How we collect, use, and protect your information.
Last updated: October 16, 2026 · WPSubstrata
We use Google Analytics 4 to understand how the site is used, but only if you accept analytics cookies. Nothing optional is set until you choose. You can change or withdraw your choice at any time with the "Cookie settings" link in the footer. We don't sell your data or use it for advertising.
We use one strictly necessary cookie to remember your cookie choice, and — only if you accept — cookies set by Google Analytics 4. The analytics cookies are not advertising cookies. They help us understand which pages are visited and how visitors move through the site.
Strictly necessary:
cc_cookie — remembers which cookie categories you accepted or rejected. Kept for 6 months.Analytics (only set with your consent):
_ga — distinguishes one visitor from another. Expires after 2 years._ga_<container-id> — maintains session state for this property. Expires after 2 years.With your consent, we also use Microsoft Clarity to record how visitors use the site — clicks, scrolling and other page interactions — so we can see what works and what doesn't. Clarity sets cookies such as _clck and _clsk.
You can change or withdraw your consent at any time with the "Cookie settings" link in the footer. You can also block or delete cookies through your browser settings. Blocking them does not affect how the site works.
We use Google Analytics 4 (GA4), a service provided by Google LLC, to understand how the site is used. GA4 is loaded through Google Tag Manager and only runs after you accept analytics cookies. If you reject them, GA4 does not set cookies and does not collect data about your visit.
What GA4 collects:
What GA4 does not collect:
Google acts as a data processor for this data. Google may transfer data to servers outside the European Economic Area, including the United States, under the EU–US Data Privacy Framework and standard contractual clauses. You can read Google's own privacy policy at policies.google.com/privacy.
Analytics data is used only to understand which pages are visited and to improve the site. It is never sold, shared with third parties for advertising, or used to build advertising profiles.
If you choose to book an appointment, a booking widget from Cal.com, Inc. (USA) is used on the booking page. The embed script is loaded when the booking page loads, but the booking interface itself only opens when you click the "Pick a time" button. Until you click, no booking interface is displayed and no booking data is collected.
When you click the button, Cal.com opens an overlay on top of the page and loads its booking interface inside an iframe served from app.cal.com. Cal.com may set its own cookies and process technical data (such as your IP address and browser information) as part of serving that interface.
When you complete a booking, Cal.com processes the information you submit (name, email, selected time slot) in order to schedule the appointment. Cal.com acts as a data processor on your behalf for that purpose. Cal.com, Inc. is based in the United States, so data may be transferred outside the European Economic Area, including to the United States, under the EU–US Data Privacy Framework and standard contractual clauses. You can review Cal.com's own privacy policy at cal.com/privacy.
We receive only what is necessary to confirm and conduct the appointment.
When a booking is completed, Cal.com sends a notification to our page so we can record the booking as a conversion in Google Analytics 4. This notification contains only the event type and booking metadata (such as the event name and time slot). It does not include the personal details you entered into the booking form, and it is only processed if you have accepted analytics cookies.
When you send us a message through the contact form, the information you enter (your name, email address, optional website URL, and message) is submitted to a Cloudflare Worker, a serverless function running on Cloudflare's network, which forwards it to us by email. The Worker acts as a data processor for this purpose and may process technical data such as your IP address as part of handling the submission. Cloudflare's own privacy policy is available at cloudflare.com/privacypolicy.
To protect the form from spam and automated abuse, we use Cloudflare Turnstile, a service provided by Cloudflare, Inc. Turnstile may process technical data such as your IP address, browser information, and interaction signals in order to determine whether you are a human visitor. Turnstile is designed to avoid tracking you across sites and does not use the data it collects for advertising. Cloudflare acts as a data processor for this purpose. Cloudflare, Inc. is based in the United States, so data may be transferred outside the European Economic Area, including to the United States, under the EU–US Data Privacy Framework and standard contractual clauses. You can review Cloudflare's own privacy policy at cloudflare.com/privacypolicy.
We use the information you submit only to read and reply to your message. We do not add you to any mailing list, and we do not share it with anyone else.
When you buy WPSubstrata Deployer or server care, the purchase is processed by Gumroad, Inc. ("Gumroad"), which acts as the merchant of record. Gumroad collects your name, email address, billing address, and payment details in order to process the payment, issue invoices, and handle VAT. We do not receive or store your card details. Gumroad's own privacy policy is available at gumroad.com/privacy.
For the WPSubstrata setup fee and the optional monthly infrastructure care fee, which are invoiced directly by us rather than through Gumroad, payment is made by bank transfer or through a payment service such as Payoneer or Ruul. Depending on the method you choose, the provider may collect your name, email address, billing details, and payment information in order to process the payment and issue invoices. We do not receive or store your card or bank details. Payoneer's privacy policy is available at payoneer.com, and Ruul's at ruul.io.
This site is served through Cloudflare's network for performance and security. Cloudflare may process IP addresses at the network level as part of routing and DDoS protection. This is standard infrastructure operation and no data is shared with us from this process. See cloudflare.com/privacypolicy.
Your cookie choice is remembered for 6 months in the cc_cookie cookie. Analytics data is retained in Google Analytics 4 for 14 months, after which it is automatically deleted. The _ga cookies expire after 2 years unless you clear them sooner. Booking information is held only as long as necessary to fulfil the appointment. Contact form messages are kept in our email inbox only as long as needed to handle your enquiry and any follow-up.
Under the GDPR you have the right to access, correct, or delete personal data we hold about you, and to object to processing based on legitimate interests. The analytics data we hold is pseudonymous (linked to a random client ID, not to your identity), but you can still ask us to delete it.
To exercise any of these rights, email us at [email protected]. You can also opt out of Google Analytics across all sites by installing Google's official browser add-on: tools.google.com/dlpage/gaoptout.
If anything changes, we will update the date at the top of this page. We will never introduce advertising or profiling technologies without making that explicitly clear.
Analytics cookies are only set after you give consent, and you can change or withdraw that consent at any time with the "Cookie settings" link in the footer.