Privacy policy.

Whitelam Media (the "Studio") is the data controller for personal information collected via this site. Contact: info@whitelam.media. Address: Avenida de Manoteras, 38, Madrid, Spain.

We collect only the data needed to do the work. Specifically:

• Contact form submissions: name, email, optional company, optional budget, optional message, IP address, user agent string. Stored in our database for as long as the relationship is active, plus 3 years.
• Newsletter subscribers: email address, source page (which page the form was on), subscription date. Stored until you unsubscribe.
• Bookings (call requests): name, email, optional company, visitor timezone, optional notes, IP, user agent. Stored for the duration of the relationship plus 3 years.
• Clients: name, email, company, phone, country, Stripe customer ID, payment history. Stored for the legal retention period (typically 6-7 years for tax records).
• Payments: the amount, currency, description, payment intent ID and your billing address are stored both with us and with Stripe. We never see or store full card numbers.
• Page views on this site: which page you looked at, the page you came from, how long the page was open, your approximate location (country, region and city, worked out by our host from your connection; we do not store your IP address) and your device, browser and operating system. We also record the network you are on, for example your internet provider, so we can filter out bots. If analytics is on, a random visitor ID and a per-tab session ID are added, and if you arrived from a link in an email we sent you, which email it was. If analytics is off, none of those identifiers are recorded. Kept for as long as it helps us understand how the site is used, and deleted on request.
• Google Analytics: only if analytics is on. Pages viewed, how you arrived, approximate location and device type, linked by the Google Analytics cookies described below. We do not send your name, email address or form contents to Google.
• Free Search Check: the website address you check and the result, which describes that site's public pages. If you ask us to email you the report, your email address and whether you confirmed it. We do not store your IP address with a check. Kept while the report link is useful to you, and deleted on request.
• Website Health Check: the website address you check and the result, which describes that site's public pages and settings. We do not store your IP address with a check. Kept while the report link is useful to you, and deleted on request.
• Free tools waitlist (Free Search Check and Website Health Check): your email address, the page you signed up on and the date. Kept until we have emailed you that the tool is open, or until you ask us to delete it. It is not added to the newsletter.
• Error reports: when something breaks in your browser, we receive the page address, the technical details of the error and which browser you use, so we can fix it.

• To respond to inquiries and deliver the work you've commissioned.
• To send transactional emails (invoices, receipts, booking confirmations, support notifications).
• To keep tax and accounting records as required by law.
• To understand which pages on our own site get read so we can improve them, and to see when someone we have emailed opens the page we sent them.
• To confirm your email when you ask for a Free Search Check report and, once you have confirmed it, to follow up once about it.
• To send you one email when the Free Search Check or the Website Health Check opens, if you joined its waitlist.
• To find and fix errors on the site.

We do not profile you, do not sell your data, do not run retargeting ads and do not share your information with marketing platforms.

• Stripe (payment processing). See their privacy notice.
• Resend (transactional email delivery).
• Neon (Postgres database hosting, EU region).
• Vercel (website hosting and edge network, plus Vercel Web Analytics and Speed Insights, which count page views and measure page speed without cookies).
• Google Analytics (site analytics, only when analytics is on).
• Google Workspace + Google Calendar (booking integration, email correspondence).
• Anthropic (the Free Search Check sends the checked website's public details, such as its name, what it does and where, to Claude to write and ask three questions a buyer might ask. Nothing about you is sent).
• Google PageSpeed Insights (the Website Health Check sends the checked website's address to Google's free speed test. Nothing about you is sent).
• Sentry (error monitoring. It receives error reports only: no performance tracing, no session recordings and no cookies. We do not send it names, email addresses or form contents).

Each of these is a sub-processor bound by their own terms and our written data-processing terms with them where applicable.

This is the full list of what the site stores in your browser and what it loads. Nothing here is used for advertising, and we do not sell or share your personal information.

Your choice

In the EU, the EEA, the UK, Switzerland and Brazil we ask before anything that identifies you runs: no analytics cookies and no Google Analytics until you say yes. Everywhere else, including the US, analytics is on by default and you can turn it off. If your browser sends a Global Privacy Control signal, we treat it as a no wherever you are and do not ask. You can change your mind at any time: open cookie settings, or use Cookie settings at the foot of every page.

Always on (the site needs these)

• wm_consent: remembers your cookie choice. Kept for six months, then we ask again.
• __Secure-authjs.session-token: keeps a client signed in to the client portal at https://whitelam.media/account. Set only when you sign in. HttpOnly, Secure, SameSite=Lax, 30 days.
• __Host-authjs.csrf-token and __Secure-authjs.callback-url: set by the portal's sign-in system when a page checks whether you are signed in. They protect the sign-in form against forged requests and remember which page to return you to. They hold nothing about you and are deleted when you close the browser.
• __stripe_mid (one year) and __stripe_sid (30 minutes): set by Stripe on our payment pages only, to prevent card fraud.

Analytics (only when analytics is on)

• wm_vid: our own random visitor ID, so we can tell a returning visitor from a new one. First party, 365 days.
• wm_v: set when you arrive from a link in an email we sent you, so we can see which email it was. First party, 90 days.
• wm_sess: groups the pages you view in one tab. Kept in the browser's session storage (not a cookie) and cleared when you close the tab.
• _ga and _ga_<ID>: Google Analytics cookies, set by Google on whitelam.media, two years. Google Analytics is not loaded at all until analytics is on.

Turning analytics off deletes wm_vid, wm_v, wm_sess and the Google Analytics cookies, and stops Google Analytics for the rest of your visit.

No cookies

• Our page-view count always runs. With analytics off it records the view with no cookie, no visitor ID and nothing that links it to you: no more than the access log every web server keeps.
• Proposal pages. A proposal we write for a named firm is a private page, sent by email. The link in that email carries a reference to the email, and the page records the view against it so we know the proposal was opened. No cookies.
• Vercel Web Analytics and Speed Insights count page views and measure page speed from our own domain, with no cookies and no ID that lasts beyond the day. Because they identify no one, they run from your first page, before you have answered the cookie question. They stop from the moment you turn analytics off, and never run if your browser sends Global Privacy Control.
• Sentry loads after the page has finished loading and sends a report only when an error happens. No cookies.

Pages used only by our own staff set cookies in our own browsers. They are never set in yours.

You have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Have your data deleted (subject to legal retention requirements for tax records).
• Restrict or object to processing.
• Receive your data in a portable format.
• Withdraw consent at any time (for example, turn analytics off in Cookie settings or unsubscribe from the newsletter).
• Lodge a complaint with your supervisory authority. For EU residents this is your national Data Protection Authority; for UK residents this is the ICO (ico.org.uk).

To exercise any of these rights, email info@whitelam.media. We respond within one calendar month.

Our processors (Stripe, Vercel, Google, Sentry) operate globally. Where data leaves the EU/EEA, it travels under Standard Contractual Clauses or equivalent legal mechanisms required by GDPR.

The site is HTTPS-only with HSTS preloaded. Card data never reaches our servers (PCI-DSS SAQ-A via Stripe Payment Element). Database is hosted on Neon's isolated infrastructure with TLS in transit. Dashboard access requires a strong password behind HTTP Basic Auth on the middleware layer. Magic-link tokens for the client portal are one-shot and expire in 30 minutes.

We may update this notice from time to time. The current version is always available at https://whitelam.media/privacy. Material changes affecting how we use existing data will be communicated by email to anyone with an active account or active engagement.

Email info@whitelam.media. We'll respond within one business day.