Cookie Policy — masar.
A brand of Nexia Global Sp. z o.o.
Last updated: [DATE] · Version 1.1
1. The short version
We store almost nothing. Two small entries keep the site working. Beyond those there are two optional purposes, and each one is a separate decision: analytics (Google), and advertising measurement (Meta). Nothing optional is stored before you choose, declining is one click in the same place as accepting, and you can change your answer at any time.
You can say yes to one and no to the other. Accept turns both on, Decline turns both off, and Choose gives you a switch for each. Everything on this site works either way, including your full scorecard report.
We do not sell your data, and we do not build our own profile of you as an individual visitor. We are not going to claim more than that: if you allow the advertising purpose, Meta can connect this visit to the profile it already holds on you. That is what the switch is for, and section 4 says so plainly rather than burying it.
2. What counts as a cookie here
A cookie is a small file a site asks your browser to keep, so it can remember something between pages or visits. The same rules cover related technologies — local storage, session storage, pixels and tags. Where this page says "cookies", it means all of them. That matters on this site, because the scorecard uses local storage rather than a cookie.
3. The rule we work to
Storing anything on your device, or reading anything from it, requires your prior consent under art. 399 Prawo komunikacji elektronicznej — the provision that replaced art. 173 Prawo telekomunikacyjne on 10 November 2024. The exception is storage that is strictly necessary to deliver what you actually asked for (art. 399 ust. 3).
Consent also has to meet the RODO standard (art. 4 pkt 11 and art. 7), which is why:
- nothing non-essential loads before you choose;
- declining is exactly as easy as accepting: same bar, same size button, one click;
- consent is specific to each purpose. Analytics and advertising measurement are different things done for different reasons, so they get one switch each rather than a single bundled yes;
- no box is pre-ticked, and ignoring the bar is not consent;
- withdrawing is as easy as giving, at any time, and one purpose at a time.
4. What we actually store
Strictly necessary — no consent needed
| What | Where | Why | Kept for |
|---|---|---|---|
masar-consent | Local storage | Remembers your answer for each purpose separately, so we stop asking. Written either way, including when you decline both. | 12 months, then we ask again |
masar-scorecard | Local storage | Holds your in-progress answers on the scorecard page, so a refresh or a stray back-button doesn't cost you four minutes. Never sent anywhere, cleared when you finish or start over. | Until you finish, export, or start a new session |
Neither has any analytics or advertising purpose, and neither leaves your browser.
Analytics — only if you accept
| What | Set by | Why | Kept for |
|---|---|---|---|
_ga, _ga_4V1GTERFDG | Google Analytics 4 (Google Ireland Ltd) | Counting visits, and telling a visitor who read one page from one who completed the twenty-statement scorecard — so we can tell whether the site works | Up to 2 years (_ga), 2 years (_ga_*) |
If you decline, the Google tag is never loaded at all, not loaded-but-disabled. No request reaches Google, and your IP address is not disclosed to them. The honest trade-off: we then have no data about your visit, which is a cost we accept.
What we send when you do accept: page views, plus three events, scorecard_start, scorecard_complete (with your Independence Score and band) and call_booked. Your name, email, company and phone number are never sent to Google. A score describes a company's situation; those four identify a person, and they stay in our own systems.
Advertising measurement — only if you accept
| What | Set by | Why | Kept for |
|---|---|---|---|
_fbp | Meta Pixel (Meta Platforms Ireland Ltd) | A random browser identifier, so a completed scorecard can be matched back to the ad that produced it | 90 days |
_fbc | Meta Pixel (Meta Platforms Ireland Ltd) | Holds the click identifier (fbclid) from the ad you arrived on, for that same matching | 90 days |
Both are first-party cookies, written on masar.ceo by script rather than served from Meta's own domain. That changes who writes them, not who benefits from them.
If you decline advertising, connect.facebook.net is never contacted. We also do not use Meta's <noscript> fallback beacon anywhere on this site: it is an image tag that fires before any consent mechanism can reach it, which makes it incompatible with the promise on this page.
What we send when you do accept: a page view, and four events marking progress through the scorecard, FitCheckComplete, ScorecardStart, Lead when your report is produced, and Schedule if you book a call. The Lead event carries the name of the instrument and your band, so we can tell which ads bring founders who actually finish.
The second leg, which you should know about. When you submit the scorecard, our automation also sends Meta the same Lead event from our server rather than your browser, with your email, phone and name hashed with SHA-256 before they leave our systems. Meta uses the hashes to match the conversion against an account it already holds; it never receives the plain values from us. This happens only if you accepted the advertising purpose, and both legs carry the same event identifier so Meta counts one lead rather than two.
The honest part. Meta is not a neutral counter. Google Analytics works for us as a processor and does not get to reuse your visit for its own ends. Meta does: it uses what the Pixel reports for its own purposes as well as ours, and if you have an account it can connect this visit to the profile it already holds. Section 5 of our Privacy Policy sets out the legal shape of that, which is joint controllership rather than a processing agreement. It is the reason advertising is its own switch, and the reason we would rather you turned it off than agreed to it without noticing.
Not used
No LinkedIn Insight Tag. No session-recording, heatmap or session-replay tools. No cookies at all from a visitor who declines both purposes, beyond the one that records the decline itself.
Fonts and scripts — deliberately not a cookie question
Our typefaces, the animation library and the PDF generator are all served from our own servers rather than a CDN. That sets no cookie, and more importantly it means loading a masar. page does not disclose your IP address to Google, jsDelivr or anyone else before you have consented to anything.
5. Changing your mind
- Use the "Cookie settings" link in the footer of any page to bring the bar back. Choose opens with both switches showing their current state, so you can turn one purpose off without touching the other.
- Or clear this site's data in your browser, which resets the choice and makes us ask again.
Every current browser also lets you block or delete cookies wholesale, in Settings under Privacy. Note that blocking local storage entirely will stop the scorecard remembering your answers mid-run.
What withdrawal actually does. The moment you turn a purpose off, we expire that purpose's cookies in your browser (_ga and _ga_* for analytics, _fbp and _fbc for advertising) and stop sending anything further. A tag that has already loaded into the page you are currently looking at cannot be lifted back out of it, so on that one page the withdrawal takes effect from that moment forward, and from your next page load it is complete.
Withdrawing consent does not make what happened beforehand unlawful (art. 7 ust. 3 RODO), and it does not affect anything we hold on a basis other than consent.
6. Cookies and your personal data
Some of this — an IP address, an analytics identifier — is personal data under RODO. Where it is, our Privacy Policy governs: the legal bases, the processors, the transfers, how long we keep it, and your rights. That includes the right to complain to the Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa.
7. Changes to this policy
If we add or remove anything that stores data on your device, this page changes with it and the version and date at the top move. Where a change means we need consent we did not need before, we ask again rather than assume your old answer still covers it.
8. Contact
Write to ahmed@masar.ceo with anything about this page or the choices behind it.