Data processing agreement
Updated 20 October 2026.Last updated: 2026-10-20
This agreement is part of the terms of service and applies to every customer whose websites use the Cookiequiet banner. It follows Article 28 of the GDPR.
Roles
For the consent records (the choices made by your websites' visitors, with the data listed in the privacy policy), you are the controller and Cookiequiet (Cookiequiet, France) is the processor. For your account data, we are the controller.
Instructions
We process the consent records only to store them, show them to you, let you export them, delete them at the end of the retention period, and keep the daily counters. Your instructions are the settings of your account. We never use the records for our own purposes and never combine them across customers.
Subprocessors
| Subprocessor | Role | Location |
|---|---|---|
| Supabase, Inc. | Database and storage | European Union (AWS eu-west) |
| Vercel Inc. | Hosting, edge network, serverless functions | European Union (functions); global edge cache for the script only (no personal data cached) |
| Anthropic, PBC | Classification of cookie names; AI banner designer (reads the public homepage you point it at) | United States, under standard contractual clauses; no visitor data |
| Stripe, Inc. | Payments (account holders only) | European Union and United States |
We tell you 30 days before adding a subprocessor; you may object and terminate without penalty.
Security
Encrypted transport (TLS), encryption at rest, access limited to the operator, hashed IP addresses salted per day, row-level security in the database, daily backups, and the measures of the subprocessors above. We notify you of a personal data breach affecting the records without undue delay after becoming aware of it.
Retention and deletion
Records are deleted after 30 days (free websites) or 5 years (Pro websites), when you delete the website, or when you delete your account. Backups expire within 30 days.
Assistance and audits
We help you answer data subject requests about the records (search by the visitor id stored in the cq_consent cookie) and provide the information needed to demonstrate compliance. You may audit our processing once a year on reasonable notice, or rely on the subprocessors' certifications (SOC 2 and ISO 27001 for Supabase and Vercel).
Transfers
Records stay in the European Union. Anthropic receives no visitor data. Where a subprocessor transfers account data outside the EEA, the transfer relies on the EU-US Data Privacy Framework or the standard contractual clauses.
Contact for this agreement: hello@cookiequiet.com.