Cookiesentry

Privacy Policy

Last updated: October 22, 2026

Introduction

Welcome to CookieSentry. We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our cookie compliance scanning service.

By using CookieSentry, you agree to the collection and use of information in accordance with this policy. If you do not agree with our policies and practices, please do not use our service.

Information We Collect

Personal Information

When you register for CookieSentry, we collect:

  • Name and email address
  • Company name and website URL
  • Payment information (processed securely through third-party providers)
  • Account credentials (encrypted passwords)

Website Scanning Data

When you use our scanning service, we collect:

  • URLs of websites you scan
  • Cookie data found on scanned websites
  • Scan results and compliance reports
  • Technical data about cookie behavior and classifications

Usage Information

We automatically collect certain information when you use our service:

  • Device information (browser type, operating system)
  • IP address and location data
  • Usage patterns and feature interactions
  • Log data and error reports

How We Use Your Information

We use the information we collect to:

  • Provide, operate, and maintain our cookie scanning service
  • Process your transactions and send you related information
  • Send you technical notices, updates, and security alerts
  • Respond to your comments, questions, and customer service requests
  • Monitor and analyze usage patterns to improve our service
  • Detect, prevent, and address technical issues and security threats
  • Send you marketing communications (with your consent)
  • Comply with legal obligations and enforce our terms

Our Cookie Usage

Our public website sets no tracking cookies and no marketing cookies. Without interaction, its pages set no cookies and store nothing in your browser's local storage, so we ask for no cookie consent. Every page does load the tawk.to support chat widget, described below.

Essential cookies (logged-in area only)

When you sign in to the dashboard, a session cookie is required for authentication and security. These are strictly necessary under ePrivacy Article 5(3) and do not require consent.

Analytics — cookieless

We use Umami, a privacy-friendly analytics tool that we host ourselves. Umami sets no cookies, uses no cross-site identifiers, and does not build user profiles. IP addresses are hashed and discarded. Only aggregate page views, referrers, and country-level location are collected.

Support chat — tawk.to

Every page, including the dashboard, loads the chat widget script from embed.tawk.to (tawk.to inc., USA; Standard Contractual Clauses). Loading it sends your IP address, browser data and the address of the page to tawk.to. If you open the chat, tawk.to also processes your messages and the name and email address you enter.

Data Storage & Security

We protect your personal information with these measures:

  • All traffic to cookiesentry.com is encrypted in transit (HTTPS)
  • Passwords are stored only as salted scrypt hashes (the default of our sign-in library, better-auth)
  • Your data is stored on our server in Frankfurt am Main, Germany (Hostinger)
  • Every query is limited to your own account; the admin area is limited to the owner's accounts
  • The full list of technical and organisational measures is Annex 2 of our Data Processing Agreement

Your scan data is retained for as long as your account is active. You can delete your data at any time from your account settings.

Your Privacy Rights

Under GDPR and other privacy laws, you have the following rights:

Right to Access

Request a copy of your personal data we hold

Right to Rectification

Correct inaccurate or incomplete data

Right to Erasure

Request deletion of your personal data

Right to Portability

Export your data in a machine-readable format

Right to Object

Object to processing of your data

Right to Restrict

Limit how we use your data

To exercise any of these rights, please contact us at [email protected]

Third-Party Services

We use these third-party services to provide our platform:

  • Hostinger International Ltd.: VPS: application, PostgreSQL and Redis, scanner workers — Frankfurt am Main, Germany (EU) (Art. 28 GDPR — Data Processing Agreement)
  • Hostinger: Transactional email (SMTP) — EU (Art. 28 GDPR — Data Processing Agreement)
  • BunnyWay d.o.o. (Bunny CDN): Storage and delivery of static assets and uploaded report logos — Company in Slovenia (EU); storage in Germany (Falkenstein); delivery via global edge (Art. 28 GDPR — Data Processing Agreement)
  • ScrapingBee: Overflow scanner (used only when the own scanners are busy or down) — Paris, France (EU) (Art. 28 GDPR — Data Processing Agreement)
  • Cloudflare, Inc.: CDN / reverse proxy and Turnstile (anti-bot check) — Global edge; USA (Art. 28 GDPR; EU–US Data Privacy Framework + SCCs)
  • Functional Software, Inc. (Sentry): Error monitoring — EU region (Germany) (Art. 28 GDPR; EU–US Data Privacy Framework + SCCs for access from the USA)
  • Better Stack, Inc. (Logtail): Application logs — Nuremberg, Germany (EU region) (Art. 28 GDPR; SCCs)
  • tawk.to inc.: Support chat (widget on every page, including the dashboard) — USA (Art. 28 GDPR; SCCs)
  • Stripe Payments Europe Ltd.: Subscription billing and invoicing (CookieSentry's own processing as controller, DPA clause 3.4) — Dublin, Ireland (EU); onward transfer to Stripe, Inc. (USA) (Onward transfer to the USA: EU–US Data Privacy Framework + SCCs)
  • Google (optional Sign in with Google): Sign-in, only when the user chooses it — USA (Independent controller; EU–US Data Privacy Framework)
  • Analytics: Umami, self-hosted by CookieSentry (cookieless, no cross-site tracking, hashed IPs)

Customer data is stored on our server in Frankfurt, Germany (uploaded logos: Bunny, Falkenstein, Germany). Cloudflare, Stripe, Tawk.to, Sentry, Better Stack and Google (optional sign-in) are US companies or may access data from the US; those transfers rely on the EU–US Data Privacy Framework and/or the EU Standard Contractual Clauses (SCCs), named in each provider's entry. The full list with the data each provider processes is published at /legal/hosting.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by:

  • Posting the new Privacy Policy on this page
  • Updating the "Last updated" date at the top
  • Sending you an email notification for material changes

We encourage you to review this Privacy Policy periodically for any changes. Changes are effective when posted on this page.

Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us:

Email: [email protected]

Data Protection Officer: [email protected]

We aim to respond to all privacy inquiries within 48 hours.