English
This policy explains the cookies and browser storage currently used on the Growth Lab FJL website. Growth Lab FJL is a project and trade name used by Francisco José Luluaga Garcia; it is not a separate legal entity.
Current cookie and storage inventory
cc_cookie: a necessary, first-party cookie created by the self-hosted CookieConsent v3 interface. It records consent categories and services, policy revision, interface language, consent timestamps, expiry metadata, and a locally generated consent identifier. It lasts approximately 182 days, uses SameSite=Lax, and is marked Secure on HTTPS. Eligible same-origin HTTP requests may include the cookie automatically under normal browser cookie rules. Application code does not extract its identifier for analytics or send it to PostHog, GA4, GTM, Brevo Tracker, or another analytics provider.
Persistent attribution is disabled: the site no longer creates, updates, or reads _tk_* session-storage values. On initialization it removes known legacy _tk_* keys without reading or reusing their contents. No replacement cookie, local-storage value, fingerprint, server-side identity, or event history is created.
CookieConsent does not use local storage. The site has no analytics event queue, replay buffer, stable visitor identity, consent logging endpoint, or application-owned analytics endpoint.
Choices and withdrawal
The interface lets you accept all, reject all, or manage categories. Necessary storage is always enabled because it remembers your cookie choice and operates the consent controls. Statistics is optional and disabled before a valid choice.
You can reopen the preferences interface at any time through the permanent Cookie settings / Preferencias de cookies control on every page, change the statistics category, or clear the cookie through browser settings. Withdrawal takes effect immediately in the site consent state.
Accepting statistics currently activates no provider. There is no new delivery to PostHog, Google Analytics 4, Google Tag Manager, Brevo Tracker, or any other analytics destination. Form-processing consent never grants analytics consent.
Consent revision 3 presents the prepared GA4/GTM disclosure and asks existing visitors to choose again. The new choice does not activate delivery: the global and GA4 switches remain disabled and no container identifier is configured in this release.
Prepared but inactive GA4/GTM inventory
A separately authorized non-production preview may later use Google Analytics 4 through Google Tag Manager to measure only consented, reviewed CTA and successful-lead events. The current configuration makes that path ineligible, so there is no Google script, request, cookie, local storage, session storage, dataLayer, or analytics event delivery.
- Category and hosts: statistics only; proposed hosts are
www.googletagmanager.com,www.google-analytics.com, andregion1.google-analytics.com. - Possible consented storage: a later verified preview may create first-party GA cookies such as
_gaand a stream-specific_ga_*. Their actual names, duration, and removal behavior must be measured before activation; none exists under the current disabled configuration. - Data limits: reviewed event and categorical properties plus automatically generated technical metadata only. Names, email addresses, form values, full URLs, query strings, fragments, raw referrers, User-ID, Google Signals, Ads data, and user-provided data collection remain prohibited.
- Retention: the proposed non-production GA4 property uses 2 months with reset on new activity off. A future production target of 14 months requires separate approval.
- Withdrawal: the site must stop every new canonical event synchronously. Every request after withdrawal must be inventoried; a consent-state or cookieless ping blocks activation pending an explicit owner decision.
Deferred persistent attribution
Cross-page attribution remains disabled. Any future implementation requires a separately approved decision covering:
- a defined and documented purpose;
- its ePrivacy and Spanish LSSI classification;
- an applicable GDPR legal basis;
- data minimization and closed value rules;
- an explicit retention period;
- consent behavior where required;
- updated English and Spanish policies;
- a consent revision increment and reconsent where applicable; and
- browser, network, and storage QA.
Deferred analytics governance
Any future PostHog, GA4, or other analytics activation requires a separate reviewed release that:
- loads the provider only after valid statistics consent;
- stops delivery and clears applicable provider persistence on withdrawal;
- uses only reviewed events and event-specific property allowlists;
- keeps session replay, autocapture, heatmaps, console capture, and automatic form capture disabled by default;
- excludes names, email addresses, form values, query strings, and URL fragments;
- separates production from non-production environments;
- defines and publishes an explicit retention period;
- updates the English and Spanish policies and the cookie/tracker inventory;
- increments the consent revision and requests a fresh choice; and
- passes browser and network QA proving no delivery before consent or after withdrawal.
These are future activation conditions, not functionality included in the current release.
Changes and contact
Material changes to purposes, categories, providers, or retention will update this policy and may require a fresh consent choice. Privacy questions can be sent to privacy@growthlab-fjl.com. See the Privacy Policy for more information.