Cookie notice
Last updated: 2026-09-10. Published by FRONTPLUG LLC.
The short version
Two cookies are required for the service to work at all, and we set them without asking because you cannot use the site without them. Everything else — measuring how the site is used, and seeing which campaign brought you here — only happens if you say yes. You are asked once, you can refuse with a single click, and you can change your answer at any time.
Categories
| Category | Do we ask? | What it does |
|---|---|---|
| Strictly necessary | No — cannot be switched off | Signing in, remembering your language, and storing your cookie choice itself |
| Analytics | Yes — off until you allow it | How many people visit, which pages are read, where things break |
| Marketing | Yes — off until you allow it | Which campaign or referral brought you here |
Strictly necessary cookies
| Name | Purpose | Lifetime |
|---|---|---|
bmp_session | Keeps you signed in | 30 days |
bmp_lang | Remembers your display language | 1 year |
bmp_consent | Remembers the choice you made here, so we stop asking | 6 months |
All three are first-party cookies set with Secure and SameSite=Lax. bmp_session and bmp_lang are also HttpOnly; bmp_consent is not, because the page has to read your choice before deciding
whether to load anything else. None of them profiles you or tracks you across other sites.
These do not require consent under the EU ePrivacy Directive or the UK PECR because they are strictly necessary to provide a service you asked for. We ask about everything else.
Analytics and marketing cookies
If you allow them, we use Google Analytics 4 (Google Ireland Limited /
Google LLC). It sets cookies named _ga and _ga_<id> in your
browser (for how long, see Retention below), and it processes your IP address,
device and browser information, and the pages you view.
We also process some usage context: your plan, display language, approximate ranges of how many templates and renders you have, whether you use an API key, and how long since you signed up. This lets us break reports down along those lines. We do not send individual identifiers such as your email or account number, and every value above is a range (for example, "4–10 templates").
We run it with Google Consent Mode: advertising storage stays denied unless
you allow the marketing category specifically, and IP anonymisation is on. If you refuse, the Google tag is not loaded at all — not in a limited mode, not silently.
You can verify that: with analytics and marketing refused, no request to googletagmanager.com appears in your browser's network panel.
One exception, stated plainly. When you complete a purchase, we send a server-side record of that purchase (the plan and the amount) to Google Analytics 4 to measure conversions. This transmission happens even if you have declined cookies, because it is sent from our server — not your browser — so it stores nothing on your device and does not contradict the "tag is not loaded" statement above (it does not appear in your network panel). It carries no individual identifiers and we do not process your IP for it. The legal basis for this server-side transmission is our legitimate interest in measuring conversions (GDPR Art. 6(1)(f)), which is separate from the consent-based cookie analytics above. You may object at any time.
Google may transfer this data to the United States. We rely on your consent as the legal basis, and on Google's Standard Contractual Clauses and Data Privacy Framework certification for the transfer. Google is listed in our subprocessors.
Retention. We have set Google Analytics to keep both event data and user
data for 14 months, after which they are deleted automatically. This is
separate from the browser lifetime of the _ga cookies themselves, which is 400 days (about 13 months) — Google sets them for two years, but current
browsers cap any cookie at 400 days, so that is what actually applies.
Site analytics without cookies
Cloudflare Web Analytics, from our infrastructure provider Cloudflare, is
enabled. It is a page-view measurement that stores nothing on your device and sets no cookie.
Because it stores and reads nothing on your device, it is outside the scope of the consent
rules that cover cookies, and so it runs on every page regardless of your
choice. It never identifies you individually — Cloudflare states that it uses no client-side state (like cookies or localStorage) for analytics purposes
, and it
does not track visitors over time by IP address or user agent. The script loads from static.cloudflareinsights.com; it is listed in the next section too.
The two scripts we load from elsewhere without asking
1. The page-view beacon. The Cloudflare Web Analytics script described
above loads from static.cloudflareinsights.com on every page.
It loads before we ask you anything, because it stores and records nothing on your device.
If you reject cookies it still runs — and still leaves nothing behind on your device.
2. The bot check. The sign-up and resend forms run a bot check, Cloudflare Turnstile. It loads from challenges.cloudflare.com and sets no cookie.
It exists so that automated sign-ups cannot send email to addresses that did not ask for it.
Cloudflare processes your IP address, browser user agent and TLS fingerprint for that check
only, as our processor.
What we still do not use
- Advertising or retargeting pixels
- Cross-site identifiers or data brokers
- Selling or sharing personal information for money
Changing your mind
Withdrawing is as easy as giving: open Cookie preferences at the bottom of any legal page and change your answer. The new choice takes effect immediately. Refusing later does not delete data Google already holds — for that, use the Google controls linked from their privacy policy.
If we add a new purpose, we raise the version of this notice and ask again. Your previous answer is not reused for something you were not told about.
Controlling cookies in the browser
You can block or delete cookies in your browser settings. If you block bmp_session you will not be able to stay signed in; if you block bmp_lang the site will display in English on every visit; if you block bmp_consent we will ask you on every visit.
More
See the Privacy Policy. Questions: support@brewmypdf.com