Privacy Policy
Last updated: 15 October 2026
This page explains what www.moonworks.agency collects about you, why, who else sees it, and what you can do about it. No legalese padding.
The short version
- We only get what you choose to send us: a free audit request, a call booking, an email.
- Analytics cookies only go on your device if you click Accept. You can change your mind any time with the Cookies link in the footer.
- The tools behind the site: Webflow (website and forms), Google (Analytics, email, calendar) and Cal.com (call bookings).
1. Who we are
Moonworks is the trade name of Trema Janota, Unipessoal Lda, a single-member company registered in Portugal (NIF PT519274830). We work between Paris and Lisbon. For the personal data on this page, we're the controller: we decide why and how it's used.
- Registered address: Rua de São Domingos, nº 11, 2º, 1200-832 Lisboa, Portugal
- Privacy contact:contact@moonworks.agency
2. What we collect, and when
Free audit form. On the free audit page we ask for your name, your email, your company website and details about your site. All four are required: without them we can't do the audit. Webflow stores your submission and emails a copy to contact@moonworks.agency.
Booking a call. The booking buttons (“Let's talk” and “Book a 30 min call”) open Cal.com's booking window. To book, you give your name and email, and you can add notes and guest email addresses. The call runs on Google Meet, so the booking also lands in our Google Calendar with your name, email and the meeting details.
Emails you send us. Your email address, your message and anything you attach.
Analytics. We use Google Analytics 4 to see which pages and buttons work. It runs in two modes:
- Before you choose, or if you click Reject: no analytics cookies are set. Google Analytics still receives cookieless measurements: the page address and title, the page you came from, the event (for example a page view), the time, general browser and device details (like language and screen size) and a random number generated on each page load. Without a cookie, one page view can't be linked to the next.
- If you click Accept: Google Analytics also sets cookies (see section 10) that recognise your browser across pages and visits.
In both modes we measure: page views, scroll depth, clicks on free audit links, clicks on booking buttons, confirmed bookings, clicks on links to other websites (the link address and its text) and form submissions (only the form's name, never what you typed). Google says Google Analytics 4 doesn't log or store IP addresses.
Technical data. To show you a page, your browser connects to the servers that deliver it. They receive your IP address, your browser details and the page or file requested. For the site itself that's Webflow and its network provider, Cloudflare. For files loaded from other services, it's the services listed in section 4.
3. Why we use it, and on what legal basis
- Preparing your free audit and replying to you: steps you asked for before a possible contract (GDPR Art. 6(1)(b)).
- Your booked call: same basis (Art. 6(1)(b)).
- Replying to your emails: the same basis when it's about working together; otherwise our legitimate interest in answering messages (Art. 6(1)(f)).
- Analytics cookies: your consent (Art. 6(1)(a)). You can withdraw it at any time. That doesn't affect what happened before.
- Cookieless analytics measurements: our legitimate interest in knowing, overall, how the site is used (Art. 6(1)(f)). You can object (section 7).
- Technical data and security cookies: our legitimate interest in running a website that works and stays secure (Art. 6(1)(f)).
We don't make automated decisions about you.
4. Who else gets it
These companies process data on our behalf:
- Webflow, Inc. (USA): hosts the website and stores form submissions. Its subprocessors include Amazon Web Services (hosting) and Cloudflare (content delivery).
- Google: Google Analytics (measurement) and Google Workspace (our email and calendar, so audit notifications, your emails and booked calls end up there).
- Cal.com, Inc. (USA): runs the booking window and stores your booking. Nothing is loaded from Cal.com until you hover, tap or tab to a booking button.
Some files come from public delivery networks, which receive your IP address and browser details when they send them: jsDelivr (the slider library on the Home, Our Work and case study pages) and Google (the Google tag script).
The LinkedIn, Instagram, Dribbble and Webflow icons in the footer are plain links. Nothing loads from those sites unless you click, and then their own privacy policies apply.
5. Transfers outside the EU
Webflow, Google and Cal.com are US companies, so your data may be processed in the United States. Each states that it is certified under the EU-U.S. Data Privacy Framework, and each says it also uses the European Commission's Standard Contractual Clauses where needed. Their policies: Webflow, Google, Cal.com.
6. How long we keep it
- Free audit requests and call bookings: as long as we need them to deliver the audit or the call and follow up, then deleted. At most 24 months after our last exchange, unless you become a client (then for as long as the contract and the law require).
- Emails: 24 months after our last exchange, unless needed for a client contract or a legal obligation, then deleted.
- Google Analytics data: Google keeps it for 14 months (the retention setting in our Analytics account), then deletes it automatically.
- Cookies and browser storage: see the table in section 10.
- Technical logs: kept by Webflow, Cloudflare and the other providers above under their own rules.
7. Your rights
You can ask us to:
- show you the data we hold about you and give you a copy;
- correct it;
- delete it;
- restrict how we use it;
- stop using it where we rely on legitimate interest (including the cookieless analytics);
- send you the data you gave us in a portable format.
Where we rely on your consent, you can withdraw it at any time.
Email contact@moonworks.agency. We answer within one month and may ask you to confirm who you are first.
You can also complain to Portugal's data protection authority, the CNPD (Comissão Nacional de Proteção de Dados, www.cnpd.pt), or to the authority where you live or work. We'd like the chance to fix it first.
8. Children
This site is for founders and businesses, not children. If you think a child has sent us their data, email us and we'll delete it.
9. Changes to this policy
When what the site does changes, we update this page and the date at the top.
10. Cookies and similar technologies
Changing your choice. Click “Cookies” in the footer of any page to reopen the banner. If you switch from Accept to Reject, Google Analytics stops using cookies and the site deletes the Google Analytics cookies it had already set (_ga and _ga_D514X6DZYN).
Inside the booking window, Cal.com uses its own cookies for login, preferences and security. Cal.com says it uses no third-party advertising cookies in its product.
Here's everything we found this site storing on your device:
| Name | Provider and type | Purpose | Duration | Needs your consent? |
|---|---|---|---|---|
| mw-consent | Moonworks, local storage | Remembers whether you clicked Accept or Reject | Until you clear your browser's site data | No (it stores your choice) |
| mw-gal2:… | Moonworks, session storage | Caches the images of the work showcase on the home page | Until you close the tab | No |
| _cfuvid | Webflow via Cloudflare, cookie | Security: tells apart visitors who share an IP address | Session | No |
| __cf_bm | Cal.com via Cloudflare, cookie on cal.com | Bot protection for Cal.com's booking script. Set only once you hover, tap or tab to a booking button | 30 minutes | No (security) |
| _ga | Google Analytics, cookie | Distinguishes visitors | 2 years, or until you click Reject | Yes: set only after Accept |
| _ga_D514X6DZYN | Google Analytics, cookie | Keeps session state | 2 years, or until you click Reject | Yes: set only after Accept |
