Privacy policy

Who we are

HopCookie is operated by [Company name], company code [company code], registered at [registered address] (“we”, “us”). We are the controller of personal data about our customers, their team members and people who visit this website. You can contact us about privacy at [email protected].

Our role on customers' websites

When a customer installs the HopCookie script on their website, that customer decides which cookies and scripts run on the site and why, and is the controller of the related personal data. We act as the customer's processor: we show the banner, store consent records and scan the site only to provide the service to that customer and under their instructions.

If you visited a website that uses HopCookie, you can change your choice at any time through that site's cookie settings link. For questions about the site's cookies or to exercise your rights, contact the site owner. If you contact us instead, we will pass your request to the relevant customer.

Information we collect

Depending on how you use HopCookie, we handle the following:

• Account details. Your name, email address, password (stored only as a secure hash), email verification status and language preference. If you sign in with a third-party account, we receive your name, email address and account identifier from that provider.
• Website settings. Domains you add and their verification status, banner text and design, cookie categories and descriptions, policy texts and installation settings.
• Billing information. If you choose a paid plan, our payment provider collects your payment details. We never see or store your full card number; we keep customer and subscription identifiers, plan and subscription status.
• Communications. Messages you send us and the emails we send you about your account.
• Technical data. IP address, browser user agent and session data when you sign in or use the workspace, used to keep you signed in and protect the service.
• Consent records. When a visitor makes a choice in a HopCookie banner, we store a random receipt identifier, the decision, the selected categories, the banner configuration version, the page address without query parameters and the time. We do not store the visitor's IP address or name with the record. The visitor's browser keeps a consent cookie so the choice is remembered.
• Scan results. Our scanner visits the public pages of websites you add, on request and periodically, and records cookie names, domains, durations and script addresses. Scans do not sign in to websites or collect visitors' personal data.

Why we use it and on what legal basis

We process personal data for these purposes under the EU General Data Protection Regulation (GDPR):

• Providing HopCookie (contract). Creating and running your account, saving website settings, serving the banner, storing consent records and running scans.
• Payments (contract and legal obligation). Managing subscriptions, issuing invoices and keeping accounting records.
• Security (legitimate interest). Protecting accounts, temporarily limiting requests to login and consent endpoints by IP address, and investigating misuse.
• Service emails (contract). Email verification, password resets, billing messages and important notices about the service.
• Improving the service (legitimate interest). Aggregated figures, such as the number of websites and consent choices, to understand how HopCookie is used.
• Legal obligations. Complying with tax, accounting and other laws and responding to lawful requests from authorities.

We do not sell personal data, use it for advertising or make decisions about you based solely on automated processing.

Who we share it with

We use carefully selected service providers, who process personal data on our behalf and only to deliver their service:

• Hosting — application servers, database and backups.
• Sign-in — optional sign-in with a third-party account.
• Email delivery — sending account and service emails.
• Payment processing — payments, subscriptions and invoices. The payment provider may also act as an independent controller for some payment data under its own privacy policy.
• Browser infrastructure — running the browser used to scan websites.

A current list of our service providers is available on request at [email protected]. We may also disclose information to professional advisers, to authorities where the law requires it, or to a successor if HopCookie is reorganised or sold, in which case this policy will continue to apply.

International transfers

Some of our service providers are based in or process data in the United States or other countries outside the European Economic Area. In those cases, we rely on a European Commission adequacy decision, such as the EU–US Data Privacy Framework, or on the Commission's Standard Contractual Clauses.

How long we keep it

• Account data is kept while your account is active and deleted after the account is closed, unless we must keep it longer.
• Website settings, consent records and scans are kept while the website remains in your workspace, so you can demonstrate the choices visitors made. Deleting a website removes its settings, consent records and scan results. We keep only the latest completed scan for each website.
• Billing records are kept for as long as tax and accounting laws require.
• Sessions and rate limits expire automatically. IP-based rate limiting data is kept for minutes, not days.
• Backups may contain deleted data for a limited period until they are overwritten.

Cookies on this website

This website and the workspace use only cookies needed for them to work, which do not require consent:

• Session cookie — keeps you signed in; expires after a period of inactivity.
• XSRF-TOKEN — protects forms against cross-site request forgery; expires with the session.
• hopcookie_locale — remembers your language choice for one year.

We do not use analytics or advertising cookies. Third-party sign-in and payment pages may set their own cookies when you use them.

How we protect it

We use encrypted connections, hashed passwords, access controls that limit who can see personal data, and providers with recognised security practices. No system is completely secure; if a personal data breach affects you, we will notify you and the authorities as the law requires.

Your rights

Under the GDPR, you have the right to:

• Access — get a copy of the personal data we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Erasure — ask us to delete your data.
• Restriction — ask us to limit how we use your data.
• Portability — receive your data in a machine-readable format.
• Objection — object to processing based on our legitimate interests.
• Withdrawal of consent — where we rely on consent, withdraw it at any time.

You can update most account details yourself in Profile & security. To exercise any other right, email [email protected]. We will reply within one month and may ask you to confirm your identity.

You can also lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live, work or where the alleged infringement took place.

Children

HopCookie is a business service and is not intended for children under 16. We do not knowingly collect their personal data.

Changes to this policy

We may update this policy when HopCookie or the law changes. The date at the top shows the current version.