Privacy policy

This is an English translation provided for convenience. The Spanish version is the binding one.

Version 2.6 · in force since October 12, 2026 · replaces version 2.4 of October 2, 2026: it specifies the retention period for server logs and clarifies that measurement does not load until you accept. Before that: version 2.4 added section 5, about the 1-pixel image that emails I send may carry, version 2.3 of September 21, 2026 rewrote the cookieless first-party measurement in section 4, version 2.2 of September 12, 2026 added that first-party measurement, and version 2.1 of August 26, 2026 added the server-side consent record.

1. Who handles your data

The controller of the personal data handled on this site is Francisco Moroso, an individual (natural person), SEO and web development consultant. You can write to me at hola@franciscomoroso.com, which is also the channel for exercising your rights, or use the contact form.

I have not appointed a data protection officer. I answer requests myself.

2. What data I handle, for what purpose and on what legal basis

I only handle the data you give me when you write to me, the data your visit to the site generates and the data generated when you open an email I sent you. This table is the summary; the detail of each item is below.

I do not sell or rent your data. I do not use it for advertising or to build advertising profiles. I do not make automated decisions that produce legal effects for you or affect you significantly: I write every answer you receive.

If at some point I want to use your email for something else, for example to send you content or promotions, that is a different purpose and I will ask you for it separately.

3. Form, WhatsApp and email

The form asks for the minimum needed to answer you: name, email and message. The phone and the situation are optional and help me answer you better. I do not ask for your RUT (Chile's tax ID) or billing details for an inquiry, because I do not need them to answer it.

Submissions go through anti-spam controls: an invisible trap field, a timestamp and a limit on submissions per hour. That limit temporarily stores a hash of your IP address on the server, per hour, based on legitimate interest in the security of the site; the email I receive does not include your IP, only the page you wrote from.

4. Cookies and measurement

When you arrive, this site does not store any measurement cookie and does not load Google Analytics 4. Until you accept, your browser sends nothing to Google: no cookies, no identifier, no cookieless signal. Only if you accept does the measurement load and start writing the _ga and _ga_* cookies.

The banner has two buttons of equal weight, Accept and Reject. Closing it without deciding leaves measurement denied. Advertising signals are permanently denied: I do not use Google Ads, remarketing or social media pixels.

Apart from cookies, the site stores in your browser's local storage your light or dark theme preference, a copy of your answer to the banner, a random identifier associated with that answer and the three values of the first-party measurement I explain below (fm_r, fm_c and fm_f). None of that travels to a third party or serves to track you.

When you accept or reject, that decision is also written to a first-party record on the server, so I can prove it. That record stores four things and nothing more: the server's date and time, the random identifier, your decision and the banner version. It does not store your IP address, your browser or the page you were on, and the identifier does not travel in any cookie: it is sent only at the moment you decide. It is kept for 24 months and then deleted automatically. If you want to know what is there about you, write to me with your identifier and I will give it to you.

You can change your mind whenever you want from Cookie preferences, in the footer: the banner appears again and your new decision replaces the previous one. You can also delete cookies from your browser settings. Withdrawing consent does not affect the lawfulness of what was measured before you withdrew it.

First-party measurement, without cookies. Apart from Google Analytics, this site runs its own measurement in a file on the server, without cookies. It stores something at four moments. In the first three it writes one line. For loading speed it writes up to five, one per metric. All of them carry the date with the time rounded to the full hour, without the minute.

• When you view a page it records the path of that page, which page number it is within the tab (it starts at 1 and does not go beyond 9), the previous page when you came from another page of this same site, the page you entered through, where you came from if you arrived from outside, the campaign tags when the link carried them, whether your screen is mobile, tablet or desktop, the window width band, your browser's base language, the browser and the operating system without version, the approximate country, region and city, and a flag when what you opened is the 404 error page. On the first page of each tab, the three values the site leaves in your browser are added: whether you had visited the site before, the month of your first visit and the source of that first visit.
• When you take a contact, interest, navigation or reading action it records the name of the action, the path, the page number, where you came from, the campaign tags, the page you entered through, whether it is mobile, tablet or desktop, the country and the same three values from your browser. The actions come from a closed list I defined beforehand: tapping the WhatsApp button, submitting the contact form, starting to fill it in, the submission failing, clicking my email or my phone, going to the diagnosis from its button, going from a post to the contact page or to a service, going from the portfolio to a service, downloading a resource and leaving for a client's site. Also clicking the menu or the footer, changing the language or the light or dark theme, deciding on the cookie notice, leaving for another site, opening a service page or a case page, reaching certain parts of those pages, opening a frequently asked question and progressing through a page (a quarter, half, three quarters or all of it). Some also carry a short label saying what it was about, in short-name format, for example the name of the service, the case, the resource or the reading band. Never free text, never what you wrote in the form, never your email or your phone. The frequently asked question you open is recorded by its title, which is site text and not something you write.
• When the tab goes to the background for the first time, or when you close it, it records, only once, the path, the number of that page in the tab's count, where you came from, the page you entered through, whether it is mobile, tablet or desktop, the country, the band of time the page was visible (less than 10 seconds, between 10 and 30 seconds, between 30 seconds and 2 minutes, or more than 2 minutes) and how far you scrolled, rounded to nothing, a quarter, half, three quarters or the whole page. The exact second and the exact point where you stopped are not stored.
• When you stop viewing the page it records, only once per load, how it loaded: one line per speed metric, with the path, whether it is mobile, tablet or desktop, the window width band, the name of the metric and its rating. Nothing else: not where you came from, not the entry page, not the country.

Region, city, browser, operating system and language go only in the page view lines. Action and exit lines do not carry them, so that a contact action is not recorded together with all that data.

Where you came from and which page you entered through are remembered only while the tab stays open. The site keeps them in your browser's session storage, which is a memory of that tab: it holds the source, the campaign if you came with one, the entry page, the page number and the three values from your browser that were sent on entry. It is not a cookie, it does not travel to other sites and it is deleted when you close the tab.

Your IP address and your browser. Every time a line arrives, the server reads your IP address and the description your browser sends about itself (the user agent, and in Chrome, Edge and similar browsers some short signals with the brand, the operating system and whether it is a mobile device). It uses them to classify the visit and they are discarded on the spot: your IP is not stored, whole, truncated or converted into a code, and neither is your user agent. The location comes from the IP. The browser, the operating system and the device type come from the user agent. It is also used to filter out bots. The site does not ask your browser for extra signals with the exact version or the device model.

Location. The country, region and city come from your IP address. The server looks it up in a location database stored on the same server and keeps only the result. The lookup does not go to any external service. The database is DB-IP Lite, which is updated every month. The server also keeps a copy of the previous database in case the new one comes with errors. That copy is the location database, not data about you. The location is approximate: with a VPN, or with mobile internet, it usually shows the provider's city and not yours. If the database does not find the IP, the country is inferred from the time zone your browser reports. The time zone is not sent, only the two-letter country code, and when it does not match any country it is recorded as unknown.

IP Geolocation by DB-IP

What the measurement leaves in your browser. Besides the tab memory, the measurement stores three values in your browser's local storage, which is not cleared when you close the tab:

• fm_r: a 1 indicating that you have already visited the site.
• fm_c: the month of your first visit, for example 2026-10.
• fm_f: the source of that first visit. It is the site that brought you, for example www.google.com, or the campaign tag if you arrived through a link that carried one. Never the full URL. It stays empty if you came in directly.

They are written the first time you view a page of the site and do not change afterwards. They travel to the server only on the first page of each tab and with contact, interest, navigation or reading actions. They are used to know how many visits are new and how many return, which month they come from and how they arrived the first time. They are not a code of yours: anyone who arrived for the first time in the same month and from the same site has the same three values, and the server does not link them to anything that points to you.

To delete them, delete this site's data from your browser settings, in the section for cookies and site data. In a private window they are deleted automatically when you close it. If you delete them, your next visit counts as new.

Loading speed. There are five metrics, the ones Google uses to measure how a site's loading is experienced: how long the main content takes to appear (LCP), how long the page takes to respond when you tap something (INP), how much the content shifts while it loads (CLS), how long the server takes to respond (TTFB) and how long the first thing takes to appear (FCP). Your browser calculates them and sends only the rating, good, needs improvement or poor, according to the thresholds Google publishes. The exact value in milliseconds does not leave your browser. If your browser does not allow measuring one of them, that one is not sent.

Real time. To see how many people are on the site right now, the server also keeps a separate short list. Only page views go into it: for each one it records the minute, the path and whether it was the entry page or not. Nothing else. Actions, exits and loading speed do not go in. That list keeps only the last hour: every time it is written or read, lines older than 60 minutes are deleted.

From the page address only three campaign tags are read: utm_source, utm_medium and utm_campaign, which are the ones links carry when I want to know which campaign or which mailing a visit comes from. Other URL parameters are neither read nor stored, including the click identifiers that advertising platforms add to their links (gclid, fbclid, msclkid and similar).

There is no visit or visitor identifier. No code is generated to represent you, neither random nor derived from your data. The only thing the site knows about your previous visits is in the three values from your browser that I explained above. If you delete them, the site no longer knows.

The honest limit of this: when traffic in a given hour is low, the lines from that hour that share the same source, the same city or the same browser can be regrouped by hand and end up as a single visit. With that, the path of a visit through the site can be reconstructed, and in a city with few visits it narrows down quite a lot who it could have been. That is why, in reports and on the dashboard, the city is only crossed with another data point (for example the channel) when that city adds up to at least 30 visits. With fewer, only the count is shown. The line does not hold your IP, your name or a code of yours. The same server keeps its technical logs with IP, browser and exact time, the ones in section 2 that are kept for 12 months. I commit to not crossing those logs with this measurement and to not using this measurement to identify anyone.

Apart from visits by people, I count how many times the crawlers of AI assistants go through the site, for example those of OpenAI, Perplexity, Anthropic, Amazon or Meta. That count comes from the server's access log, and from each line only the date, the page and the crawler's name are taken. The IP address in that line is discarded when it is read and is not written to any file.

So that nobody fills the disk on purpose, the server accepts a maximum number of lines per minute and per day, and past that cap it stops recording until the rate goes down. The cap applies to the whole site: it does not look at IP addresses or distinguish who each line comes from.

What this measurement does not store, at any of the four moments: your IP address (whole, truncated or converted into a code), your user agent, the version of your browser or of your operating system, cookies of any kind, visit or visitor identifiers, the exact width of your screen, the full language of your browser or the exact value of the speed metrics. That is why this measurement does not need your consent and works the same whether you accept or reject the banner. The records are kept for 26 months and then deleted automatically.

Server logs are a different matter. The web server that hosts the site writes its own access logs, with IP address, like any web server: that is done by the hosting software and not by this measurement. They are outside what I describe here, and the only use I give them within this measurement is the crawler count in the previous paragraph, which does not copy the IP. In section 2 they appear as "Server that hosts the site", together with the rest of the data I handle. It covers the server's access and error logs, for both the site and its testing copy.

5. Emails I send you

The emails I send you from my account may carry a 1-pixel image, which you cannot see, hosted on this site. Each email carries its own image, with a code that only serves to know which email it belongs to. When your email program loads that image, the server records the date and time, the IP address it was requested from and the browser or email program that requested it, together with that code.

To be able to link that record to the email, when I send it I also store on the same server who it was addressed to, the subject, the send date and the identifier Gmail gives the message. That is the same data that is already in the email I sent you.

I use it only to know whether an email was opened and when. I do not cross it with the site measurement in section 4 or with Google Analytics, and I do not share it with anyone. The basis is my legitimate interest in knowing whether my emails arrive and are read (article 13, letter d), and you can object whenever you want.

The record does not always mean that you opened the email. If you use Gmail, the image is requested by a Google server on your behalf, so the IP that gets recorded is Google's and not yours. Some programs, such as Apple Mail, download images in advance even if you do not open the email, and others, such as Outlook, do not load them until you allow it.

Opens are kept for 6 months and then deleted automatically. The record of who I sent each email to follows the period of the email itself, which is in section 8.

If you do not want this to happen, set your email program not to load images automatically. Almost all of them have that option. Without the image, the server receives nothing. You can also write to me so I delete what was recorded about the emails I sent you.

6. Who else sees your data

I do not transfer your data to third parties for them to use on their own account. To run the site and answer you I rely on providers that process data on my behalf and following my instructions:

• Google (Google Workspace): the email account where form messages and our email conversation arrive and are stored.
• Google (Google Analytics 4): site measurement, only if you accepted it.
• Hosting provider: the server that hosts the site, located in Chile, where the technical logs and the email open records are kept.
• Meta (WhatsApp): if you choose to write to me on WhatsApp, the conversation goes through that service and is also subject to WhatsApp's terms.

7. Transfers outside Chile

The site is hosted by a hosting provider located in Chile. The international transfer of data this site makes is the one Google performs: for email, through Google Workspace, and for measurement, through Google Analytics 4 if you accept measurement. Those transfers are covered by the standard terms and the data protection clauses that Google offers its customers. If you choose to write to me on WhatsApp, that conversation also leaves Chile because WhatsApp hosts its servers outside the country, under that service's own terms. If you need the detail of which provider handles which data and under which instrument, write to me and I will give it to you.

8. How long I keep your data

• Inquiries that do not lead to work: until the inquiry is resolved or until you ask for its deletion.
• Clients: for as long as the relationship lasts and, once it ends, for the periods required by the tax and commercial rules that apply to documents and contracts.
• Analytics: 14 months of retention configured in Google Analytics; after that period only aggregated data remains.
• First-party measurement without cookies: 26 months, with automatic deletion. Each line carries what section 4 describes, with no IP, no user agent, no cookies and no identifiers. The real-time list keeps only the last 60 minutes. The three values the measurement leaves in your browser stay there until you delete them.
• Server technical logs: 12 months on the server. Encrypted copy with IP offline for up to 24 months, for security incidents. Copy without IP, with no time limit.
• Email opens: 6 months, with automatic deletion. The record of who I sent each email to, with its subject and date, follows the period for inquiries or for clients listed above.
• Consent cookie: 180 days, or until you delete it.
• Server-side consent record: 24 months from each decision, with automatic deletion. It stores only the date, the random identifier, the decision and the banner version.

"Just in case" is not a retention period. If there is no legal reason to keep something, it is deleted.

9. Your rights

Regarding your personal data you have the right of access (to know whether I handle data about you and which data), rectification (to correct what is inaccurate, outdated or incomplete), erasure (to have it deleted when appropriate), objection (to object to a processing activity), portability (to receive it in a commonly used electronic format) and temporary blocking while I resolve a request for rectification, erasure or objection.

You exercise them by writing to hola@franciscomoroso.com. Tell me which right you want to exercise, over which data, and an email or postal address where you want the answer. Rectification, erasure and objection are always free of charge, and access is too at least once per quarter.

I acknowledge receipt of your request and answer you no later than 30 calendar days afterwards. That period can be extended only once, by up to another 30 calendar days, and if that happens I will let you know. I answer a request for temporary blocking within the following two business days. If I reject your request, I explain why and tell you that you can file a complaint with the Personal Data Protection Agency (Chile's data protection authority) within 30 business days. If I do not answer you in time, you can file a complaint anyway.

10. Security

The site is served over HTTPS, the form sends through authenticated SMTP and access to the server is restricted and protected with dedicated passwords and backups. I review access and updates periodically. No measure is infallible, so I apply the ones that match the real risk of what I handle, which is contact data and not sensitive data.

If a breach occurs that destroys, leaks, loses or alters your data, or that allows unauthorized access, and it results in a reasonable risk to your rights, I report it to the Personal Data Protection Agency through the fastest available means and without undue delay, I keep a record of what happened and, in the cases where the law requires it, I notify you in plain language, telling you which data was affected, what may happen and what I did about it.

11. Minors

This site is aimed at people who hire professional services and not at minors. I do not knowingly collect data from children under fourteen. If you believe a minor in your care sent me data, write to me and I will delete it.

12. Which law applies and since when

Until November 30, 2026, the current text of Chile's Law 19.628 on the protection of private life applies. On December 1, 2026 the amendments introduced by Law 21.719 come into force; that is Chile's new personal data protection law and it creates the Personal Data Protection Agency. This policy is already written to that standard, so nothing changes for you on that date. If you want the detail of what that law requires, I explained it in Law 21.719 on personal data protection in Chile (in Spanish).

13. Changes to this policy

If I change how I handle data, I update this page and raise the version number and the date shown above. The version in force is always published at this URL.