Marco Orta (the "controller"), based in Mexico City, Mexico, is responsible for the personal data collected on ortamarco.me, under Mexico's Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP), published in the Diario Oficial de la Federación on March 20, 2025. For anything related to this policy, email [email protected].

This policy covers the website. If you use Trípode, that tool has its own privacy policy.

1. What data I process, and when

• Contact form: name, email, phone (optional) and message. The notification email I receive also carries the IP address and browser (user agent) the form was sent from.
• Estimator: name, email, phone and company (the last two optional), the project description, the options you picked and the estimated price and hour range. A copy is stored in the site's database along with your browser and a hash of your IP (not the IP itself); the notification email I receive does include the IP and browser. While you fill it in, the draft is saved only in your browser.
• Newsletter: email address and language. The subscription stays pending until you confirm it from the email I send you (double opt-in).
• Support chat: the messages you type. Replies are generated by an AI assistant running on my own backend, which stores the conversation; if you leave contact details in it, I log them as a request. Your browser keeps the chat history so it survives page changes.
• Tool reviews: rating, title, text, name and email (optional). The rating, title, text and name are published only after I approve the review; the email is never published. I also keep the browser and a hash of your IP to catch duplicates and abuse.
• WhatsApp button: clicking it generates a reference code (for example, #OM-K7P2) appended to the pre-filled message, and the click is logged with the page and the attribution cookie data (see section 4). Whatever you write next reaches me inside WhatsApp.
• Browsing data: pages visited, referrer, browser, operating system, device type, language and approximate country, measured with self-hosted analytics (section 4). For a sample of visits the session is also recorded: mouse movement, clicks and scrolling.

What you type into the site's tools (domains, IPs, text you convert) is processed to give you the result and is not stored. For each tool I only count views and uses, as totals not tied to anyone.

I do not ask for or process sensitive personal data.

2. What I use it for

Purposes needed for what you ask me to do:

• Answering messages, preparing estimates and following up on them.
• Answering the support chat.
• Moderating and publishing reviews.
• Protecting the forms from bots and abuse (anti-bot check, per-IP rate limits, duplicate detection).
• Meeting legal and tax obligations if we end up working together.

Purposes that are not required and that you can opt out of (section 6):

• Sending you the newsletter, only if you confirmed it.
• Knowing which campaign or website a request came from (attribution), to decide where it is worth investing.
• Measuring and observing how the site is used to improve content and design.

3. Where it is stored and who else is involved

I do not sell or hand over your data. Contact and estimator submissions, and clicks on the WhatsApp button, are forwarded server-side to my CRM: my own system, hosted on a server I run and used for more than one brand, where your record is tagged as an ortamarco.me contact. The newsletter and the chat live on that same backend.

To run the site I rely on these providers, which process data on my behalf:

• Cloudflare: all site traffic goes through its network (delivery and protection), and its Turnstile service checks that you are not a bot in the chat and in reviews.
• Mailgun: sends the notification emails for contact, estimator and reviews.
• A language model provider: receives chat messages to generate the reply.
• WhatsApp (Meta): only if you choose to message me there; that conversation is subject to WhatsApp's terms.

Some of these providers process information outside Mexico.

4. Cookies, local storage and analytics

• om_attr cookie (first-party, 90 days): set on your first visit, it stores the campaign parameters in the URL (utm_source, utm_medium, utm_campaign, utm_content, utm_term, gclid, fbclid), the external site you came from, the landing page and the date of your first visit. A later visit with a new campaign updates it. It only leaves your browser when you submit the contact form or the estimator, or click the WhatsApp button; the first-visit date is never sent.
• Browser local storage: light or dark theme, chat history and session, and the estimator draft. None of it is sent on its own.
• Umami (self-hosted at analytics.ortamarco.me): measures visits without cookies. It also records 15% of sessions, up to 5 minutes each, and builds heatmaps; recordings mask the content of every form field, but the visible text on the page is captured. According to Umami's documentation, recordings are kept for 30 days.

I do not use advertising cookies or social media pixels.

5. How long I keep it

The om_attr cookie expires 90 days after it was last updated, and session recordings last as stated above. Messages, estimates, reviews, chat conversations and CRM records have no scheduled automatic deletion today: I keep them while they serve the purpose you gave them to me for, and delete them when you ask.

6. How to limit the use of your data

• Delete the om_attr cookie and the site's local storage from your browser settings.
• Block scripts from analytics.ortamarco.me with a content blocker so your visits are not measured or recorded. The site has no built-in switch for this today.
• Email [email protected] to leave the newsletter or to ask me to stop contacting you.

7. ARCO rights

You can request Access, Rectification, Cancellation or Opposition (ARCO) regarding your data at any time, or revoke your consent, by emailing [email protected]. The request must include your name and a way to reply to you, a document proving your identity (or your representative's), a description of the data and of the right you want to exercise, and anything that helps locate the data.

I will send you my answer within 20 days of receiving the request and, if it applies, carry it out within the following 15 days. The process is free. If I do not reply or you disagree with the answer, you can file a data protection request with the Secretaría Anticorrupción y Buen Gobierno (Ministry of Anti-Corruption and Good Governance), which took over the functions of the former INAI and is now the authority on this matter.

8. Changes to this policy

Any change is published on this same page and reflected in the "Last updated" date.