This privacy policy is a translation of the Danish version. If the two versions differ, the Danish version prevails.

1. Data controller

Uneven Bits ApS (CVR 30487842), Dybbølsgade 39, 2. th., 1721 København V, Denmark, which operates Consentaur ("we", "us" or "our"), is the data controller for the personal data described in sections 3 to 5. You can contact us about data protection at support@consentaur.com.

2. Our two roles

We process personal data in two different roles:

As data controller for our customers' accounts, billing, emails to customers, support and our own website, consentaur.com. This privacy policy is about that processing.
As data processor for our customers. When a business uses Consentaur on its website, we record its visitors' consent choices on the business's behalf. The business is the data controller, and the processing is governed by our data processing agreement, which also sets out exactly what a consent record contains.

If you have visited a website that uses Consentaur and want to exercise your rights regarding your consent, please contact the owner of that website. We assist the owner under the data processing agreement.

3. When you have an account with us

When you create and use an account, we process:

Account details: name, email address, company name, your password, which we store only as an Argon2id hash, or your Google account ID if you sign in with Google, your language, whether your email address is verified, and when the account was created and last used to sign in.
Sign-in sessions: when you sign in, we store a record of the session: a random session ID, your user ID, whether you chose "Keep me signed in", when you signed in, when the sign-in was last renewed and when it expires, and hashes of the current and previous value of the _cb_refresh_token cookie (section 5), never the values themselves. It contains no IP address or browser details. We use it to keep you signed in and to be able to sign you out: on one device when you sign out there, and on all your devices when your password is changed or reset or your email address is changed. The legal basis is contract (Article 6(1)(b)). The record is deleted when you sign out, change or reset your password or delete your account, and otherwise automatically 24 hours after you signed in, or 30 days after if you chose "Keep me signed in".
Team: who you have invited to your team, and which teams you are a member of.
Subscription and payment: your plan and subscription status. Payments are handled by Stripe, where you enter your billing address and, if you have one, your VAT number. Your card details never reach us.
Your websites: the websites you add, your banner settings and the results of cookie scans (names, domains, lifetimes and categories of the cookies found, not their values).
Emails: we send emails about your account through Brevo, such as email verification, password resets, team invitations and notices about your trial and payments.

Your name, email address and password (or signing in with Google) are required to create an account.

Legal bases:

Contract (Article 6(1)(b) GDPR): to provide the service, run your account and subscription and send emails about your account.
Legal obligation (Article 6(1)(c)): to keep invoices and accounting records under the Danish Bookkeeping Act.
Legitimate interests (Article 6(1)(f)): to keep the service secure and prevent misuse.

4. When you write to us

If you write to us at support@consentaur.com, we process your message and contact details to reply. We provide support in Danish, English and German. The legal basis is contract (Article 6(1)(b)) when you are a customer or ask before buying, and otherwise our legitimate interest in answering enquiries (Article 6(1)(f)).

5. Our website, consentaur.com

We use our own cookie banner on consentaur.com. Necessary cookies are set without consent because they are needed to provide what you ask for: signing in, showing the pages in your language and remembering your cookie choice. Google Analytics 4 only loads if you consent to analytics.

Name	Purpose	Lifetime	Category
`_cb_access_token`	Keeps you signed in to the dashboard, 15 minutes at a time. httpOnly.	Until you close the browser; 15 minutes with "Keep me signed in"	Necessary
`_cb_refresh_token`	Renews your sign-in whenever the cookie above expires, so you stay signed in until you sign out or your sign-in ends. httpOnly.	Until you close the browser, valid for at most 24 hours after you sign in; 30 days after you sign in with "Keep me signed in"	Necessary
`NEXT_LOCALE`	Remembers the language you chose on the website, if it differs from your browser language.	Until you close the browser	Necessary
`consentaur_consent`	Stores your choice in our cookie banner (with a copy in localStorage).	365 days	Necessary
`g_state`	Set by Google's sign-in button on our sign-in pages: remembers that you signed out or closed Google's sign-in prompt, so you aren't signed straight back in. Contains no identifier.	About 6 months	Necessary
`user`	Session storage, not a cookie: a copy of your name, email and company for the dashboard in the open tab. Never your sign-in token.	Until you close the tab	Necessary
`signed_in`	localStorage, not a cookie, and only with "Keep me signed in": when your sign-in ends, so a new tab shows "Dashboard". No personal data.	Until you sign out, at most 30 days	Necessary
`_ga`	Google Analytics 4: distinguishes visitors.	2 years	Analytics
`_ga_BQSX9799KL`	Google Analytics 4: keeps the session state.	2 years	Analytics

Keep me signed in is your choice when you sign in, with your password or with Google, and is not ticked in advance. Without it, the two sign-in cookies only last until you close the browser, and your sign-in ends no later than 24 hours after you signed in, even if your browser restores its previous session. With it, that browser keeps you signed in for 30 days after you signed in, unless you sign out.
Google Analytics 4 (Google Ireland Limited) shows us how the website is used. The legal basis is your consent (Article 6(1)(a) and section 3 of the Danish Cookie Order; in Germany, section 25 TDDDG). You can withdraw your consent at any time under "Cookie settings" at the bottom of the page.
Your cookie choice: our banner records your choice in the same way as on our customers' websites (a random consent ID, your choice per category, the action, the time, the consent version, the banner language and the device type, but not your IP address). We do this to be able to demonstrate your consent (Article 6(1)(c) in conjunction with Article 7(1)). The record is deleted after 24 months.
Sign in with Google is optional. If you use it, we receive your name, email address and Google account ID from Google Ireland Limited.

6. Recipients

We share personal data with these recipients, only to the extent they need it:

Contabo GmbH, Welfenstrasse 22, 81541 Munich, Germany: servers and database. The data centre is in Lauterbourg, France, and is operated by Contabo France SAS.
Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany: servers and database, instead of or alongside Contabo. EU data centres only (Falkenstein and Nuremberg, Germany, and Helsinki, Finland).
Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA: network delivery and security for all traffic to the service (global), delivery of the banner script, and storage of backups in R2 (EU).
Stripe Payments Europe, Limited, One Wilton Park, Wilton Place, Dublin 2, D02 FX04, Ireland: payments and invoices.
Sendinblue SAS (Brevo), 9-17 rue Salneuve, 75017 Paris, France: sending emails.
Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland: Google Analytics 4 (only with your consent) and sign-in with Google (optional).

Cloudflare, Inc. is established in the USA. Transfers to Cloudflare are based on the European Commission's adequacy decision for the EU-US Data Privacy Framework (Article 45) and otherwise on the standard contractual clauses in Cloudflare's data processing agreement.

7. Retention

Account details are kept until you delete your account. If you cancel a paid subscription, the account continues on the Free plan and is not deleted.
Deleting your account: you can delete your account yourself under Settings in the dashboard. Your user, your sites with their consent records, cookie scans, scan results, page-view statistics and published banner scripts, your team memberships and your sign-in sessions are deleted immediately, and any active subscription is cancelled at the same time.
Sign-in sessions are deleted no later than 24 hours after you sign in, or 30 days if you chose "Keep me signed in" (see section 3).
Invoices are kept with Stripe for 5 years, as the Danish Bookkeeping Act requires.
Records of cookie choices on consentaur.com are deleted after 24 months.
Backups are kept for 30 days, so deleted data disappears from them no later than 30 days after.
Cookies have the lifetimes shown in the table in section 5.

8. Your rights

Under the GDPR you have the right to:

Access: see the data we hold about you.
Rectification: have inaccurate data corrected.
Erasure: have your data deleted. You can delete your account yourself in the dashboard.
Restriction: have the processing of your data restricted.
Data portability: receive your data in a structured, machine-readable format.
Objection: object to processing based on our legitimate interests.
Withdrawal of consent: withdraw a consent at any time, without affecting the lawfulness of the processing before the withdrawal.

To exercise your rights, write to support@consentaur.com.

9. Complaints

You can complain about our processing of your personal data to Datatilsynet, the Danish data protection authority. You will find its contact details at www.datatilsynet.dk. You can also complain to the supervisory authority in the EU country where you live or work (Article 77).

10. Changes

We may update this privacy policy. If we make significant changes, we will let you know by email or with a notice in the service.

Privacy policy