Privacy policy

Last updated October 23, 2026

I keep only what I need to build your site, answer you, bill you and understand how this site is used. I don't sell your personal information for money.

The short version

• I count visits on my own server, without cookies, and my measurement doesn't store your IP address.
• Tools from other companies (Google Analytics, Meta, Google Ads and TikTok) load only if you say yes in the cookie notice. If none of them is turned on, the notice doesn't even appear.
• I honor the Global Privacy Control (GPC) signal.
• You can change your choices anytime with Cookie settings or Do Not Sell or Share My Personal Information at the bottom of every page.

What I collect

• Public business details, to build a preview: your business name, phone, services, address or service area, and the public email address I write to.
• What you send me by email: your name, email, the phone and email you want on your site, the changes you ask for, and your domain.
• Payment details, handled by Stripe. I see your name, email, the amount and the last four digits of the card. I never see your full card number.
• Visits to this site: see Cookies and measurement and Server logs.

How I use it

• To build and send your preview, put your site live and keep it running.
• To answer your emails and make the changes you ask for.
• To bill you and keep the payment records the law requires.
• To see which parts of this site work, with the measurement described below.

Cookies and measurement

What I measure myself

My own measurement script runs on these pages and sends data only to my own server, at the same address as the site. It records:

• the page you opened, the website that sent you (only its domain, such as google.com) and campaign tags like utm_source, and the date and time;
• how far you scrolled, which sections you reached, and how long each section was on screen while the tab was visible;
• where on the page you tapped or clicked, and which button or link it was;
• the type of device (phone, tablet or computer, from the screen width) and your country (a two-letter code).

No cookies, and no IP address in my measurement. The script doesn't set cookies or store anything on your device for measurement. To group the pages of one visit, my server computes an anonymous code from a random secret, your IP address and your browser's user agent. The IP address itself is not stored in my measurement data. The secret is replaced every day and the old one is deleted, so one day's codes can't be linked to the next day's. If you come back tomorrow, you count as a new visitor. I keep this data in a form that can't reasonably be linked to you, I won't try to re-identify it, and I require the same of anyone who handles it for me.

If you turn Measurement off (or choose Reject all), I only count the visit and the buttons you tap. I don't record where on the page you tapped or how long you spent on each section.

This data stays with me. It's never sent to another company.

Your cookie choices

The cookie notice offers three buttons with the same weight: Accept all, Reject all and Choose. Nothing is pre-selected. You can change your mind anytime with Cookie settings at the bottom of every page, and I'll show "Your choices are saved." when it's done.

Necessary

Remembers your choice on this device, in your browser's local storage as fm_consent, not in a cookie. It comes from firmonte.com and can't be turned off: without it, I'd ask on every page.

Measurement

My own detailed measurement (where people tap, time on each section), without cookies, on my server. Google Analytics 4, if it's on, sets cookies to measure site use. You can turn it off: then I only count visits and button taps, and Google Analytics doesn't load.

Marketing

Lets Meta Pixel, Google Ads and TikTok Pixel set cookies and get data about your visit, to show and measure my ads. It's off until you accept, and always off with GPC.

The notice only names the tools that are turned on. If I turn on a tool from another company that you haven't seen before, the notice asks you again before it loads. Your choice is kept for 12 months; after that, the notice asks again.

Cookies these companies may set once you accept (each company decides and publishes its own durations):

_ga, _ga_*

Google (Analytics): tells visits apart over time. Up to 2 years.

_gid

Google (Analytics): tells visits apart within a day. 24 hours.

_gcl_au, _gcl_*, _gac_*

Google (Ads): links a visit to an ad click. Up to 90 days.

_fbp, _fbc

Meta: links a visit to Meta ads. Up to 90 days.

_ttp, ttcsid*

TikTok: links a visit to TikTok ads. Up to 13 months.

When you withdraw consent, my script deletes these cookies from firmonte.com and reloads the page so the tools stop. Google, Meta and TikTok handle the data they receive under their own privacy policies.

Google Analytics runs in Google's consent mode, with Google signals and ad personalization off unless you also accept Marketing. Meta's automatic setup and advanced matching are off.

Do Not Sell or Share, and GPC

I don't sell personal information for money. Under California law, letting advertising companies get data about your visit ("cross-context behavioral advertising") can count as sharing, and other states call it targeted advertising. The Marketing category is that, and it's off unless you turn it on. You can opt out by:

• choosing Reject all, or turning Marketing off in Choose;
• using Do Not Sell or Share My Personal Information at the bottom of any page, which opts you out with one tap;
• turning on Global Privacy Control in your browser. I treat GPC as a valid opt-out request: Marketing stays off even if you click Accept all, and the page shows "Opt-Out Request Honored".

Your opt-out applies to the browser you use. If you clear your browser data, or use another browser or device, you'll need to choose again there (GPC is applied automatically wherever it's on).

I don't sell or share the personal information of anyone I know is under 16.

Website previews I send to businesses

I build sample websites for businesses and email them a link such as firmonte.com/p/business-name/. On those pages I record when the preview was opened, on which type of device and from which country, without cookies. These records are linked to the business the preview was made for, not to anyone's name or email. I keep them for 12 months after I send the link, or delete them sooner if the business asks: reply "stop" to my email. Preview pages load no tools from other companies, so they show no cookie notice.

Email security filters often open links on their own. I only count an opening when the page actually ran in a browser, stayed visible for a few seconds and saw a person's gesture (a scroll, tap, mouse move or key press), and I discard known robots.

Server logs

Traffic to this site passes through Cloudflare, which protects it and makes it faster. To do that, Cloudflare processes technical data about each visit, such as your IP address and browser, and it may set a security cookie of its own if it needs to check that a visit isn't automated.

My web server keeps a basic access log (IP address, date and time, the page requested, the page that sent you and your browser) to keep the site secure and to meet record-keeping duties in Brazil, where my server is. I keep it for 6 months and don't use it for measurement or ads. The requests my measurement script sends are not written to this log.

Who else sees it

I don't sell or rent your data. I share it only with the services I need to do the work: Hostinger (my email), Stripe (payments), Cloudflare (protects traffic to this site), an AI service that helps me write emails and build previews, and the companies that host your site and register your domain. Each of them handles your data under its own privacy policy. If you accept Marketing or Measurement in the cookie notice, the companies behind those tools also get data about your visit, as described above.

In the last 12 months I haven't sold personal information. Data about visits went to Meta, Google or TikTok only from people who accepted Marketing.

Emails from me

If you don't want emails from me, reply "stop" and I won't write again.

How long I keep data

Detailed visit events

Pages, scrolling, taps and sections: 90 days.

Daily totals

Numbers only, no visitor codes: as long as the site exists.

Cookie choices

Anonymous daily code, choice, notice version, GPC, page and time: 2 years, as proof of your choice.

Preview records

When it was opened, device type and country: 12 months after I send the link.

Server access log

IP address, date and time, page and browser: 6 months.

Emails

Up to 5 years after our last email.

Payment records

As long as tax law requires, usually 5 years.

Your choices and rights

Depending on where you live (for example California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon and other U.S. states with privacy laws), you may have the right to:

• know what personal information I have about you, where it came from and why, and get a copy;
• correct it;
• delete it;
• opt out of sale, sharing and targeted advertising (see above);
• appeal if I deny your request;
• not be treated differently for using these rights.

Email [email protected]. I'll confirm I got your request within 10 business days and answer within 15 days. I'll ask you to confirm the request from the email address you used with me. An authorized agent can make a request for you if they send your signed permission. Because my measurement is anonymous by design, I usually can't find visit data about a specific person; when that's the case, I'll tell you. For data that Google, Meta or TikTok received after you accepted, you can also contact them directly. I delete your data unless the law requires me to keep it, such as payment records.

If I deny your request, you can appeal by replying "appeal". I'll respond within 45 days. If you're not satisfied, you can contact your state attorney general.

If you're in Brazil, you also have rights under Brazil's LGPD, and you can complain to the ANPD.

I don't collect sensitive personal information.

Where your data is

I'm based in Brazil, and my server is in Brazil. Your data may be processed in Brazil, in the United States and in other countries where the services listed above operate.

Children

This site and my services are for businesses and adults. I don't knowingly collect data from children under 16.

Changes to this policy

If I change this policy, I'll post the new version here with a new date. If a change affects your cookie choice, the notice asks you again.