corrects the sentences of sections 2 and 4 that said it was not loaded on any screen of the product. It adds no cookie, changes no duration and does not change what the cookie notice asks you. It replaces 0.0.10, of September 23, 2026. Version 0.0.10 adds purpose (d) of section 2, the aggregate measurement of the use of the public site, and describes in section 4 the two tools that carry it out: Google Analytics 4, which travels through the same Google tag and under the same consent, and only with it writes `_ga` and `_ga_<id>`; and Cloudflare Web Analytics, which writes no cookies and does not use local storage. It removes the sentence that said no third-party tool measured browsing, which was no longer true: Cloudflare Web Analytics was measuring the site without the policy naming it. It replaces 0.0.9, of September 18, 2026. Version 0.0.9 makes precise what the first-party cookie `law_flow_attribution` stores: it adds, to the labels and the name of the referring site, **the address of our page you came in through**, without the part that follows the question mark. It adds no cookie, changes no duration, creates no new purpose and carries no identifier of you: two people coming in through the same page write the same value. It replaced 0.0.8, of September 16, 2026. Version 0.0.8 adds Brazil to the legal basis and scope of section 5 —Lei nº 13.709/2018, the Lei Geral de Proteção de Dados Pessoais—, because the Service is now offered in seven countries. It changes not one cookie, not one duration, not one purpose. It replaced 0.0.7, of September 13, 2026. Version 0.0.7 adds Argentina to the legal basis and scope of section 5 —Ley 25.326 and its Decreto 1558/2001—, because the Service is now offered in six countries. It changes not one cookie, one duration or one purpose. It replaces version 0.0.6, of September 12, 2026. Version 0.0.6 adds Uruguay to the legal basis and scope of section 5 —Ley N° 18.331 and its amending Ley N° 19.670—, because the Service is now offered in five countries. It changes not one cookie, one duration or one purpose. It replaces version 0.0.5, of September 10, 2026, version 0.0.4, of September 8, 2026, version 0.0.3, of 4 September 2026, version 0.0.2, of 4 September 2026, and version 0.0.1, in force since April 2026. Version 0.0.5 adds Costa Rica to the legal basis and scope of section 5 —Ley N° 8968 and its Reglamento, Decreto Ejecutivo N° 37554-JP—, which the text already named without the version having moved with it, and names the four rules as their source publishes them in this translation too, where Colombia's and Ecuador's were translated. It changes not one cookie, one duration or one purpose. Version 0.0.4 declares the first-party cookie `law_flow_attribution`, which remembers which link you arrived through for 30 days without carrying any identifier of you, and makes purpose (c) of section 2 precise, which until now described only its third-party half. Version 0.0.3 removes the `law_flow_impersonate_restore` cookie and the one-hour support-session duration: the feature that created them —support access with the identity of a user of the firm— no longer exists, so neither is written in any browser any more. Version 0.0.2 named every first-party cookie with its purpose, duration and attributes, declares the local storage, removes the mention of analytics and performance cookies that do not exist, corrects the legal basis of the necessary cookies, describes what the Google tag sends before you decide and adds the "Cookie preferences" link as the means to withdraw consent. We may update this policy to reflect changes in our practices or in the law; each new version is published here with its date and number, and material changes are communicated through the platform.

This policy is written in Spanish; in case of any difference with its translations, the Spanish version prevails. For questions about it, or to exercise your rights of access, rectification, cancellation and opposition under the Personal Data Processing Policy, write to us at support@custodio.legal.