Privacy Policy

Effective date: August 29, 2026

This policy describes how Smash Media collects, uses, shares, and retains information from visitors to smashmedia.com. It applies to this website only. It does not cover advertising campaigns we operate on behalf of clients, which are governed by our agreements with those clients and by the privacy policies of the platforms involved.

We serve clients and receive visitors in the United Kingdom, Canada, and the United States. Where the UK GDPR, Canadian federal or provincial privacy law, or a United States state privacy law gives you rights that go beyond what is described here, those rights apply and we will honour them.

1. Who we are and how to reach us

Smash Media is a performance marketing agency located at Caribe Plaza, 6th Floor, Palmeras St. #53, San Juan, PR 00901. For the purposes of the UK GDPR, Smash Media is the controller of the personal information described in this policy. Privacy questions, and requests about your own information, should go to privacy@smashmedia.com. Anything else — including general enquiries about our services — can go through our contact form.

Privacy Officer. Quebec's Law 25 requires us to publish the title and contact information of the person in charge of the protection of personal information. Under that Act the function belongs by default to the person exercising the highest authority in the enterprise, who may delegate it in writing, so the role is always filled. The title we publish for it is Privacy Officer, and the Privacy Officer can be reached at privacy@smashmedia.com or by mail to Smash Media, Privacy Officer, at the address above. What the law asks us to publish is a title and a contact route rather than the name of an individual, and that is what you see here. Whoever holds the role handles privacy requests from every jurisdiction, not only Quebec.

2. Information you give us

When you submit the contact form, we collect the information you enter into it:

• Your name and email address, which are required.
• Your company name and website. Company name and website are required for brand, affiliate-network, traffic-source, and DSP inquiries.
• The reason for your inquiry, and — if you are applying for a role — the position you are interested in.
• If you are a marketer, the marketing channels you select and any other channel you describe.
• If you are an influencer, the social platforms and handles you provide.
• The content of your message.

We only ask for what we need to respond to you. Please do not include sensitive personal information in your message — we do not need it, and we do not ask for special category data such as health, racial or ethnic origin, religious belief, or biometric data.

3. Information collected automatically

Like most websites, this site records basic technical data about each request. Our hosting provider logs the following on our behalf:

• Your IP address, and an approximate location (typically city and country) derived from it.
• Your browser and device type, taken from the user-agent your browser sends.
• The page you requested, the page that referred you to it, and the date and time.
• The response status and size, and basic performance data.

We use this to keep the site running, diagnose errors, understand overall traffic volume, and detect abuse such as automated scraping or attacks. We do not use it to build a profile of you.

When you submit the contact form, the IP address our server observes for that request is recorded alongside your submission. This is a security measure that lets us identify and block abusive submissions. We do not accept an IP address supplied by your browser.

4. Website analytics

We use Plausible Analytics to understand in aggregate how this site is used: which pages people read, which sources bring them here, and where they lose interest. Plausible is an open-source analytics service operated by Plausible Insights OÜ, an Estonian company that stores and processes the measurement data on servers in the European Union.

Plausible works differently from conventional analytics, and the difference is the reason we chose it:

• It sets no cookies and stores no persistent identifier on your device.
• It does not track you across other websites, or across your own devices.
• It does not build profiles, and the data is never used for advertising or sold.
• All measurement is scoped to a single day, a single website, and a single device, and is reported only in aggregate.
• Plausible states that the data it collects cannot be used to identify individuals.

For each page view, the following is collected:

• The address of the page on this site. Query strings are discarded apart from standard campaign parameters such as utm_source.
• The referring page or source that brought you here.
• Your browser, operating system, and device type, derived from the user-agent your browser sends. The full user-agent is then discarded.
• An approximate location — country, region, and city — derived from your IP address. The IP address itself is not stored.
• How far down the page you scrolled and how long the page was in view.
• Clicks on links that lead off this site, and downloads of files we host.

To count a person who views three pages as one visitor rather than three, Plausible combines your IP address and user-agent with a rotating secret to produce a hash that works only for the current day. That secret is deleted every 24 hours, and the raw IP address and user-agent are never stored. There is no way to link your activity today to your activity yesterday.

Contact form measurement. So that we can find out where our contact form confuses or fails people, we record a small number of named steps: that the form was started, that a reason was chosen, that all fields were completed, that the anti-spam check was passed, that a submission was sent, and whether it succeeded or failed. Two fixed values chosen from a dropdown may be attached — the reason for your inquiry and, for job inquiries, the role — along with a coarse failure category such as network, validation, or server.Nothing you type is ever sent to our analytics. No name, email address, company name, website, social handle, message text, or error message from our server leaves this site through analytics.

5. Your analytics choice

Because our analytics is cookieless, aggregate, and used only for statistical purposes, we do not ask you to accept a cookie banner before it runs. In exchange, you are entitled to a simple, free way to object, and here it is. The toggle below records your choice for this browser and takes effect immediately.

Your choice is stored in this browser only, using a single local storage entry named plausible_ignore. It is not sent to us or to anyone else, and it contains nothing about you. Because it lives in the browser, you will need to set it again on each browser and device you want to exclude, and clearing your browsing data will reset it. Turning analytics off does not affect anything else on this site.

If you would rather not use the toggle, blocking or disabling JavaScript also prevents our analytics from running, and you can email privacy@smashmedia.com to object in writing. Objecting costs nothing and we will not treat you differently for it.

6. Cookies and information stored on your device

This site does not use advertising cookies, analytics cookies, or any cookie that tracks you across other websites. The only things stored on your device are:

• A single entry in your browser's session storage that remembers whether you have already seen the animated intro on our home page, so we do not replay it on every page. It is deleted when you close the tab and contains no personal information.
• A short-lived entry in your browser's local storage that remembers whether you have seen the optional brand-partner offer, so we do not show it again for two hours. It contains no personal information.
• The plausible_ignore local storage entry described in section 5, but only if you choose to turn analytics off. Nothing is stored unless you make that choice.
• A short-lived token placed by Cloudflare Turnstile, the anti-spam check on our contact form, used solely to validate that challenge. See section 7.

Because we set no advertising or cross-site tracking technology and our analytics is cookieless and used only for statistical purposes, we do not ask you to accept cookies before using this site. If that ever changes, we will update this policy and provide the appropriate choice before any such technology is used.

7. Service providers we share information with

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We share it only with the providers below, only as needed to operate this site, and only under confidentiality obligations.

• Google Cloud / Firebase Hosting — hosts this website and processes the technical request data described in section 3. Data is processed in the United States.
• Cloudflare — provides the Turnstile anti-spam check on our contact form. Turnstile is designed to distinguish humans from bots without tracking individuals across websites.
• Plausible Insights OÜ — provides the analytics described in section 4. The data is stored and processed in the European Union.
• Internal Smash Media systems — contact form submissions are forwarded to a separate system we operate for managing and responding to inquiries. It is not accessible to third parties.

We may also disclose information where we are legally required to, or where necessary to protect our rights, security, or property.

8. Where your information is processed

Our providers are not all in the same country as you, so some of what we collect crosses a border.

• Analytics data stays in the European Union. Plausible stores and processes it on EU infrastructure and states that visitor data does not leave the EU. Transfers from the United Kingdom to the EEA are covered by the UK's adequacy regulations, so no additional safeguard is required.
• Website hosting and anti-spam are in the United States. Google Cloud hosts this site and Cloudflare provides Turnstile, so the technical request data in section 3 and contact submissions in section 2 are processed in the United States.

For transfers of UK and EEA personal information to the United States, we rely on the transfer mechanisms in our providers' data processing terms. For Google and Cloudflare these include the European Commission's standard contractual clauses together with the UK International Data Transfer Addendum, and each provider's certification under the EU–U.S. Data Privacy Framework and its UK Extension, where that certification applies to the service in question. Both providers encrypt data in transit and at rest. You can ask us for more detail about the mechanism relied on for a specific provider by emailing privacy@smashmedia.com.

For visitors in Canada: because our hosting and anti-spam providers operate in the United States, personal information you provide through this site is stored and processed outside Canada and may be accessible to courts, law enforcement, and national security authorities in that jurisdiction under its laws.

9. Our lawful bases for processing (UK and EEA visitors)

Under the UK GDPR we must have a lawful basis for each purpose. Ours are:

• Responding to your contact form submission — Article 6(1)(b), performance of a contract or steps taken at your request before entering into one. When you contact us about a partnership, media buying, a traffic or DSP relationship, or a job, you are asking us to take the first step toward an agreement, so handling your submission is necessary for that pre-contractual step.
• Responding to general inquiries that are not heading toward a contract — Article 6(1)(f), legitimate interests. Where you have simply asked us a question, our legitimate interest is in replying to the person who contacted us. That interest is limited, expected by you, and easy to object to, and it does not override your rights.
• Cookieless website analytics — Article 6(1)(f), legitimate interests. Our interest is in understanding aggregate usage so we can improve this site. The data is aggregated, carries no persistent identifier, and cannot identify you. To the extent the Privacy and Electronic Communications Regulations apply to reading information from your device for this purpose, we rely on the exception for statistical purposes introduced by the Data (Use and Access) Act 2025, which requires us to tell you clearly what we are doing and give you a simple, free means of objecting. Section 4 provides the information and section 5 provides the objection.
• Keeping the site secure — Article 6(1)(f), legitimate interests. Server request logs, the IP address recorded with a contact submission, and the Cloudflare Turnstile check exist to prevent spam, fraud, and attacks on our infrastructure. Network and information security is expressly recognised as a legitimate interest.
• Sending you marketing updates — Article 6(1)(a), consent. We only do this where you have separately agreed, and you can withdraw that consent at any time without affecting anything else.
• Keeping records we are required to keep — Article 6(1)(c), legal obligation. Where law requires us to retain a record, that requirement is our basis for keeping it.

Providing your details through the contact form is voluntary, but we cannot reply to an inquiry without a name and an email address.

10. Do Not Track and Global Privacy Control signals

Some browsers can send a "Do Not Track" (DNT) or Global Privacy Control (GPC) signal indicating that you do not want to be tracked or to have your personal information sold or shared.

We do not track visitors across third-party websites, we do not sell personal information, and we do not share it for targeted advertising. Because we do not engage in any of those practices, a DNT or GPC signal does not change what this site collects — visitors who send these signals and visitors who do not are treated identically. If you want to be excluded from our aggregate analytics, use the toggle in section 5, which is the mechanism we act on.

11. Tracking by third parties across other sites

We do not permit third parties to collect personal information about your online activities across different websites through this site. No third-party advertising networks, retargeting pixels, data brokers, or social media tracking scripts are embedded on smashmedia.com.

12. How we use the information

We use what we collect to respond to your inquiry, evaluate potential partnerships and job applications, operate and secure this website, measure its performance in aggregate, and — only where you have separately agreed — send you updates about our services. We do not make automated decisions that produce legal or similarly significant effects about you, and we do not profile you.

13. How long we keep it

Technical request logs are retained for a limited period, generally no more than 30 days, unless a longer period is needed to investigate a security incident. Aggregate analytics data contains no identifiers and is retained for as long as we use the statistics. Contact form submissions are kept for as long as needed to handle your inquiry and maintain a record of our business relationship, and are deleted on request as described below.

14. Your rights in the United Kingdom and the EEA

If the UK GDPR or the EU GDPR applies to you, you have the following rights over your personal information:

• Access — to be told whether we hold personal information about you and to receive a copy of it.
• Rectification — to have inaccurate information corrected and incomplete information completed.
• Erasure — to have your information deleted where we no longer have a valid reason to keep it.
• Restriction — to have us pause our use of your information while a dispute about its accuracy or our basis for using it is resolved.
• Portability — to receive information you gave us in a structured, commonly used, machine-readable format, and to have it sent to another controller, where we processed it by automated means on the basis of consent or a contract.
• Objection — to object to processing we carry out on the basis of legitimate interests, including our analytics, and to object at any time to direct marketing.
• Withdrawal of consent — to withdraw consent at any time where consent is our basis, without affecting processing that already took place.

Email privacy@smashmedia.com to exercise any of these rights. We will respond within one month, and will tell you if we need longer because the request is complex. Exercising a right is free, and we will not discriminate against you for it. We ask only for the information we genuinely need to be satisfied that the request is yours.

You also have the right to lodge a complaint with a supervisory authority. In the United Kingdom that is the Information Commissioner's Office, which you can reach at ico.org.uk/make-a-complaint or on 0303 123 1113. In the EEA you can complain to the supervisory authority in the country where you live or work. We would appreciate the chance to address your concern first, but you do not have to come to us before going to a regulator.

15. Your rights in Canada

Under the Personal Information Protection and Electronic Documents Act (PIPEDA) you can:

• Ask what personal information we hold about you, how we use it, and who we have disclosed it to, and receive a copy.
• Ask us to correct information that is inaccurate or incomplete.
• Withdraw your consent, subject to legal and contractual restrictions, on reasonable notice.
• Challenge our compliance with PIPEDA by writing to our Privacy Officer at privacy@smashmedia.com, and complain to the Office of the Privacy Commissioner of Canada if you are not satisfied with our response.

Quebec. If you are in Quebec, the Act respecting the protection of personal information in the private sector, as amended by Law 25, also gives you the right to be informed of the purposes for which we collect your information at the time we collect it, to access and correct it, to withdraw consent, to request that it be deleted or that a link to it be de-indexed where the legal conditions are met, and — for computerised information you provided to us — to receive it in a structured, commonly used technological format. You may complain to the Commission d'accès à l'information du Québec. The title and contact information of our Privacy Officer are published in section 1, and that is the route for any of these requests. We do not use technology that identifies, locates, or profiles you, and we do not make decisions about you based exclusively on automated processing.

16. Your rights in the United States

You can ask us to confirm what personal information we hold about you, provide a copy of it, correct it if it is inaccurate, or delete it. Email privacy@smashmedia.com and we will respond within 45 days. We do not sell personal information and we do not share it for targeted advertising, so there is nothing for you to opt out of on those grounds. We will not discriminate against you for exercising any of these rights, and we do not require you to create an account or verify your identity beyond what is reasonably necessary to confirm the request is genuinely yours.

17. Children

This site is intended for business audiences and is not directed to children. We do not knowingly collect personal information from anyone under 13. If you believe a child has provided us information, contact us and we will delete it.

18. Changes to this policy

We may update this policy as our practices or the law change. When we do, we will post the revised version on this page and update the effective date at the top. If the changes are material — for example, if we begin using a new category of data or a new analytics provider — we will describe them clearly here before or when the change takes effect. We encourage you to review this page periodically.

19. Contact us

Questions about this policy or how we handle your information, and any request about your rights, can be sent to privacy@smashmedia.com, or by mail to Smash Media, Privacy Officer, Caribe Plaza, 6th Floor, Palmeras St. #53, San Juan, PR 00901. Both routes reach our Privacy Officer.

For anything unrelated to privacy, use our contact form and choose the Something else option if none of the other choices fit. The form does not reach our Privacy Officer, so please send a privacy question, or any request about your rights, by one of the two routes above instead.