This page explains the cookies and similar technologies that Mirox, LDA ("Mirox") uses on mirox.pt and the dashboard, and how you control them. It supplements the Privacy Policy.
1. What is a cookie
A cookie is a small text file a website stores on your device. We also use comparable technologies such as localStorage for the same purposes. The same rules apply to all of them under Article 5(3) of the ePrivacy Directive.
2. Three categories
Essential cookies — required for the site to work (sign-in, security, remembering your consent choice). These are set without consent under Art. 5(3) ePrivacy Directive.
Analytics cookies — help us understand aggregated, anonymised use of the site. We only set these after your explicit, affirmative consent via the cookie banner.
Ad-measurement cookies — a first-party cookie that remembers which advertisement you arrived from, plus the Google Ads tag, so we can tell which campaigns are worth running and reach you with our own ads elsewhere. Nothing in this category is set, and the Google tag is not even downloaded, until you give explicit, affirmative consent.
3. The cookies we set
Name
Purpose
Duration
Type
mirox_session
Authenticated session token after sign-in.
Session
Essential
mirox_csrf
CSRF protection for state-changing requests.
Session
Essential
mirox_consent
Records your cookie-banner choice per category so we do not ask again.
12 months
Essential
ph_<key>_posthog
PostHog product-analytics cookie holding a pseudonymous device identifier and session id.
First-party cookie holding the click identifier of the ad you arrived from (e.g. Google’s gclid) plus any campaign tags in the URL, so we can tell which campaigns bring people here. Set by us, readable only by us, and never used to personalise anything you see.
90 days
Ad measurement
_gcl_au, _gcl_aw, _gcl_dc
Set by the Google Ads tag (gtag.js) to link an ad click to a later conversion and to build advertising audiences. Loaded from googletagmanager.com only after you switch on ad measurement.
90 days
Ad measurement
4. Third-party processors
When you accept analytics, the following processor receives event data on our behalf, bound by a written data-processing agreement under Art. 28 GDPR:
PostHog Inc. — product analytics (pageviews, navigation paths, conversion events). We use the PostHog EU Cloud tenant, hosted in Frankfurt, Germany. IP addresses are not stored verbatim — PostHog uses them only for coarse geo-resolution (country / region) and then discards them. We do not enable session recording. DPA: posthog.com/dpa.
If — and only if — you switch on ad measurement, Google Ireland Ltd. additionally receives data directly from your browser through the Google Ads tag: your IP address, the page you are on, and the identifiers in the _gcl_* cookies above. Google may use this to attribute conversions and to show you Mirox advertising on other sites. Google acts as an independent controller for that data under its own advertising terms, not as our processor, and it may be processed outside the EU under the EU–US Data Privacy Framework and Standard Contractual Clauses. Refuse the ad-measurement category and the tag is never loaded, so none of this happens. See Google's advertising data terms.
The first-party mirox_attr cookie is separate and is never read by anyone else while you browse. If you go on to submit a form (a free audit request, or signing up), we send the advertising network that brought you — Google Ireland Ltd. or Microsoft Ireland Operations Ltd. — a record that one conversion happened: the click identifier from that cookie (or a SHA-256 hash of your email address if the identifier is missing), the time, and a monetary value. Your name, your message, your uploaded file and your plaintext email are never included.
We do not use Google Analytics, Meta Pixel, LinkedIn Insight, X (Twitter) Pixel, TikTok Pixel or any Microsoft UET tag.
5. Managing your choice
On your first visit, the cookie banner asks which categories you accept. You can accept all, reject non-essential, or open Customize to decide on analytics and ad measurement separately. Closing the banner is treated as a rejection. You can revisit your choice at any time using the Cookie settings link in the footer; withdrawing ad-measurement consent deletes the mirox_attr and _gcl_* cookies immediately and revokes Google's ad-storage permission.
You can also block or delete cookies from your browser settings. Blocking essential cookies will break sign-in.
Nothing advertising-related runs until you say yes
Mirox advertises, and since 13 August 2026 we run the Google Ads tag to measure it — which means Google can attribute your conversion and show you our ads elsewhere. It is strictly opt-in: the script is not in this page's source and is never downloaded from Google unless you switch on ad measurement, which you can verify in your browser's network inspector before and after choosing. There is still no Meta Pixel, no LinkedIn Insight Tag and no Microsoft UET tag. Withdraw consent and we revoke Google's permission and delete its cookies. We never sell data.
6. Changes to this policy
If we add or change cookies, we update this page and re-prompt for consent where required. The "last updated" date above always reflects the current version.