Cookie Notice
Last Updated: July 30, 2026 | Questions? Contact legal@surmado.com
Our Approach
Surmado uses cookies and similar technologies to operate the site, keep it fast and secure, understand how visitors use it, and measure the performance of our advertising. We organize them into four categories: essential (always active), performance, analytics, and advertising. How the non-essential categories start depends on where you are. In regions whose laws require opt-in consent (the EEA, the United Kingdom, Switzerland, and Canada), they stay off until you accept them in our banner. In US states with opt-out privacy laws (California, Colorado, Connecticut, and Oregon), they are active by default and the banner lets you opt out at any time. Elsewhere, they are active by default. All non-essential categories are managed by our own first-party consent banner and we honor Global Privacy Control (GPC) signals where required by law — no third-party consent platform is involved.
Essential Cookies
We use strictly necessary cookies (or similar technologies) to provide the Services. These cannot be disabled:
| Category | Purpose |
|---|---|
| Authentication | To manage user sessions and secure login (via Clerk). |
| Security & Fraud | To prevent fraud and secure payments (via Stripe). |
| Site Security | To protect against attacks (e.g., CSRF tokens). |
| Consent Management | To remember your cookie preferences across visits (the first-party surmado-consent cookie, set only when you make a choice in our banner). |
Performance Cookies (Consent-Managed)
When performance cookies are enabled — after you accept in opt-in regions, or by default where opt-out rules apply — we allow our infrastructure provider to set cookies that help us keep the site fast and protect it from automated abuse. They do not identify you or build a behavioral profile, and they do not power advertising.
| Tool | Provider | What it does |
|---|---|---|
| Cloudflare | Cloudflare, Inc. | Bot management, request load-balancing, and edge performance for the marketing site (e.g., the __cf_bm and _cfuvid cookies). Used to keep the site responsive and to distinguish humans from automated traffic; not used for advertising. |
Analytics Cookies (Consent-Managed)
When analytics cookies are enabled — after you accept in opt-in regions, or by default where opt-out rules apply — we load the following tools to understand how visitors use our marketing site. They do not fire if you decline, and you can withdraw consent or opt out at any time via the cookie preferences link in the footer.
| Tool | Provider | What it does |
|---|---|---|
| Google Analytics 4 | Google LLC | Aggregate page views, sessions, events, device characteristics, and approximate location derived from IP. Initialized with all advertising-related consent signals defaulted to denied. |
| Microsoft Clarity | Microsoft Corporation | Heatmaps and session recordings of mouse movement, clicks, scrolls, and viewport size. Form inputs and on-page text content are masked client-side before transmission. |
Advertising Cookies (Consent-Managed)
When advertising cookies are enabled — after you accept in opt-in regions, or by default where opt-out rules apply — we load conversion-tracking pixels that measure how our ads perform and let those platforms attribute purchases back to a click. These technologies may constitute a "sale" or "sharing" of Personal Information under California, Colorado, Connecticut, and similar state privacy laws because they enable cross-context behavioral advertising. They do not fire if you decline or opt out, and we honor Global Privacy Control (GPC) signals where required by law.
| Tool | Provider | What it does |
|---|---|---|
| Meta Pixel | Meta Platforms, Inc. | Conversion tracking, ad measurement, and audience-building for Facebook and Instagram ads. Automatic Advanced Matching is disabled, so we do not transmit your email or phone number to Meta. Meta may still associate page views with your Meta account if you are signed in to Facebook or Instagram in the same browser. |
| Reddit Pixel | Reddit, Inc. | Conversion tracking and ad measurement for Reddit ads. Reddit may use the data to build audiences for retargeting. |
Your Choices
You can manage performance, analytics, and advertising consent in three ways:
- Cookie banner. First-time visitors in opt-in regions see a banner before any non-essential tag loads. Visitors in US opt-out states see the same banner with non-essential cookies active by default, and clicking Decline opts you out immediately and for future visits.
- Consent preferences link. Open the "Consent Preferences" link in our footer at any time to change your choices.
- Browser-level signals. We honor Global Privacy Control (GPC) signals as an opt-out of "sale" / "sharing" and targeted advertising in jurisdictions that recognize them (currently California, Colorado, Connecticut, and Oregon as of January 1, 2026).
You may also block cookies via your browser settings, but blocking essential cookies will prevent you from logging in or making payments.
Related Legal Documents
- Privacy Policy: How we handle your data
- Terms of Service: Complete terms governing use of our Services