Privacy Policy.

Who we are

In plain terms: Web Wombats LLC is the data controller for this website.

Web Wombats LLC ("Web Wombats", "we", "us") is a privacy-first measurement-engineering consultancy serving multi-market enterprise teams. For any privacy matter, contact our email address. Postal address: Web Wombats LLC, 3833 Powerline Rd, Suite 201, Fort Lauderdale, FL 33309, USA. Full details in the imprint.

Cookies, consent and analytics

In plain terms: nothing but the essentials runs until you say yes, and you can change your mind whenever you like.

• Consent is denied by default. Our own consent tool asks you before anything non-essential loads. It runs on our own domain and loads nothing from third parties. Statistics and marketing categories stay off until you actively allow them.
• We respect Global Privacy Control. If your browser sends this signal, marketing stays off unless you switch it on yourself.
• Tags are managed through Google Tag Manager. The container itself is loaded from Google's servers; it sets no cookies on its own, and every analytics or marketing tag inside it stays dormant until you consent. We are moving tag delivery to a first-party endpoint we operate, which will reduce what leaves our control by default.
• Fonts and assets are self-hosted. Your IP address is never disclosed to a font or CDN provider simply for loading this page.
• We never sell your data. If you allow statistics or marketing cookies, information about your visit may be shared with the providers behind those tools (for example Google) so we can see how this site and our own campaigns perform. They process it under their own terms as independent controllers. None of this happens unless you consent, and you can withdraw at any time.

You can review or withdraw your consent at any time through the Cookie settings link in the footer of every page, which reopens the dialog and lists every cookie in use and its purpose. Consent-based processing rests on Art. 6(1)(a) GDPR; strictly necessary cookies rest on Art. 6(1)(f).

To be able to prove the choice you made (Art. 7(1) GDPR), we keep a record of each decision: a random consent ID that is also stored in the ww_consent cookie, the time, your choice per category, the version of the banner you saw, the banner language and the page path. We do not store your IP address or any details about your browser. Records are deleted automatically after three years. Legal basis: Art. 6(1)(c) GDPR.

Our hosting provider processes technical connection data (such as IP address and requested URL) in short-lived server logs, as is technically necessary to deliver the site and defend it against abuse (Art. 6(1)(f) GDPR).

Page views are counted with Vercel Web Analytics, without cookies: the path visited (never the query string), country, device type, browser and referring website. Visitors are told apart only by a hash that changes every day, so no one is recognised across days. The legal basis is our legitimate interest in knowing which pages are used (Art. 6(1)(f) GDPR).

Information you choose to send us

In plain terms: we receive data when you email us or book a call, not before.

• Email. If you write to us, we process your name, email address and the content of your message.
• Booking. If you book a call, scheduling is handled by Cal.com, Inc. as our processor; it processes the name, email address and time slot you enter.
• Engagement preparation. If we move toward working together, we process company details and technical information you share with us.

Free tracking scan

In plain terms: the scan only reads what a website shows publicly, and we only use your email after you confirm it.

• The scan. When you enter a domain on our Live-Check page, our server loads the publicly available pages of that website (its homepage, up to three linked country versions, its own script files and its public Google Tag Manager container) and checks them for tracking-related settings. We do not log in, set cookies on or change anything on the scanned website. We store the domain entered, the result and the time of the scan to show you your report and to improve the scan.
• Full report by email (double opt-in). If you request the full report, we store your email address together with the scan result, the time and IP address of your request and the wording of what you requested, and send you a confirmation link. The report only unlocks when you click it. We then also store the time and IP address of your confirmation as proof of your consent. Without confirmation we do not contact you.
• Follow-up. After confirming, you may receive one personal follow-up email from us about your result. There is no newsletter. You can withdraw your consent at any time by replying to any of our emails or writing to our email address; we then delete your email address.
• Processors. The website and the scan run on Vercel Inc. Scan results and requests are stored with Supabase Inc. on servers in Frankfurt, Germany. Confirmation emails are sent through Resend (Plus Five Five, Inc.) from its EU region in Ireland. All three act as our processors under data-processing agreements.
• Legal basis. The scan rests on Art. 6(1)(f) GDPR (our legitimate interest in providing the scan you request). The email, the full report and the follow-up rest on your consent, Art. 6(1)(a). Keeping proof of your consent rests on Art. 6(1)(c) in conjunction with Art. 7(1) GDPR.
• Retention. Scans without an email request are deleted after 90 days, unconfirmed requests after 30 days. Confirmed requests are kept until you withdraw your consent, at the latest 24 months after our last contact.

If you have allowed statistics cookies, the steps of the scan (started, completed, report requested) are measured as described in § 2, without your email address.

Why and on what legal basis

In plain terms: to answer you, and to prepare and perform contracts.

We use the information above to respond to inquiries, prepare proposals, perform engagements and maintain our business relationship. Legal bases under the GDPR are Art. 6(1)(b) (steps prior to, and performance of, a contract) and Art. 6(1)(f) (our legitimate interest in operating and developing our business). We do not use your data for advertising, and we do not build profiles.

Sharing

In plain terms: we never sell data; a small set of vetted processors keeps our operations running.

We do not sell, trade or rent personal information. We share it with service providers that support our operations (hosting, database, scheduling, email) under data-processing agreements, and, where you have consented to statistics or marketing cookies, with the analytics and advertising platforms behind those tools (for example Google), which act as independent controllers under their own terms. We also share it where required to comply with legal obligations, or to establish, exercise or defend legal claims.

Client engagement data

In plain terms: data inside your analytics stack stays yours, governed by our engagement contract.

In engagements we access client measurement systems (for example analytics properties, tag management containers and data warehouses). We act on documented instructions, access the minimum necessary, and process such data exclusively under the applicable engagement agreement and data-processing agreement, never for our own purposes. This website policy does not govern that processing; your contract does.

Retention

In plain terms: we keep correspondence as long as the relationship needs, then delete it.

We retain personal data only as long as necessary for the purposes above or as required by statutory retention duties (for example commercial and tax law), and delete it afterwards. Retention periods for the tracking scan are listed in § 4.

International transfers

In plain terms: we are US-based and use contractual safeguards for EEA, UK and Swiss data.

Web Wombats LLC is established in the United States. Where personal data of individuals in the EEA, the United Kingdom or Switzerland is transferred to us or our processors, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

Your rights

In plain terms: ask us, and we will show, correct, hand over or delete your data.

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion, or restriction of processing
• Object to processing based on legitimate interest
• Receive your data in a portable format

Write to our email address. If you are in the EEA, UK or Switzerland, you may also lodge a complaint with your supervisory authority.

Security

In plain terms: least access, encryption in transit, and a site with no attack surface to speak of.

We apply appropriate technical and organizational measures, including transport encryption, least-privilege access and vendor due diligence, to protect personal data against unauthorized access, alteration, disclosure or destruction. No method of transmission over the internet is entirely secure; we design for that reality rather than promising it away.

Changes

In plain terms: the current version lives at this address, with its date at the top.

We may update this policy as our services or the law evolve. The version published here, with the "last updated" date above, is the applicable one.

Cookie declaration

In plain terms: every cookie this site can set, listed in full.

The table below is generated from the same configuration that controls the consent banner, and we check it against what the site actually sets before every release. Use Cookie settings to change or withdraw your consent at any time.