Cookie Policy
Effective date: June 25, 2026
Last updated: June 25, 2026
Version: 1.0
1. Introduction
This Cookie Policy explains how Pink Elephant, Unipessoal Lda, operating the States of Mind platform, uses cookies and similar technologies when individuals visit or use the States of Mind website and related online services.
This Cookie Policy should be read together with the States of Mind Privacy Policy, which explains how personal data is collected, used, disclosed, retained and protected.
2. Controller
The controller responsible for the use of cookies and similar technologies is:
Pink Elephant, Unipessoal Lda
NIPC 519056582
Edifício Amoreiras Square
Rua Carlos Alberto da Mota Pinto, no. 17, second floor
1070-313 Lisboa
Portugal
Privacy enquiries may be sent to:
3. Scope
This Cookie Policy applies to the States of Mind website, website analytics, community access, mental-health self-assessments and educational quizzes, AI Navigator, newsletter subscription interfaces and other online features made available through States of Mind.
The community is operated through Circle. Certain community technologies may therefore be placed or accessed by Circle when an individual creates an account, signs in or uses members-only functionality.
4. Meaning of cookies and similar technologies
A cookie is a small file or item of information placed on or read from a browser or device. Similar technologies include local storage, session storage, analytics identifiers, software development kits, scripts, pixels, device or browser identifiers and session-replay technologies.
The rules concerning storage of or access to information on a user’s device are not limited to conventional browser cookies. They may also apply to other technologies that read from or write information to a computer, mobile device or browser.
In this Cookie Policy, the term “cookies” includes cookies and comparable technologies unless the context requires otherwise.
5. Legal framework
Under Portuguese Law No. 41/2004, the storage of information on, or access to information stored on, a user’s device generally requires the provision of clear information and the user’s consent. An exception applies where storage or access is strictly necessary to transmit a communication or provide an information-society service expressly requested by the user.
States of Mind therefore uses non-essential analytics and Session Replay technologies only after the user has given prior consent. Where those technologies process personal data, the GDPR legal basis is Article 6(1)(a), consent.
Strictly necessary technologies may be used without optional cookie consent where they are required to provide website security, remember privacy choices, maintain an authenticated session or deliver a feature expressly requested by the user. Where those technologies process personal data, the applicable GDPR basis is described in the Privacy Policy.
Acceptance of the States of Mind Terms of Use does not constitute consent to optional analytics or other non-essential cookies.
6. Categories of technologies used
6.1 Strictly necessary technologies
States of Mind uses technologies that are necessary to operate and secure the website and requested services.
These technologies may be used to route website traffic, protect the website against abuse, establish secure connections, maintain an authenticated community session, process forms, maintain an active assessment or AI Navigator session, remember privacy choices and prevent non-essential technologies from loading before consent.
Cloudflare is used for website routing, content delivery and security. Circle may use necessary authentication and session technologies when a user creates or accesses a community account.
Strictly necessary technologies are not used for behavioral advertising or unrelated user profiling.
6.2 Analytics technologies
Where the user has given consent, States of Mind uses Amplitude and Google Analytics to understand website use, improve functionality and user experience, identify technical issues and analyze navigation patterns.
Analytics data may include an IP address to the extent processed by the provider, device and browser information, analytics and session identifiers, page URLs and page views, referral source, click, scroll and navigation events, timestamps, coarse location data where derived and the user’s consent status.
Amplitude event-level analytics data is retained for 14 months. Google Analytics user- and event-level data is retained for 14 months, or the shortest available setting consistent with the documented analytics need. Genuinely anonymized aggregate statistics may be retained after anonymization.
6.3 Amplitude Session Replay
Where the user has given analytics consent, Amplitude Session Replay may record interactions on permitted and masked website pages.
Session Replay must not capture login credentials, assessment answers, community posts or messages, AI Navigator conversations, newsletter-form content or other special-category data.
Session Replay is not enabled on pages or fields where health, mental-health or other sensitive information may be displayed or entered. Editable fields and user-generated content must be masked where replay is permitted.
Amplitude Session Replay data is retained for 30 days.
6.4 Community authentication and session technologies
When a user creates or accesses a States of Mind community account, Circle may use cookies or similar technologies necessary to authenticate the user, maintain the signed-in session, provide members-only content, protect the account and operate community functionality.
These technologies are necessary to provide the community service requested by the member. Refusing or blocking them may prevent the user from signing in or using the community.
Community content and account data are governed by the States of Mind Privacy Policy and Terms of Use.
6.5 Assessment and AI Navigator session technologies
The mental-health self-assessments and AI Navigator may use a temporary session identifier or comparable technical storage to maintain the active feature session and associate responses with the correct result or conversation.
The assessment and AI Navigator features are optional. Separate consent and, where health information is processed, explicit consent are required under the flows described in the Privacy Policy.
Assessment answers, assessment results, AI Navigator messages and health-related content must not be transmitted to Amplitude, Google Analytics or Session Replay.
6.6 Consent-preference technologies
States of Mind may store a consent-preference record so that the website can remember whether the user accepted or rejected optional technologies.
This storage is considered necessary to respect and implement the user’s privacy choice and to prevent optional analytics from repeatedly loading or requesting consent contrary to that choice.
The consent-preference record is retained only for the period necessary to remember and demonstrate the applicable choice. Its exact storage identifier and expiry period must be displayed in the live Cookie Settings panel.
7. Current technology register
The following register describes the technologies documented for the current States of Mind configuration. Exact cookie or storage names and browser-device lifetimes must be shown in the live Cookie Settings panel and must correspond to the production configuration.
| Category | Provider or technology | Purpose | Optional consent | Documented server-side retention |
| Strictly necessary website and security technologies | States of Mind and Cloudflare | Secure website delivery, routing, protection against abuse and operation of requested website functions | No, where strictly necessary | Limited to the applicable technical and security purpose |
| Consent preference | States of Mind | Record and implement the user’s cookie choices | No | For the period necessary to remember and demonstrate the choice |
| Community authentication and session | CircleCo, Inc. | Create and maintain community accounts, authenticate members and provide members-only features | No, where strictly necessary for requested community access | Community account retention is described in the Privacy Policy |
| Analytics | Amplitude, Inc. | Website analytics, functionality improvement and navigation analysis | Yes | 14 months for event-level analytics |
| Session Replay | Amplitude, Inc. | Analyse interactions on permitted, masked pages and identify usability or technical issues | Yes | 30 days |
| Analytics | Google Ireland Limited / Google Analytics | Website analytics and aggregate usage measurement | Yes | 14 months, or the shortest available setting consistent with the documented need |
| Assessment or AI feature session | States of Mind backend infrastructure | Maintain an active assessment or AI Navigator session and associate responses with the requested result or conversation | Separate feature consent applies; strictly necessary session storage may be used once the feature is requested | As described in the Privacy Policy for the relevant feature |
8. Technologies not used for advertising
States of Mind does not use cookies for behavioural advertising, retargeting or the sale of browsing profiles.
States of Mind does not permit Amplitude, Google Analytics or Session Replay to collect mental-health assessment answers, community content, AI Navigator conversations or other special-category data.
The newsletter processing recorded for States of Mind includes subscription, consent, delivery and bounce information. The current RoPA does not record the use of newsletter open-tracking pixels or click-tracking for behavioural profiling. If such technology is introduced, this Cookie Policy and the relevant consent mechanism must be updated before it is used. RoPA SOM (1).docx
9. Cookie consent
Optional analytics and Session Replay are disabled until the user gives consent through the cookie banner or Cookie Settings panel.
The user must be able to accept or reject optional technologies without being required to accept them in order to access ordinary website content.
Consent choices must be presented clearly and must not use pre-selected optional categories. Refusing optional analytics must be as accessible as accepting it.
Consent applies only to the categories and purposes presented when the choice is made.
10. Changing or withdrawing a choice
A user may change or withdraw cookie consent at any time by reopening the Cookie Settings panel available through the website footer or other persistent privacy control.
Withdrawal does not affect processing that occurred lawfully before withdrawal. After withdrawal, States of Mind will stop future collection through the relevant optional technologies and update the consent preference accordingly.
Previously stored cookies may be removed through browser settings. Browser controls may also be used to block or delete cookies, although blocking strictly necessary cookies may prevent certain website or community functions from operating correctly.
11. Consequences of refusing optional cookies
A user may access ordinary website content without accepting optional analytics or Session Replay.
Refusing optional analytics means that States of Mind will not use Amplitude or Google Analytics to measure that user’s website interactions through consent-dependent technologies.
Refusing analytics consent does not prevent the user from subscribing to the newsletter, creating a community account, using an assessment or using the AI Navigator, although those features may require their own separate privacy notices, permissions or consent.
12. Third-party providers and international transfers
Amplitude, Google Analytics and Circle may involve processing by affiliates or subprocessors located outside the European Economic Area.
Where personal data is transferred to a country that has not been recognized as providing an adequate level of protection, States of Mind relies on appropriate safeguards, including applicable Data Processing Agreements, European Commission Standard Contractual Clauses and supplementary contractual or technical measures where required.
Amplitude is configured with EU data residency, but non-EEA support, affiliate or subprocessor access may still occur. Google Analytics processing is governed by Google’s Data Processing Terms and applicable transfer safeguards. Circle processes community account and participation data under its applicable processor and transfer terms.
Further information about recipients and international transfers is provided in the States of Mind Privacy Policy.
13. Third-party pages and embedded services
Where a user follows a link to an external website, social-media page, provider service or other third-party platform, that third party may use its own cookies and similar technologies.
Those technologies are governed by the third party’s own privacy and cookie information. States of Mind does not control cookies placed solely by an external website after the user leaves the States of Mind platform.
Where third-party content is embedded directly within the States of Mind website and the embed uses non-essential cookies, it must remain blocked until the user gives the required consent.
14. Retention
Cookie and browser-storage lifetimes are determined by their technical purpose and configuration. The exact production identifier and expiry period must be displayed in the Cookie Settings panel.
Personal data generated through analytics and Session Replay is retained for the periods stated in this Cookie Policy and the Privacy Policy.
Strictly necessary session technologies are retained only for the duration necessary to maintain the relevant session, secure the website or provide the requested function.
Consent-preference information is retained for the period necessary to remember and demonstrate the user’s choice.
Genuinely anonymized aggregate statistics may be retained because they no longer identify, link to or single out an individual.
15. Changes to this Cookie Policy
States of Mind may update this Cookie Policy where the website, technologies, providers, legal requirements or consent configuration changes.
The Policy and consent mechanism must be updated before States of Mind introduces materially different optional technologies, including new analytics providers, advertising or retargeting technologies, additional Session Replay coverage, tracking pixels, persistent cross-session identifiers or third-party embeds that require consent.
Where a change affects the purposes for which consent was given, new consent will be requested before the changed technology is used.
16. Contact
Questions about this Cookie Policy or the use of cookies and similar technologies may be sent to:
Written correspondence may be sent to:
Pink Elephant, Unipessoal Lda
Edifício Amoreiras Square
Rua Carlos Alberto da Mota Pinto, no. 17, second floor
1070-313 Lisboa
Portugal
