Privacy policy.

Who is responsible?

OpenCookies, published by Antoine Bartrolich (see the legal notice), is responsible for the data described below: that of visitors to opencookies.com, people who use the free tests and account holders.

For the visitors to your own sites, OpenCookies acts as a processor: the data controller is you, the site owner. See the data processing page.

For any question or request: contact@opencookies.com.

No trackers on this site

opencookies.com uses no audience measurement, no advertising and no third-party resources. The only cookie is the “oc_sess” session cookie, set after logging in to the customer area: it is strictly necessary and disappears when the browser is closed. The site’s language is chosen by the page address (for example /en/) and is not remembered by any cookie.

Data processed, purposes and retention

• Host logs. At each visit, the server records the IP address, the date and the page requested, for the security and proper operation of the service (legitimate interest). The retention period is the host’s.
• Abuse protection. An irreversible fingerprint of your IP address, renewed every day, is kept for 48 hours at most together with the number of requests, to limit abuse (legitimate interest). It is neither published nor reused.
• Free site test. The domain name entered, the report and three screenshots of the tested site’s home page are kept for 30 days (performance of the service requested), then deleted. The report can only be read by people who have its address, which is long and random, and is not indexed by search engines. For a test run from the United States, the domain is passed to GitHub Actions, which runs the test browser.
• Account. E-mail address, password (stored only in hashed form), account creation and last login dates, declared sites (domain, site key), banner settings and check results (performance of the contract). This data is kept as long as the account exists and deleted when you delete your account from the “My account” page.
• Site installed by an AI assistant. When an assistant installs the banner without an account, the site stays provisional and is deleted after 14 days, unless you attach it to an account.
• E-mails. We only send the e-mails needed for the service (password reset, attaching a site, test alerts). No commercial mailing without your consent.
• Re-test by e-mail. If you leave your address to be told about a new test, it is used only for that, with your consent, which you can withdraw at any time.
• Consent log. The proof of your visitors’ choices is kept for 3 months on a site on the Free plan and 13 months on a Pro or Agency site, then deleted automatically. It contains neither identity nor IP address.
• Agency sponsorship. If you sign up through a sponsorship link, the account that invited you is recorded with yours so that the reward can be calculated. The sponsor only sees the number of sign-ups, confirmed accounts and paid accounts, never your data.
• Payment. When online payments open, they will be processed by Stripe Payments Europe, Ltd. (Dublin, Irlande); OpenCookies neither sees nor keeps your card number. Invoices and accounting records are kept for 10 years (legal obligation).
• Backups. A technical backup of the database is made every day and the last 14 are kept: deleted data may therefore remain in the backups for up to 14 days.

Data of the visitors to your sites (banner)

When the OpenCookies banner is installed on a site, the following processing is carried out on behalf of the site owner, of whom OpenCookies is the processor:

• Proof of consent. A random identifier created in the browser, the choices by category, the date, the page and the text version. No IP address is recorded with this proof.
• Audience measurement. No cookie or identifier at the standard level: page views, source, device type, performance and errors, kept in aggregate form for 25 months at most. Detailed journeys, with a random identifier, are recorded only with the visitor’s consent and kept for 13 months at most.
• Detection of third-party services. Once a day per browser, the banner reports the names of the third-party services contacted and the names of cookies (never their content), to help the site owner set up blocking.

Who receives your data?

Your data is neither sold nor used for advertising purposes. It is accessible to our host (o2switch SAS), which stores the site, its data and sends the service’s e-mails; to GitHub (Microsoft), only to run tests launched from the United States, for which it receives the tested domain; and to the authorities when the law requires it.

Transfers outside the European Union

OpenCookies’ servers are located France (Clermont-Ferrand). When data is processed outside the European Union (host, GitHub), the following safeguards apply: les clauses contractuelles types de la Commission européenne ou le cadre de protection des données UE-États-Unis.

Security

Encrypted connections (HTTPS), hashed passwords, protected session cookie, IP addresses never recorded with consent proofs, each account’s data kept separate, restricted administration access. As no system is infallible, we will inform you of any data breach under the conditions provided by law.

Your rights

You can access your data, correct it, erase it, restrict its processing, object to it and, where applicable, retrieve it in a readable format (CSV export of consents in your customer area). Write to contact@opencookies.com: we reply within one month.

If you visited a site that uses OpenCookies, contact the owner of that site first, who is the data controller. If you believe your rights are not being respected, you may lodge a complaint with the data protection authority of your country (in France: the CNIL, cnil.fr).

Changes

This policy may change. The date of the last update appears at the top of the page; significant changes are notified to account holders.