Cookie Policy

Which cookies the Costa Mobility website uses, why and for how long, and how we measure website usage without cookies.

Preliminary version under attorney review. Items marked [PREENCHER] (to be filled in) and [CONFIRMAR] (to be confirmed) are still open. Do not treat this text as final.

On this page

Effective date: [PREENCHER: effective date]

1. What cookies are

Cookies are small files a website stores in your browser to remember information between visits. Similar technologies, such as the browser's local storage, follow the same rules in this policy.

2. Cookies the website uses today

Name	Purpose	Type	Duration
NEXT_LOCALE	remember the language you chose (Portuguese or English) in the selector at the top of the page	strictly necessary, first-party	1 year
costa_intake (`__Host-costa_intake`)	let you continue the assessment (Mobility Snapshot) where you left off, in the same browser	necessary for the requested service, first-party (API server)	30 days, renewed at each step
costa_intake_resume	confirm that the resume code sent by e-mail is used in the same browser that requested it	necessary for security, first-party (API server)	10 minutes

The assessment cookies cannot be read by scripts on the page (HttpOnly) and do not store your answers or contact details: they only hold a random identifier, replaced on every use.

The website does not use analytics, advertising or social media cookies.

3. Signed-in area and payment

Portal and staff panel: use the session cookie costa.session_token (__Secure-costa.session_token over secure connections) to keep you securely signed in. It lasts 7 days and is renewed when you use the portal; for the firm's staff, the session expires after 12 hours at most. Users with two-step verification also get a temporary cookie, lasting a few minutes, during sign-in.
Payment: checkout happens on Stripe's page, which uses its own cookies to process payment and prevent fraud, under Stripe's privacy policy.

These cookies are necessary for the service you requested and do not depend on consent.

4. Website usage metrics

To know how many people visit the website, where they come from and how many start the assessment, we use Vercel Web Analytics, from Vercel, which hosts the website. It does not use cookies or store anything in your browser: each visit is recognized by a code generated from the request itself, discarded within 24 hours, and the data is only seen in aggregate (page visited, referring site, country/region, device type, operating system and browser). We do not send this tool your name, e-mail, assessment answers or session identifiers.

If we ever start using analytics or advertising cookies, they will only be enabled after you consent, through a notice where the option to refuse is as visible as the option to accept, and this policy will be updated beforehand.

5. How to control cookies

You can delete or block cookies in your browser settings. If you block the language cookie, the website will pick the language from your browser again. If you block the session cookie, you will not be able to sign in to the portal.

6. Legal basis

Necessary cookies rely on providing the service and on our legitimate interest in keeping the website working (LGPD, art. 7, V and IX). The aggregate metrics in section 4 rely on our legitimate interest in understanding how the website is used (LGPD, art. 7, IX), with minimal data and without identifying you. [CONFIRMAR: legal basis for cookieless aggregate metrics.] Analytics or advertising cookies, if adopted, will depend on your consent (LGPD, art. 7, I). More details in the Privacy Policy.

7. Changes

We will update this page whenever a cookie is added or removed.

Sources and legal bases

[CONFIRMAR: English version drafted by the team from the Portuguese text of 11/01/2026; pending the attorney's review]