CookieHug Privacy Policy

Effective date: 9 April 2026 · Last updated: 10 August 2026

1. Data controller

The controller of personal data processed in connection with the CookieHug service (cookiehug.com, the “Service”) is Alfabet Marki Sp. z o.o. with its registered office in Toruń, ul. Strzałowa 13K/1, 87-100 Toruń, Poland, NIP (tax ID) 9562399118, REGON 540603810, KRS 0001147842 (the “Controller”, “we”).

Data protection contact: privacy@cookiehug.com.

This policy consists of two parts:

• Part A — applies to Users of the Service (people who have a CookieHug account or use the cookiehug.com pages, including the public scanner). In this respect we act as the data controller.
• Part B — applies to visitors of our Clients’ websites on which the CookieHug consent banner runs. In this respect the data controller is the Client (the website owner), and we act as a data processor.

Part A — Users of the Service

2. What data we collect

• Account data: e-mail address and password (stored exclusively as a bcrypt cryptographic hash). With the optional sign-in via Google, Apple or Facebook — the account identifier at the given provider and the e-mail address passed by that provider.
• Configuration data: domains added to the account, banner settings, scanner and integration configuration.
• Billing data: the selected plan, transaction history and the data required to issue an invoice. We do not process payment card data — you provide it directly to the payment operator Stripe.
• Technical and security data: IP address, browser information and event logs (including sign-in attempt logs), one-time verification codes sent by e-mail.
• Public scanner: the address of the scanned website, the requester’s IP address and — if you provide it — the e-mail address for sending the report.

3. Purposes and legal bases

We process data in order to:

• provide the services and operate the account — Art. 6(1)(b) GDPR (performance of a contract),
• issue and store billing documents — Art. 6(1)(c) GDPR (legal obligation),
• ensure the security of the Service, including preventing abuse and handling logs — Art. 6(1)(f) GDPR (legitimate interest),
• handle requests and correspondence — Art. 6(1)(f) GDPR,
• send the public scanner report to the provided e-mail address — Art. 6(1)(b) GDPR (action at the request of the data subject).

4. Recipients of data

We entrust data only to parties that are necessary for us to provide the service:

• OVH — infrastructure hosting (servers in Warsaw, Poland),
• Cloudflare — CDN, proxy and attack protection,
• Stripe — payment processing,
• dpoczta.pl — transactional e-mail delivery (verification codes, notifications),
• Google, Apple, Facebook (Meta) — only if you use sign-in via these services.

The current list of subprocessors with their roles: /en/trust/subprocessors.

5. Transfers outside the EEA

We store data on servers in Poland. Some providers (Cloudflare, Stripe, Google, Apple, Meta) are based in the USA — data transfers take place on the basis of the European Commission’s adequacy decision on the EU-U.S. Data Privacy Framework (DPF) and, additionally, on the basis of Standard Contractual Clauses (SCC).

6. How long we keep data

The full retention schedule: /en/trust/data-retention.

7. Security

We store passwords exclusively as bcrypt hashes, panel sign-in is confirmed with a one-time e-mail code, and stored secrets (e.g. integration keys) are encrypted with AES-256-GCM. Data is transmitted over TLS. Details of the technical and organisational measures: /en/trust/security.

8. Your rights

You have the right of access to your data, rectification, erasure, restriction of processing, data portability and objection to processing based on legitimate interest. We handle requests without undue delay, at the latest within the time limits set by the GDPR — write to privacy@cookiehug.com.

You also have the right to lodge a complaint with a supervisory authority. In Poland this is the President of the Personal Data Protection Office (PUODO), ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl. You may also contact the supervisory authority in your country of residence.

9. Cookies on cookiehug.com

The CookieHug panel uses strictly necessary session cookies to keep you signed in. The informational pages of cookiehug.com use Google Tag Manager. We do not use cookies to profile Users of the Service, nor do we make automated decisions producing legal effects concerning them.

Part B — Visitors of Clients’ websites

10. CookieHug’s role

If you see a CookieHug banner on someone else’s website, the controller of your data is the owner of that website (our Client). CookieHug acts on their behalf as a data processor, on the basis of the Data Processing Agreement (DPA).

11. What we record — and what we don’t

The consent record stored on the CookieHug side includes, among other things, the selected consent categories, the region (e.g. “PL”), the device type, the banner language and variant, and a timestamp. The record does not contain the IP address, the user agent, a visitor identifier or the address of the visited page — it does not allow a person to be identified. Your consent choice is saved in your browser (a first-party cookie CookieHugConsent, valid for 30 days).

A detailed description of the data flow: /en/trust/data-processing.

12. Retention and your rights

We keep raw consent records for 90 days. For matters concerning data collected on a Client’s website (e.g. by analytics or marketing scripts running with your consent), please contact the owner of that website — they decide on the purposes and scope of that processing.

13. Changes to this policy

We will announce material changes to this policy in the Service, and registered Users will be informed by e-mail or a notice in the panel. Previous versions are available on request.

14. Contact

Alfabet Marki Sp. z o.o. ul. Strzałowa 13K/1, 87-100 Toruń, Poland NIP 9562399118 · REGON 540603810 · KRS 0001147842

• Data protection: privacy@cookiehug.com
• Support: support@cookiehug.com