Cookie Policy

Technology Categories

• Necessary technology supports site security and basic functions, stores your policy-bound privacy selection, and may store separate opaque Analytics and Advertising withdrawal capabilities after a purpose-authorized project inquiry. For up to 30 minutes in the same tab, it may also store one pending inquiry's random event ID, frozen non-form measurement context, and event-salted form digest so an interrupted submission can be retried without storing names, contact-field values, or event details. It is always active because the site must safely complete requests and remember and honor your choices.
• Optional analytics technology creates a random browser identifier in local storage and a random tab-scoped session identifier in session storage. It measures query-free page paths, stable route and service codes, active visible engagement, and typed form or contact events without storing form-field values.
• Before you choose, the site may read allowlisted UTM fields, advertising click identifiers, the external referrer hostname, and a query-free landing path into temporary browser memory. They are not written to browser storage or transmitted before analytics consent. Denial clears them; analytics consent permits optional attribution storage so campaign performance can be connected to a later inquiry.
• Optional advertising technology permits authorized marketing tags managed through Google Tag Manager. Those tags may use provider cookies or identifiers for campaign and conversion measurement according to the provider's terms and your advertising choice. Separately, while Advertising is granted and Global Privacy Control is not enabled, the site may retain allowlisted Google and Meta click or browser identifiers for consented server-side lifecycle conversion delivery.
• After a consented project inquiry, Supabase may queue server-owned lead, contact, qualification, proposal, contracted, or not-contracted lifecycle events. Authorized events may be delivered from the server to Google Analytics 4 through Measurement Protocol, to Google Ads through Google Data Manager, and to Meta through the Conversions API. These server deliveries do not load provider code in the browser.
• For campaign measurement, a qualified inquiry from an approved paid landing page may carry a versioned modeled USD value based on its service category. This estimate is not a quote, invoice, contract price, or actual revenue. If services are contracted, a verified contracted amount may replace the estimate for closed-won reporting.

Consent and Google Tag Manager

Analytics and advertising are separate choices. Google Consent Mode begins with analytics storage, ad storage, ad user data, ad personalization, functionality storage, and personalization storage denied; security storage remains granted for security-related processing. The external Google Tag Manager container is not requested unless you grant analytics, advertising, or both. Granting analytics does not grant advertising, and granting advertising does not create our first-party analytics identity.

If you grant advertising without analytics, Google Tag Manager may receive approved PII-free page and action events containing a random event ID and time, query-free path, language, and stable route or action codes. It does not receive our first-party browser or session identifiers, analytics attribution, or form-field values in that state.

We treat an enabled Global Privacy Control signal as a request to deny Advertising. It does not automatically deny the separate Analytics choice. Privacy selections are tied to this site and policy version and expire after 180 days, after which the site asks again.

How We Use These Technologies

• To connect consented page journeys and contact attempts to a later project inquiry.
• To understand which marketing channels generate project inquiries.
• To improve service pages, landing pages, forms, and response workflows.
• To measure authorized advertising conversions without placing names, email addresses, phone numbers, company names, project details, or form values in the browser data layer.

Your Choices

You can accept all optional technology, use necessary technology only, or independently enable analytics and advertising. Forms and contact links work regardless of your choice. You can reopen Cookie settings in the footer at any time. Denying analytics clears optional analytics identifiers and attribution from your browser, cancels active first-party analytics requests where possible, stops future first-party journey collection, and uses the opaque Analytics capability stored in that browser to suppress unsent Analytics lifecycle work for that inquiry. Denying advertising updates advertising signals and uses the separate opaque Advertising capability to suppress unsent advertising-conversion work. You may also clear site data in your browser.

If a withdrawal service is temporarily unavailable, the browser retains the opaque pending withdrawal and retries it in limited batches when the site remounts, the browser returns online, or the retry timer expires. Re-enabling a category later does not cancel a withdrawal already requested for earlier work.

A withdrawal can suppress work that has not been sent. An event already accepted by Google Analytics 4, Google Ads, or Meta cannot be recalled by changing a browser preference.

Changing a browser preference does not automatically erase business, CRM, or analytics records already received. To request deletion where applicable, contact us using the address below.

Retention

The browser privacy preference expires after 180 days or sooner if you clear site data. We have not yet approved fixed, category-specific database retention periods or enabled an automated deletion schedule for anonymous or converted journeys, campaign identifiers, diagnostics, and business inquiries. Bounded administrative cleanup tools do not run on a schedule by themselves. Until periods and schedules are approved, records may remain in active systems and provider-managed backups for longer than a defined period, subject to operational, security, legal, and recordkeeping needs.

Service Providers

Netlify provides website hosting, delivery, and related request-security infrastructure. Supabase processes project-form records, consent snapshots submitted with those records, first-party journeys, lifecycle outcomes, withdrawal state, and delivery diagnostics. HubSpot processes contact, project, sales-stage, proposal, and contracted or not-contracted information as our CRM; it is contacted by our server rather than loaded as a browser tag. While Analytics remains authorized, configured HubSpot Deal properties may also receive a stable attribution model and campaign-page code, channel classifications, and only a registry-authenticated paid campaign identifier and query-free paid landing path. This CRM projection excludes referrer values, search terms, ad content, click identifiers, and contact information used for attribution, and a recorded Analytics withdrawal suppresses it before claim. Google Tag Manager remains our sole boundary for optional browser marketing tags. Separately, Supabase-authorized server lifecycle delivery may use Google Analytics 4 Measurement Protocol, Google Data Manager for Google Ads, and Meta Conversions API. GA4 lifecycle delivery does not include contact information and marks ad user data and ad personalization denied. When Advertising was authorized, Google Ads and Meta may receive consented click or browser identifiers and just-in-time normalized SHA-256 contact hashes for matching. Our delivery system does not persist outbound provider payloads or response bodies. Each provider processes received data under its own terms and our applicable agreements.