NO COOKIES.
NO BANNER.
You did not click away a consent banner to read this page — because there is nothing to consent to. No cookies, no analytics, no fingerprinting, no third-party scripts. Not as a promise, but as a technical constraint.
WHAT THIS SITE DOES NOT DO.
Every item below is a deliberate absence. None of it was removed after a privacy review — it was never added.
- No cookies. Not for analytics, not for preferences, not for “essential” session state.
- No analytics. No page-view counters, no heatmaps, no conversion pixels.
- No fingerprinting. No canvas, font or device probing to recognise returning visitors.
- No third-party scripts. No tag managers, chat widgets, embedded videos or social buttons.
- No fonts from CDNs. Typefaces are served from this server, so no font provider learns your IP address.
- No client-side JavaScript. Pages are static HTML and CSS. The only script elements are machine-readable structured data, which browsers do not execute.
A POLICY THE BROWSER ENFORCES.
Promises in a privacy policy are easy to break by accident: one marketing tag added on a Friday, and the site tracks. So this website is served with a strict Content Security Policy — an HTTP header that tells your browser which sources it may load resources from.
The policy allows resources only from this site's own origin. Scripts or stylesheets injected from anywhere else are refused by the browser itself, and inline style attributes are blocked too. Adding a tracker would not just be against our rules — it would visibly break.
default-src 'self'; # only this origin
script-src 'none'; # no JavaScript at all
style-src 'self'; # no inline styles, no CDN CSS
img-src 'self' data:;
font-src 'self'; # fonts served locally
connect-src 'none'; # no beacons to analytics hosts
object-src 'none';
frame-src 'none';
frame-ancestors 'none';
base-uri 'none';
form-action 'self' mailto:;
upgrade-insecure-requestsNO STORAGE. NO CONSENT NEEDED.
In Germany, § 25 TDDDG (the Telecommunications Digital Services Data Protection Act, formerly TTDSG) implements the EU ePrivacy rules: storing information on a user's device, or reading information from it, requires consent — unless it is strictly necessary for the service the user asked for. Cookies, local storage, tracking pixels and fingerprinting all fall under that rule.
The consent banner that covers half the web is the result. It is not a feature; it is the legal cost of storing things on your device. This site stores nothing on your device and reads nothing from it, so there is no consent to ask for — and no banner.
The GDPR points the same way. Data minimisation (Art. 5(1)(c)) means not collecting what you do not need. We do not need to know how you scrolled this page to build a better CRM.
THE SAME RULE INSIDE CMP42.
The CMP42 product follows the same posture: no third-party analytics, no fingerprinting, no session replay. Your team's interactions with your CRM are not a data source for anyone else.
What CMP42 does record is for you: the audit trail of every write, the run history of every process, and token cost accounting per process and per run. That is observability of your agents — not surveillance of your users.
The managed tier collects three narrowly scoped, first-party data points — all documented, none analytics: structured error logs with request context (URL, HTTP status, timestamp) and no user content or model payloads, kept 30 days for debugging; usage metering aggregated per workspace at the endpoint class, storage-GB and process-run level, kept rolling 12 months for billing; uptime checks from a handful of external nodes hitting the health endpoint, with no real user traffic. No analytics panel. No session recording. No behavioural tracking of your users. Customers who want cookie-free web analytics for their own admin UI can opt in to Plausible Analytics pointed at their own instance — nothing runs unless the customer switches it on, and it never applies to cmp42.com. The self-hosted image sends nothing outbound at all.
ONLY WHAT YOU SEND.
The only personal data we receive through this website is what you choose to send: an email to hello@protagx.com, or a Design Partner application. Details, lawful bases and your rights are in the privacy policy.
VERIFY IT IN 60 SECONDS.
- Open your browser's developer tools (F12, or right-click → Inspect).
- Open the Application (Chrome, Edge) or Storage (Firefox) tab and look at Cookies and Local Storage for this site. They are empty.
- Open the Network tab and reload the page. Every request goes to this site's own domain — no analytics hosts, no font CDNs.
- Look at the response headers of the page request and find
Content-Security-Policy.