Privacy

Who is responsible

Medido. You can reach me at marketingmedido@gmail.com.

What the reading processes

The web address you paste. I read only the home page and ignore anything after the address. To limit repeated readings, your connection address is held in memory in a scrambled form that changes every day; it is not written to disk.

What I keep

For 30 days, a short technical record of the site that was read: tracking IDs, event counts, the domain's expiry date, whether robots and sitemap exist, and a scrambled version of the title. For 90 days, a usage counter with a scrambled domain, the language, the result and the time to the hour, with no address and no visitor data. If you answer "is this correct?", I keep your answer for 90 days with the reading it refers to.

Sites I read

My readings are real requests. They can appear in the analytics and ad accounts of the site I read as visits and contact events from a Chrome browser whose user agent ends in MedidoLupa/0.2. The reader honors a robots.txt rule that disallows MedidoLupa.

If you write to me

If you use the contact form, what you type (your email, your site address, a spend range if you pick one, and your message) goes to Formspree, a form service that passes it to my inbox and, on the plan I use today, keeps a copy in its archive for 30 days. I use it only to answer you. I keep our messages for as long as we are talking and as long as the law requires. I send the free reading only if you ask for it.

If you connect Google

Connecting is optional and is only offered to clients who have ordered the Diagnosis. The free reading never needs it. If you connect, you sign in on Google's own page and allow read-only access to Google Analytics and Google Tag Manager (the permissions analytics.readonly and tagmanager.readonly). I never see your Google password. The access cannot change, delete or publish anything. The page where you connect is /connect/; I send that link only to clients.

I use what the access shows only to prepare your written Diagnosis report, within 10 business days. A person at Medido reads that data: you agree to this by ticking the box before you connect, which Google requires. I look at the setup of your accounts and at totals, not at data about individual people.

What I keep from your Google connection

The sign-in key that Google gives me (a refresh token) is stored encrypted, together with the address of your site and the dates the connection was made and ends. I don't store your Google account email. The short-lived access keys live only in the server's memory and are never written to disk. A connection lasts 14 days. When it ends, I revoke it at Google and delete it automatically; a check runs every hour. I also keep a short access log (date, site address, and whether the connection was made, revoked or expired), with no keys and no Google data, until you ask me to delete it.

What I look at is read from Google while I review it. The only things I keep from the review are my working notes and the report I write for you, and I delete them if you ask.

Disconnecting and revoking

Press Disconnect on the connection page and I revoke the access at Google and delete the connection at once. You can also remove it yourself at any time at myaccount.google.com/permissions: the connection stops working immediately, and I delete my copy the next time I try to use it or when it expires. Or write to me at marketingmedido@gmail.com and I do it. If Google doesn't confirm a revocation, I retry every hour for 24 hours and then delete my copy anyway; you can always remove the access from the permissions page.

Google API Services User Data Policy

Medido's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In plain words: I use Google data only to give you the report you ordered. I don't sell it, I don't use it for advertising, and I don't pass it to anyone else, except where the law requires; the hosting service that runs this site only holds the encrypted connection. A person reads it only because you agreed.

Third parties and cookies

This site sets no cookies unless you connect your Google account. In that case it sets two technical cookies, needed only for the sign-in and to recognize your connection until it ends; they are not used for tracking. It loads its fonts from itself. The contact form is processed by Formspree, as explained above. If I turn on visit measurement with Google Analytics or the Meta pixel (to measure my own ads), a notice asks you first and it loads only if you accept; then Google or Meta set cookies to measure visits and contact requests. The same notice covers Microsoft Clarity, which records how the pages are used (clicks, scrolling and session replays with the text you type masked) and sets its own cookies only if you accept. If you decline, nothing loads. If I turn on a bot check, the provider will receive your connection address and browser details for that check only. The site is served by a hosting provider that sees the requests it serves.

Deleting your data

Write to me and I delete the record of your domain and its subdomains. I can also exclude your domain from being read. I may ask you to write from an address at that domain. If you connected Google, I also delete the connection, the access log lines and my notes on it.

Paid sessions: rescheduling and refunds

The 45-minute reading session is booked and paid through Cal.com and PayPal. You can reschedule free of charge up to 24 hours before. If you cancel more than 24 hours before, you get a full refund. If you cancel with less notice or do not show up, there is no refund, and I offer a new date once. If I cancel, you choose a full refund or a new date. Once the session took place there is no refund; it is credited against the Diagnosis if you go on within 14 days. To request a refund, reply to your confirmation email; it goes back through PayPal within a few business days.