Privacy policy
Mis à jour le 20 octobre 2026. Ce document est disponible en anglais.Last updated: 2026-10-20
Cookiequiet is operated by Cookiequiet, France (“we”). This policy covers two situations: when you use cookiequiet.com and the app as an account holder (we are the controller), and when you visit a website that uses the Cookiequiet banner (its owner is the controller; we process the consent records on their instructions, under the data processing agreement).
Account holders
| Purpose | Data | Legal basis | Kept for |
|---|---|---|---|
| Your account and the service | E-mail address, password (hashed) or Google sign-in id, the websites you add, their configuration, scans and policies | Performance of the contract (the terms) | Until you delete the account, then 30 days in backups |
| Billing | Name, billing address, VAT number, the last four digits of the card (held by Stripe, never by us), invoices | Contract; legal obligation (accounting) | 10 years for invoices |
| Support and notifications | Your messages, the e-mail address, the events that matter (first website, banner installed, purchase) sent to the operator's own messaging | Legitimate interest (running the service) | 24 months |
| Security | IP address, browser, timestamps in server logs | Legitimate interest (security) | 12 months |
| First-touch attribution | The campaign parameters of the link you arrived from (utm, gclid), in a cookie for 90 days and on the profile | Legitimate interest (knowing what works) | 90 days / with the account |
Processors: Supabase (database and authentication, Amazon Web Services, EU region), Vercel (hosting, EU region for functions, global CDN), Stripe (payments, EU and US), Anthropic (AI brand match and the AI design agent read the public homepage of your website, and the agent reads your chat messages; the classifier reads cookie names and your platform; no account data), Google (sign-in, if you use it; Google Ads conversion measurement, if you consented to marketing cookies). Transfers outside the EEA rely on the EU-US Data Privacy Framework or standard contractual clauses.
Visitors of websites that use the banner
When you make a choice in a Cookiequiet banner, the website's owner has us record it as proof of consent: the date, the choice (accept all, reject all, custom, withdrawn), the categories, the banner version, the language, the country and region from your IP address, the page, a random id stored in the cq_consent cookie of that website, a hash of your IP address salted per day (not reversible), and your browser's user-agent string. Records are kept 30 days (free websites), 1 year (Starter websites) or 5 years (Pro websites), then deleted. We never use them for anything else, never combine them across websites, and never sell them. To exercise your rights over these records, contact the website's owner; we help them answer.
The banner script sets one cookie on the website you visit, cq_consent, which stores your choice. It sets nothing on cookiequiet.com.
Cookies on cookiequiet.com
The site uses only necessary cookies: the session cookies of the app, the cq_consent cookie of our own banner, a signed-in flag, and the attribution cookie above. Google Ads conversion measurement, when configured, runs only after you accept marketing cookies in our banner; we do not use analytics cookies.
Your rights
Access, rectification, erasure, restriction, portability, objection, and withdrawal of consent at any time: write to hello@cookiequiet.com. We answer within a month. You can complain to the CNIL (www.cnil.fr) or the authority of your country.
Changes and contact
We update the date above when this policy changes and announce significant changes by e-mail. Contact: hello@cookiequiet.com.