Privacy policy

Cookie Nexus provides a consent management platform for websites. This policy explains how we handle personal data when you visit cookienexus.com, create an account or use our product.

For the data described here, Cookie Nexus is the data controller. You can reach us at privacy@cookienexus.com.

• Account data — name, email address, company name and password (stored only as a secure hash).
• Billing data — billing address, VAT ID and invoice history. Card details are handled by Stripe; we never see or store full card numbers.
• Usage data — pages visited, features used, device and browser type, collected only with your consent.
• Support data — messages you send us and what you include in them.

We use personal data to:

• create and run your account and provide the service (contract);
• process payments, issue invoices and meet tax obligations (legal obligation);
• answer support requests and send important service notices (contract, legitimate interest);
• improve our website and product using statistics (consent);
• send product news, only if you opt in (consent).

When you install Cookie Nexus on your website, we record your visitors’ consent choices on your behalf. For this data, you are the controller and we are the processor.

Each consent record contains an anonymous consent ID, the date and time, the choices made, the banner version, language and a truncated IP address. We process it only to provide the service and keep it for the retention period you choose. Our Data Processing Agreement is available to every customer.

We use necessary cookies to run this website and remember your cookie choice. Preference, statistics and marketing cookies are only set if you allow them.

You can change your choice at any time in Cookie settings or with the cookie button in the corner of the page.

We share personal data only with service providers that help us run Cookie Nexus, under written agreements:

• Hosting — servers in Frankfurt, Germany (EU).
• Payments — Stripe, for card payments and invoicing.
• Email — a provider that delivers account and support emails.

We do not sell personal data.

Your account data and your visitors’ consent records are stored in the European Union. If a provider processes data outside the EU, we rely on an adequacy decision or the European Commission’s Standard Contractual Clauses.

• Account data — while your account is active, deleted within 30 days after you close it.
• Billing data — as long as tax law requires (usually up to 10 years).
• Consent records — for the period you set (from 6 months to 5 years).
• Support messages — up to 2 years after the request is closed.

Data is encrypted in transit (TLS) and at rest. Access is limited to staff who need it, protected by two-factor authentication, and logged.

Under the GDPR you can ask to access, correct, delete or export your data, object to or restrict its processing, and withdraw consent at any time. Write to privacy@cookienexus.com and we will reply within one month.

You can also complain to your local data protection authority.

Cookie Nexus is a business service and is not intended for children under 16. We do not knowingly collect their data.

We may update this policy as our service changes. The date of the latest version is shown at the top of this page, and we tell account holders about important changes by email.