01Who we are
Moonshine Digital is a performance marketing agency based in Ontario, Canada, operated by Matt Ciniello. This policy covers personal information collected through moonshine.digital and its subdomains (the "site"). It applies to visitors, prospective clients, and anyone who contacts us through the site.
We're subject to Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). Where visitors from the European Economic Area, the UK, or California are concerned, we aim to meet the standards of the GDPR, UK GDPR, and CCPA as well.
02What we collect
Information you give us
- Contact form. Name, email address, and your message. Optionally your company, the service you're interested in, and a budget range.
- Booking a call. Scheduling runs through Google Calendar appointment pages. Google collects your name, email, and the time you pick, and shares them with us so we can hold the meeting. Google's own privacy policy applies to that form.
- Email. Anything you send to launch@moonshine.digital or any other address at our domain.
Information collected automatically
- Analytics. With your consent, Google Analytics 4 records pages viewed, approximate location (city level), device and browser type, referring site, and how you move through the site. We route this through our own server-side tagging endpoint (blastoff.moonshine.digital), which means your browser talks to our domain rather than directly to Google's. IP addresses are not stored in Google Analytics.
- Advertising. With your consent, Google Ads conversion and remarketing tags may record that you visited the site or submitted a form, so we can measure our own campaigns and show relevant ads on Google properties.
- Server logs. The site is hosted on Cloudflare, which logs IP addresses, request details, and timestamps for security and performance. We don't use these logs to identify individuals.
03Cookies and consent
Non-essential cookies are off until you say otherwise. When you first visit, a consent banner lets you accept all, reject all, or choose categories. Nothing in the analytics or advertising categories fires until you've made a choice.
- Essential. Required for the site to work. Includes Cloudflare security cookies and a local record of your consent choice (stored in your browser for 180 days).
- Analytics. Google Analytics 4 cookies that distinguish visitors and sessions.
- Advertising. Google Ads cookies for conversion measurement, ad user data, and ad personalization. These are separate toggles so you can allow measurement without personalization.
You can change your mind at any time using the Cookies button in the bottom-left corner of any page. You can also block or delete cookies in your browser settings; the site will still work.
04How we use it
- To respond to your enquiry and hold the call you booked.
- To evaluate whether we're a fit and follow up about working together.
- To understand how the site is used and improve it.
- To measure the performance of our own marketing.
- To keep the site secure and detect abuse (for example, the contact form uses a hidden field to catch bots).
We don't sell personal information. We don't buy third-party data about you. We don't send marketing email you didn't ask for; if we ever start a newsletter it will be opt-in.
05Who we share it with
We use a small set of service providers to run the site and the business. Each one processes data on our instructions and under its own privacy terms:
- Cloudflare — hosting, DNS, and security.
- Google — Analytics, Ads, Tag Manager, Calendar, and Workspace (email).
- Stape — hosts our server-side tagging container in Canada.
- Resend — delivers contact form submissions to our inbox.
- Notion — where we track enquiries and projects.
Some of these providers store data outside Canada, including in the United States. Where that happens, it's covered by the provider's contractual commitments and standard data-transfer safeguards. We may also disclose information if the law requires it or to protect our rights, and in the unlikely event the business is sold or merged.
06How long we keep it
- Enquiries and correspondence — kept while there's a live conversation or working relationship, and for up to three years afterward in case you come back.
- Google Analytics — event data is retained for 14 months, then aggregated.
- Server logs — retained by Cloudflare for a short rolling window, typically days.
- Consent record — 180 days in your browser, then we ask again.
07Your rights
Wherever you are, you can ask us to tell you what personal information we hold about you, correct it, or delete it. You can withdraw consent for analytics and advertising at any time through the Cookies button, and you can ask us to stop contacting you.
If you're in the EEA or UK you also have the rights to restrict or object to processing and to data portability, and you can lodge a complaint with your local supervisory authority. If you're in California, you have the right to know, delete, and opt out of sale or sharing; we don't sell or share personal information as those terms are defined under the CCPA, and we won't discriminate against you for exercising any right.
To exercise any of these, email launch@moonshine.digital. We'll respond within 30 days. Canadian residents can also contact the Office of the Privacy Commissioner of Canada.
08Security
The site is served over HTTPS. Form submissions are validated and rate-limited at the edge, and API keys for our providers are stored as encrypted secrets rather than in the codebase. No internet service is perfectly secure, but we keep the attack surface small by design: no user accounts, no payment processing, no database of visitor profiles.
09Client tools
Some unlisted pages on this site host tools built for specific clients. Any data entered into those tools belongs to that client and is handled under our agreement with them, not this policy. We act as a service provider for that data. If you've reached one of those pages and have questions, contact the client who sent you the link.
Separately, when we manage advertising and measurement for clients, we process their customers' data on their behalf under our contracts with them. That processing is governed by each client's own privacy policy.
10Changes
We'll update this page when our practices change and revise the date at the top. If a change is significant and we have your email, we'll let you know.
11Contact
Questions, access requests, or concerns about this policy go to launch@moonshine.digital. The person responsible for privacy at Moonshine Digital is Matt Ciniello.