Privacy Policy

Last updated: October 10, 2026

CookieBoss is operated by Transformination OÜ (registry code: 17449477), Sepapaja tn 6, 15551 Tallinn, Estonia (“we”, “us”, “our”).

This policy covers two roles:

• As controller, we process data about our customers (the people and companies who create a CookieBoss account) and about visitors to cookieboss.io.
• As processor, we process consent data about the visitors of our customers’ websites, on our customers’ behalf. Our customer is the controller of that data. How we handle it is set out in section 6 and in our Data Processing Agreement, which is available on request at [email protected].

1. What we collect about customers

• Account information: email address, password (stored only as a salted hash), and optionally your name and company.
• Signup attribution: if you arrived from a campaign link, the campaign parameters (UTM tags, Google Ads click ID), referring site, landing page and Google Analytics client ID. This is only recorded if you accepted analytics or marketing cookies on cookieboss.io, or if you signed up on the page you landed on.
• Billing information: handled by Stripe. We store your Stripe customer ID and subscription status, never your card details.
• Sites and configuration: the domains you add, your banner settings and texts, team members you invite, API keys (stored only as hashes) and webhooks.
• Scan data: cookies, storage, tracking requests and compliance scores found when you scan a website.
• Technical data: your IP address is used to protect our service (rate limiting; our copy is held for at most one hour) and to derive your approximate country. Our hosting provider Cloudflare processes request data, including IP addresses, to deliver and protect the service. Our application logs identify you only by your account ID, never by email address.

2. How we use customer data

• Provide the service: run your account, compile and serve your consent banner, run scans.
• Billing: subscriptions and invoices via Stripe.
• Transactional email: email verification, password reset, trial and billing notices, account deletion confirmation.
• Measure our marketing: signup attribution, only as described above.
• Security and abuse prevention: rate limiting, logging, fraud prevention.
• Legal obligations: accounting and tax records, responding to lawful requests.

The legal bases are performance of our contract with you (GDPR Art. 6(1)(b)), our legitimate interest in running and securing the service (Art. 6(1)(f)), your consent where we ask for it (Art. 6(1)(a)), and legal obligations (Art. 6(1)(c)).

3. Sub-processors

We use these service providers to run CookieBoss. The full, current list, with what each one processes, is on our sub-processor page.

Transfers outside the EU/EEA are covered by the EU Standard Contractual Clauses or the EU–US Data Privacy Framework, as provided in each provider’s data processing terms.

4. How long we keep data

• Account data: until you delete your account. You can do that yourself under Account → Delete account; deletion is immediate. Deleted data disappears from our database backups within 30 days.
• Scan results: 12 months, then automatically deleted.
• Shared scan reports (links from the free scanner): 90 days, then automatically deleted.
• Application logs: 30 days.
• Consent records on cookieboss.io: 12 months, the lifetime of your consent choice.
• Billing records: kept by Stripe for as long as Estonian tax law requires (7 years).

5. Your rights

You have the right to access, rectify and erase your personal data, to restrict or object to processing, and to data portability. You can delete your account at any time from your dashboard. For anything else, email [email protected]. You can also complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or your local data protection authority.

6. Data about our customers’ website visitors

When a website uses CookieBoss, we process the following on the website owner’s behalf, to record and prove the visitor’s consent choice:

• The consent choice: which categories were accepted or rejected, when, and with which banner version.
• A random visitor ID: stored on the visitor’s device only after they make a choice. Before a choice nothing is stored on the device.
• Approximate country and region: derived by Cloudflare from the visitor’s IP address, to show the right banner for local law. The IP address itself is not stored with the choice; the consent record holds at most a keyed one-way hash of it.
• Browser user agent: kept with consent events for analytics and troubleshooting.

These records are kept exactly as long as the consent lasts. The website owner, who is the controller, sets that duration (between 1 and 12 months; 12 by default). When it ends, the records are deleted automatically and the visitor is asked again. They’re also deleted at once if the owner deletes the site or their account. Visitors who want to exercise their rights should contact the website owner; we will help them respond.

7. Cookies on cookieboss.io

We use our own consent banner, and nothing that tracks you is stored on your device before you choose. If you accept, we use Google Analytics 4 and Google Ads to measure our website and campaigns. If you reject, they are never loaded. The full list is in our Cookie Policy.

8. Security

How we protect data is described on our security page.

9. Children

CookieBoss is not intended for children under 16. We do not knowingly collect data from children.

10. Changes

We may update this policy. Significant changes will be communicated via email to registered users.

11. Contact

Transformination OÜ Sepapaja tn 6, 15551 Tallinn, Estonia Email: [email protected]