This policy explains what personal data Cookiesh, Inc. (“Cookiesh”, “we”, “us”) collects, why we collect it, and the rights you have. It covers our website, our dashboard and our consent management service. It is written to be read, so we have kept it as short and plain as we can.
Who we are
Cookiesh, Inc. is the controller for personal data we collect about website visitors, prospects and customers. For consent records that our customers collect from their own website visitors, we act as a processor on our customers’ behalf. Those customers are the controllers, and their own privacy policies apply.
You can reach us at privacy@cookiesh.eu about anything in this policy.
Data we collect
When you visit this website. We do not use analytics or advertising cookies, and we do not load third-party trackers. Our hosting provider processes technical data such as your IP address, browser type and requested pages in short-lived server logs. It uses this data only to deliver the site and protect it from abuse.
When you create an account. We collect your name, work email address, company name, password hash and the settings you configure. If you subscribe to a paid plan, our payment processor collects your billing details. We never see or store full card numbers.
When you contact us. We keep the content of your messages and your contact details so we can answer you and follow up.
When you use the service. We log product usage events, such as features used, errors and timestamps, to operate, secure and improve Cookiesh.
Consent records we process for customers
When a customer installs Cookiesh, our script records each visitor’s consent choice. A consent record contains a pseudonymous identifier, a timestamp, the banner and policy version shown, the choices made per category, an approximate region (country or state) and a truncated user agent. We do not store raw IP addresses in consent records.
We process these records only on the customer’s documented instructions, under our Data Processing Agreement (DPA). If you want to exercise your rights over a consent record, contact the website owner. We will help them respond.
How and why we use data
We use personal data only for the following purposes and on the following legal bases under the GDPR:
| Purpose | Legal basis |
|---|---|
| Providing the service and your account | Performance of a contract (Art. 6(1)(b)) |
| Billing, tax and accounting | Legal obligation (Art. 6(1)(c)) |
| Security, fraud prevention and abuse detection | Legitimate interests (Art. 6(1)(f)) |
| Product improvement using aggregated usage data | Legitimate interests (Art. 6(1)(f)) |
| Product news and marketing emails | Consent (Art. 6(1)(a)), which you can withdraw at any time |
We do not sell personal data, and we do not share it for cross-context behavioral advertising.
Cookies on this website
This website sets only strictly necessary cookies, for example to keep you signed in to the dashboard. Because we do not use non-essential cookies, we do not show a consent banner on this site. If that ever changes, we will ask for your consent first, using our own product.
Sharing and sub-processors
We share personal data only with service providers that help us run Cookiesh. These include cloud hosting and content delivery, email delivery, payment processing and customer support tooling. Each provider is bound by a contract that limits its use of the data to providing services to us.
We keep an up-to-date list of sub-processors and notify customers before adding a new one. We may also disclose data when the law requires it, or to protect our rights, users or the public.
International transfers
Consent records are stored in the European Union by default. When personal data is transferred outside the European Economic Area, the United Kingdom or Switzerland, we rely on an adequacy decision or on the European Commission’s Standard Contractual Clauses, with additional safeguards where needed.
Retention
We keep account data for as long as your account is active, and for up to 90 days after you close it. Billing records are kept for as long as tax law requires. Consent records are kept for the retention period the customer configures, after which they are deleted automatically. Server logs are deleted within 30 days.
Security
We encrypt data in transit with TLS and at rest with AES-256. Production access is limited to the people who need it and requires multi-factor authentication. Consent records are append-only and hash-chained, so any tampering is detectable. No system is perfectly secure, but we work continuously to protect your data and will notify you and the relevant authorities of a personal data breach as the law requires.
Your rights
Depending on where you live, you may have the right to:
- access the personal data we hold about you and receive a copy;
- correct inaccurate data or complete incomplete data;
- delete your data;
- restrict or object to certain processing, including processing based on legitimate interests;
- receive your data in a portable format;
- withdraw consent at any time, without affecting earlier processing;
- opt out of the sale or sharing of personal information (California). We do not sell or share personal information, and we honor Global Privacy Control signals;
- lodge a complaint with your local data protection authority.
These rights apply under the GDPR and UK GDPR, the California Consumer Privacy Act (CCPA/CPRA), Brazil’s LGPD and similar laws. To exercise them, email privacy@cookiesh.eu. We respond within the time the applicable law requires, usually within one month, and we will not discriminate against you for exercising your rights.
Children
Cookiesh is a business service and is not directed at children under 16. We do not knowingly collect their personal data.
Changes to this policy
We may update this policy as our service or the law changes. We will post the new version here with a new “last updated” date and, for material changes, notify customers by email in advance.
Contact
Cookiesh, Inc.
Email: privacy@cookiesh.eu