Cookie policy
This page describes the cookies and similar technologies used by the website and the application services of Carmilla, provided by Bright Band Srl (Controller, contact: info@pec.brightband.it).
What they are
Cookies are small text files that the browser stores at a website's request. The browser's local storage (localStorage) serves a similar purpose for data that is not sent to the server. All the technologies listed here are technical: they make the service work, keep the session or remember a preference. For these, under Article 122 of the Italian Privacy Code and the Guidelines of the Italian Data Protection Authority of 10 June 2021, no consent is required and no banner is shown.
We do not use profiling cookies, third-party analytics, advertising pixels or social plug-ins. Should measurement tools be introduced in the future, this page will be updated and, where required, consent will be requested.
Cookies and storage in use
Website (Carmilla)
| Name | Purpose | Duration | Type |
|---|---|---|---|
NEXT_LOCALE | remembers the visitor's chosen language; set only if a language is picked from the switcher | 1 year | technical, first party |
The contact form uses no cookies: protection from automated submissions is a hidden form field.
Web console (app. and bff.)
| Name | Purpose | Duration | Type |
|---|---|---|---|
__Host-mt_sid | session of the authenticated user (HttpOnly, Secure) | up to 24 hours or until logout | technical, first party |
__Host-mt_did | technical device identifier, to recognise sessions of the same browser (HttpOnly) | 1 year | technical, first party |
__Host-mt_oauth, __Host-mt_oauth_retry, __Host-mt_oauth_return | protection of the login transaction (anti-CSRF, retry after an error, return to the requested page) | a few minutes, during login | technical, first party |
localStorage: theme (theme, themePref), language (metropolis.language), grid and export preferences, last report options, percentage view, date of the last refresh of the locally cached registries | remember interface preferences and the state of the local cache of data already downloaded | until cleared by the user | technical, first party, not sent to the server |
Administration area (admin.), developer portal (developer.) and support portal (support.)
| Name | Purpose | Duration | Type |
|---|---|---|---|
es_session | session of the authenticated user (HttpOnly, Secure) | for the lifetime of the access token (8 hours when not stated) or until logout | technical, first party |
es_auth_tx | protection of the login transaction (anti-CSRF, PKCE) | 10 minutes, during login | technical, first party |
es_sso_checked | avoids repeating the silent single-sign-on check | 10 minutes | technical, first party |
es_auth_retry (admin. and developer. only) | login retry after a transaction error | 2 minutes | technical, first party |
NEXT_LOCALE | language chosen by the user | 1 year | technical, first party |
localStorage (developer.): test API token, saved only at the user's request on the playground page; (admin.): distributor-portal credentials, encrypted in the browser, for the supply-data import | features of the page that uses them | until cleared by the user or by the page itself | technical, first party |
The platform administration console (platform operator only) uses the
identity provider SDK's session cookies: __session (session, HttpOnly)
and __txn_* (login transaction, a few minutes). The blog editorial
console (editor., editors only) uses decap_oauth_state (anti-CSRF of the
GitHub login, 10 minutes, HttpOnly) and, on the GitHub domain, that
service's cookies.
Login and identity (auth. and identity provider)
| Name | Purpose | Duration | Type |
|---|---|---|---|
ab_auth_retry (HttpOnly, /auth path only) | login retry from the originating surface when the transaction has expired | 10 minutes | technical, first party |
Auth0 (Okta) cookies on the identity provider's domain (e.g. auth0, did, auth0_compat, did_compat) | login session and abuse protection at the identity provider | session / up to 1 year | technical, third party — provider's notice: auth0.com/privacy |
How to manage cookies
Browser settings allow you to block or delete cookies and local storage. Blocking technical cookies prevents access to the console (the session cannot be kept) and loses the saved preferences.
Updates
This page is updated whenever the cookies in use change.
Contacts
For questions about this cookie policy: info@pec.brightband.it.
Version: October 2026