Privacy Policy
Effective Date: September 8, 2026 | Last Updated: October 6, 2026
At HomeBumpMeals ("we," "us," "our"), accessible from https://homebumpmeals.com, we respect your privacy. This Privacy Policy explains what information we collect, how we use it, and the choices you have. Data controller: HomeBumpMeals, contact hello@homebumpmeals.com.
Certified Consent Management Platform (CMP): We use CookieYes (Gold-tier Google-Certified CMP, TCF v2.3) - cookieyes.com - to collect and signal your Transparency and Consent (TC) string including Disclosed Vendors Segment. Consent signals comply with IAB TCF v2.3 and Google Consent Mode v2. Vendors are presented in the CMP UI before any ad/analytics storage. Legitimate Interest is NOT used for Purposes 3, 4, 5, 6 (requires explicit opt-in). Verify TC string via CookieYes banner > Privacy settings or browser devtools > Application > Cookies > euconsent-v2.
1. Information We Collect
- Contact Information: When you email us or use our contact form (name, email, message).
- Comments: If you comment on an article, we collect your name, email address, and comment text. Your email is used for moderation only and is never displayed publicly. Comments are held for review on first submission, then stored until you or we delete them. We do not share comment data with third parties.
- Usage Data: Pages visited, time on page, browser, device, anonymized IP, via cookies and analytics after consent.
- Cookies & Similar Technologies: Essential cookies for site function; with your affirmative consent, analytics cookies (Google Analytics 4, Microsoft Clarity, Matomo self-hosted) and, after AdSense approval, advertising cookies.
2. How We Use Information & Legal Basis (GDPR Art. 6)
- To respond to inquiries — legitimate interest / contract pre-performance.
- To improve content & site performance — consent (analytics_storage).
- To serve ads after approval — consent (ad_storage, ad_user_data, ad_personalization). We do not sell your personal information and do not share it except with processors listed below.
We operate Google Consent Mode v2 Advanced + IAB TCF v2.3 via CookieYes. By default all ad_storage, analytics_storage, ad_user_data, ad_personalization are denied until you click Accept in the CookieYes banner. Non-consented pings are redacted (ads_data_redaction) and URL passthrough is enabled for cookieless measurement. Advanced mode sends denied pings before interaction.
3. Cookies & Consent Controls
On your first visit CookieYes (TCF 2.3) banner offers Accept / Reject / Customize (Purposes, Features, Vendors). TCF string euconsent-v2 is generated with Disclosed Vendors Segment (including Google 755). You can withdraw or change consent at any time via the floating CookieYes Privacy icon (bottom-left) or by clearing hb-consent + euconsent-v2 and reloading, or by emailing us. Decline keeps ad_storage, analytics_storage, ad_user_data, ad_personalization denied. Accept grants them. See also browser settings to block cookies and adssettings.google.com, Microsoft Clarity opt-out, and our Matomo opt-out on request.
| Category | Examples | Retention |
|---|---|---|
| Essential | Session, CSRF, hb-consent flag | Up to 12 months |
| Analytics (consent) | _ga, _gid (GA4 G-ZM5JM4G34B), _clsk/_clck (Clarity x6w892wvu6), _pk_id/_pk_ses (Matomo siteId 2 via analytics.soiltune.com) | GA4 14 months, Clarity 12 months, Matomo 12 months |
| Advertising (consent, post-approval) | AdSense / DoubleClick IDE cookie | Per Google up to 13 months |
4. Google AdSense, Analytics & Third-Party Vendors
We intend to use Google AdSense (Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043) after approval. Google, as a third-party vendor, uses cookies including the DoubleClick cookie to serve ads based on your visits to this and other sites. You can opt out of personalized advertising at adssettings.google.com and see Google's Advertising Policy.
Mandatory disclosure: How Google uses information from sites or apps that use our services — https://policies.google.com/technologies/partner-sites. This explains Google's data processing when you use our site, including cookies and IP handling.
Vendors processing data on our behalf:
- Google Analytics 4 (Measurement ID G-ZM5JM4G34B) — site analytics, consent-gated.
- Google AdSense (pub-4144261797965451) — display ads, only after approval and consent.
- Microsoft Clarity (tag x6w892wvu6) — session replays/heatmaps, consent-gated.
- Matomo Analytics self-hosted via analytics.soiltune.com (siteId 2) — privacy-focused analytics, consent-gated with requireCookieConsent.
Privacy-Enhancing Technologies (PETs) & On-Device Processing: Google may use PETs such as Topics API, Protected Audience (formerly FLEDGE), and Attribution Reporting, plus Trusted Execution Environments (TEEs), to support interest-based advertising without cross-site tracking where available. These operate on-device or in confidential compute and are subject to your ad consent. See Privacy Sandbox for details.
We do not transmit Personally Identifiable Information (PII) to ad vendors (no names, emails, or precise location in ad requests). IP addresses may be truncated/anonymized where supported.
5. Your Rights (GDPR, CCPA/CPRA & US State Laws)
You may request access, correction, deletion, portability, restriction, or objection regarding your personal data by emailing hello@homebumpmeals.com. We verify requests via email confirmation and respond within 30 days (GDPR) / 45 days (CCPA), with one extension if needed.
- EEA/UK/Switzerland: Right to withdraw consent, lodge a complaint with your supervisory authority, and object to processing on legitimate interest.
- California & US states: Right to know, delete, correct, opt-out of sale/share (we do not sell/share), limit use of sensitive data, and non-discrimination. We honor Global Privacy Control (GPC) signals as opt-out where applicable. Submit requests to the email above with subject "Privacy Request".
- Do Not Sell/Share: We do not sell or share personal information as defined by CCPA/CPRA. To opt out of future sale/share if this changes, email us or use GPC.
6. Data Retention & Security
Contact messages retained up to 12 months then deleted. Analytics data retained as per table above then aggregated or deleted. We use HTTPS (TLS via Let's Encrypt), access controls on our VPS, and periodic updates. Breach notification will follow applicable law. No data is transferred outside the EEA except as processed by the US vendors above under consent and SCCs where applicable.
7. International Transfers
Where vendors are US-based (Google, Microsoft), transfers rely on consent and, where applicable, Standard Contractual Clauses and vendor adequacy measures.
8. Children's Privacy
Our site is not directed to children under 13 (and under 16 in the EEA). We do not knowingly collect data from children. If you believe a child provided data, contact us to delete it.
9. Changes to This Policy
We post updates with a new Last Updated date. Material changes will be noted via site notice.
10. Contact
Questions or requests? Email hello@homebumpmeals.com or use our Contact page. Controller: HomeBumpMeals.