Privacy policy

1. Data controller

Uneven Bits ApS (CVR 30487842), Dybbølsgade 39, 2. th., 1721 København V, Denmark, which operates Consentaur("we", "us" or "our"), is the data controller for the personal data described in sections 3 to 5. You can contact us about data protection at support@consentaur.com.

2. Our two roles

We process personal data in two different roles:

• As data controllerfor our customers' accounts, billing, emails to customers, support and our own website, consentaur.com. This privacy policy is about that processing.
• As data processor for our customers. When a business uses Consentauron its website, we record its visitors' consent choices on the business's behalf. The business is the data controller, and the processing is governed by our data processing agreement, which also sets out exactly what a consent record contains.

If you have visited a website that uses Consentaur and want to exercise your rights regarding your consent, please contact the owner of that website. We assist the owner under the data processing agreement.

3. When you have an account with us

When you create and use an account, we process:

• Account details: name, email address, company name, your password, which we store only as an Argon2id hash, or your Google account ID if you sign in with Google, your language, whether your email address is verified, and when the account was created and last used to sign in.
• Team: who you have invited to your team, and which teams you are a member of.
• Subscription and payment: your plan and subscription status. Payments are handled by Stripe, where you enter your billing address and, if you have one, your VAT number. Your card details never reach us.
• Your websites: the websites you add, your banner settings and the results of cookie scans (names, domains, lifetimes and categories of the cookies found, not their values).
• Emails: we send emails about your account through Brevo, such as email verification, password resets, team invitations and notices about your trial and payments.

Your name, email address and password (or signing in with Google) are required to create an account.

Legal bases:

• Contract (Article 6(1)(b) GDPR): to provide the service, run your account and subscription and send emails about your account.
• Legal obligation (Article 6(1)(c)): to keep invoices and accounting records under the Danish Bookkeeping Act.
• Legitimate interests (Article 6(1)(f)): to keep the service secure and prevent misuse.

4. When you write to us

If you write to us at support@consentaur.com, we process your message and contact details to reply. We provide support in Danish, English and German. The legal basis is contract (Article 6(1)(b)) when you are a customer or ask before buying, and otherwise our legitimate interest in answering enquiries (Article 6(1)(f)).

5. Our website, consentaur.com

We use our own cookie banner on consentaur.com. Necessary cookies are set without consent because they are needed to provide what you ask for: signing in, showing the pages in your language and remembering your cookie choice. Google Analytics 4 only loads if you consent to analytics.

• Google Analytics 4(Google Ireland Limited) shows us how the website is used. The legal basis is your consent (Article 6(1)(a) and section 3 of the Danish Cookie Order; in Germany, section 25 TDDDG). You can withdraw your consent at any time under "Cookie settings" at the bottom of the page.
• Your cookie choice:our banner records your choice in the same way as on our customers' websites (a random consent ID, your choice per category, the action, the time, the consent version, the browser language and the device type, but not your IP address). We do this to be able to demonstrate your consent (Article 6(1)(c) in conjunction with Article 7(1)). The record is deleted after 24 months.
• Sign in with Google is optional. If you use it, we receive your name, email address and Google account ID from Google Ireland Limited.

6. Recipients

We share personal data with these recipients, only to the extent they need it:

• Contabo GmbH, Welfenstrasse 22, 81541 Munich, Germany: servers and database. The data centre is in Lauterbourg, France, and is operated by Contabo France SAS.
• Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA: network delivery and security for all traffic to the service (global), delivery of the banner script, and storage of backups in R2 (EU).
• Stripe Payments Europe, Limited, One Wilton Park, Wilton Place, Dublin 2, D02 FX04, Ireland: payments and invoices.
• Sendinblue SAS (Brevo), 9-17 rue Salneuve, 75017 Paris, France: sending emails.
• Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland: Google Analytics 4 (only with your consent) and sign-in with Google (optional).

Cloudflare, Inc. is established in the USA. Transfers to Cloudflare are based on the European Commission's adequacy decision for the EU-US Data Privacy Framework (Article 45) and otherwise on the standard contractual clauses in Cloudflare's data processing agreement.

7. Retention

• Account details are kept until you delete your account. If you cancel a paid subscription, the account continues on the Free plan and is not deleted.
• Deleting your account: you can delete your account yourself under Settings in the dashboard. Your user, your sites with their consent records, cookie scans, scan results, page-view statistics and published banner scripts, and your team memberships are deleted immediately, and any active subscription is cancelled at the same time.
• Invoices are kept with Stripe for 5 years, as the Danish Bookkeeping Act requires.
• Records of cookie choices on consentaur.com are deleted after 24 months.
• Backups are kept for 30 days, so deleted data disappears from them no later than 30 days after.
• Cookies have the lifetimes shown in the table in section 5.

8. Your rights

Under the GDPR you have the right to:

• Access: see the data we hold about you.
• Rectification: have inaccurate data corrected.
• Erasure: have your data deleted. You can delete your account yourself in the dashboard.
• Restriction: have the processing of your data restricted.
• Data portability: receive your data in a structured, machine-readable format.
• Objection: object to processing based on our legitimate interests.
• Withdrawal of consent: withdraw a consent at any time, without affecting the lawfulness of the processing before the withdrawal.

To exercise your rights, write to support@consentaur.com.

9. Complaints

You can complain about our processing of your personal data to Datatilsynet, the Danish data protection authority. You will find its contact details at www.datatilsynet.dk. You can also complain to the supervisory authority in the EU country where you live or work (Article 77).

10. Changes

We may update this privacy policy. If we make significant changes, we will let you know by email or with a notice in the service.