Privacy Policy

1. Introduction

CookieBeam ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our cookie consent management service.

This policy complies with the EU General Data Protection Regulation (GDPR), UK GDPR, and California Consumer Privacy Act (CCPA).

2. Data Controller Information

3. Information We Collect

3.1 Personal Information You Provide

• Account information (name, email address, company details)
• Billing information (payment details, billing address)
• Communication data (support tickets, feedback)
• Website configuration data (domains, banner settings)

When you send a message through the public contact form, we collect the name, email address, topic, and message you provide. Arimatics stores these requests in its self-hosted customer-management service so the team can respond. Sending a support request does not create a CookieBeam account or grant product access. A separate, optional checkbox controls whether we may send CookieBeam product updates by email.

The marketing website offers optional journey tracking. The self-hosted tracker is not loaded unless you accept, and your choice is stored in browser local storage. If you accept, it records the pages you visit and their URLs and timestamps. If you submit the contact form while tracking is allowed, that page history may be linked to your contact record in Arimatics’ self-hosted customer-management service. This optional page history does not use a third-party pixel or session replay. You can change or withdraw your choice in Journey tracking settings. This choice is separate from consent to receive marketing email.

3.2 Information Collected Automatically

• Usage data (pages visited, features used, time spent)
• Device information (IP address, browser type, operating system)
• Consent records (user consent choices, timestamps)
• Performance data (banner load times, error logs)

3.3 Third-Party Data

• Payment processing data from Stripe
• Analytics data from Google Analytics (anonymized)
• Authentication data from OAuth providers

4. Legal Basis for Processing

5. How We Use Your Information

• Provide and maintain our cookie consent service
• Process payments and billing
• Send service-related communications
• Improve our services and develop new features
• Ensure security and prevent fraud
• Comply with legal obligations
• Provide customer support

6. Data Sharing and Disclosure

6.1 Service Providers

• Stripe (payment processing and billing)
• Oracle Cloud Infrastructure and Cloudflare (hosting and CDN)
• Amazon Web Services (serverless cookie scanning)
• Resend (transactional email delivery)
• Sentry (error monitoring and session replay)

A current list of sub-processors, including what each one processes and where, is maintained at /subprocessors.

6.2 Legal Requirements

We may disclose information when required by law, court order, or to protect our rights.

6.3 International Transfers

Data may be transferred to countries outside the EU/UK with adequate protection measures including Standard Contractual Clauses.

7. Your Rights Under GDPR/UK GDPR

To exercise these rights, contact us at privacy@cookiebeam.com or use our Data Rights Portal.

8. California Privacy Rights (CCPA)

California residents have additional rights:

• Right to know what personal information is collected
• Right to delete personal information
• Right to opt-out of sale of personal information
• Right to non-discrimination for exercising privacy rights

Note: We do not sell personal information to third parties.

9. Data Retention

• Account data: Retained while account is active + 3 years
• Consent records: Retained according to your plan's published retention period
• Billing data: Retained for 7 years (legal requirement)
• Support communications: Retained for 2 years
• Usage logs: Retained for 1 year

10. Security Measures

• TLS protects public service connections. Selected stored secrets use field encryption with one shared key. Backup artifacts are not encrypted; provider storage encryption depends on hosting configuration.
• Regular security audits and penetration testing
• Access controls and authentication
• Employee security training
• Incident response procedures

11. Children's Privacy

Our service is not intended for children under 16. We do not knowingly collect personal information from children under 16.

12. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes via email or service notification.

13. Contact Information