Last updated: 19 October 2026

Privacy Policy

This Privacy Policy explains how CookieConsentHQ collects, uses, stores and protects personal information when you visit cookieconsenthq.com, create an account or use our dashboard.

CookieConsentHQ is operated by Hamza Ahmad Aslam, a sole proprietor based in Pakistan, at Apartment 401, 29AA, Bahria Town, Lahore, Pakistan.

Contact: support@cookieconsenthq.com

This policy covers our own website, dashboard and account-related processing. Personal information collected through our customers' websites is handled separately, as explained below.

1. Our role in processing personal data

CookieConsentHQ has two different roles.

Data controller: We determine how personal information is processed when you visit our website, create an account, contact support or manage a subscription.

Data processor: When our customers use CookieConsentHQ to collect and store their website visitors' consent records, we process that information on their behalf.

Our customers control their website visitors' data and are responsible for their own privacy notices and lawful processing.

Our Data Processing Agreement governs that relationship.

2. Information we collect

Account information

When you register or use our dashboard, we may collect:

• Name and email address.
• Business or organization name.
• Website domains connected to your account.
• Subscription plan and account settings.
• Login or authentication information.
• Support messages and communications.

Billing information

Payments are processed by Paddle.com, our Merchant of Record.

We may receive transaction details, including subscription status, payment amounts, billing identifiers and transaction history.

Payment card details entered during checkout are handled by Paddle, not directly by CookieConsentHQ.

Paddle's own privacy policy applies to its independent handling of payment information.

Technical and usage information

When you access our website or dashboard, we may process:

• IP addresses.
• Browser and device information.
• Approximate location derived from network information.
• Pages visited and dashboard interactions.
• Error logs and diagnostic information.
• Security events and service performance data.

Customer website consent records

When customers install our consent management script, we store the following consent record fields:

• Truncated IP address.
• Hashed user agent.
• Consent choices.
• Timestamp.
• Page path.

These records support consent logging and related service functionality.

Truncated and hashed identifiers may still constitute personal data under applicable privacy laws.

IP addresses and browser signals may also be processed temporarily to deliver the service, determine geographic rules and protect against abuse.

We do not use customer website visitors' consent records for unrelated advertising purposes.

3. How we use personal information

We use personal information to:

• Create and manage accounts.
• Authenticate users and secure the dashboard.
• Provide consent management services.
• Manage subscriptions and billing.
• Respond to support requests.
• Monitor service performance.
• Detect fraud and prevent abuse.
• Diagnose technical errors.
• Send service and account notifications.
• Comply with legal obligations.
• Improve the reliability and functionality of our platform.

Where permitted, we may send optional product or marketing communications. You can opt out of marketing messages.

We do not sell account personal information or share it for cross-context behavioral advertising.

4. Legal bases under GDPR and UK GDPR

Where GDPR or UK GDPR applies, we rely on the following legal bases:

Where we rely on legitimate interests, we consider those interests against individuals' rights and freedoms.

You may withdraw consent at any time where consent is the legal basis. Withdrawal does not affect processing that was lawful before withdrawal.

For personal information processed on a customer's behalf, the customer is responsible for identifying and documenting the applicable legal basis.

5. Cookies on our own website

CookieConsentHQ uses cookies and similar technologies on its own website and dashboard.

These may include:

Strictly necessary cookies: Used for authentication, session management, security and essential website functionality.

Preference cookies: Used to remember language, interface or privacy preferences.

Analytics cookies: If enabled, used to understand website usage and improve our services.

We request consent before using nonessential cookies where applicable law requires it.

You can manage optional cookies through our website's cookie preferences interface or your browser settings.

Disabling strictly necessary cookies may prevent parts of the dashboard from functioning.

Cookie names, providers and retention periods should be available through our cookie preferences interface when those cookies are in use.

6. Hosting and data storage

Customer website consent records are stored using Neon Postgres in Frankfurt, Germany, within the European Union.

Other account, billing, operational and technical information may be processed through our service providers in other countries.

Our infrastructure includes Cloudflare, Vercel and Neon.

Although the primary consent database is located in the EU, this does not mean every aspect of service processing remains exclusively within the EU.

International processing and transfers are subject to applicable contractual and legal safeguards.

7. Service providers

We use the following third-party providers:

Anthropic receives cookie names for classification, not personal information.

These providers process information according to their respective roles, contracts and privacy obligations.

Paddle acts as Merchant of Record and may independently determine certain purposes and methods of billing-related processing.

We may update our service providers where necessary and will handle changes involving customer personal data under our Data Processing Agreement.

8. Artificial intelligence

Our AI cookie scanner uses Anthropic to help classify cookie names.

Only cookie names are sent for this classification. Personal information, visitor identifiers and consent records are not sent to Anthropic for this purpose.

AI classifications are informational and may require verification.

We do not guarantee that automated classification identifies every cookie or determines its legal treatment correctly.

9. Data retention

We retain personal information only for as long as reasonably necessary for its purposes.

Retention depends on:

• Whether your account is active.
• The period needed to provide the service.
• Applicable billing and tax record requirements.
• Security, fraud prevention and dispute-resolution needs.
• Applicable legal obligations.

Customer website consent records are maintained while required to deliver the contracted service and are handled upon termination according to the Data Processing Agreement.

We delete or anonymize information when no longer needed, unless retention is required by law.

Certain records may remain temporarily in backups until their normal expiration or deletion cycle.

10. Security

We use reasonable technical and organizational safeguards designed to protect information against unauthorized access, alteration, loss and disclosure.

These include appropriate access restrictions, secure communications, infrastructure safeguards and monitoring.

No internet-based service or storage system can be guaranteed completely secure.

If a personal data breach affects customer-controlled information, we will notify affected customers in accordance with our Data Processing Agreement.

11. Your rights under GDPR and UK GDPR

Where applicable, you may have the right to:

• Access your personal data.
• Correct inaccurate information.
• Request deletion.
• Restrict processing.
• Object to certain processing.
• Request data portability.
• Withdraw consent.
• Lodge a complaint with a relevant data protection authority.

These rights are subject to applicable legal conditions and exceptions.

To exercise your rights relating to your CookieConsentHQ account, contact support@cookieconsenthq.com.

We may need to verify your identity before responding.

We respond within the time limits required by applicable law, generally within one month under GDPR and UK GDPR, subject to permitted extensions.

If your request concerns a consent record collected on another business's website, contact that website operator first.

We will assist our customer in responding to valid requests as required by our Data Processing Agreement.

12. International data transfers

CookieConsentHQ operates from Pakistan and uses service providers that may process information internationally.

Where applicable data protection law requires international transfer safeguards, we use appropriate mechanisms, including:

• The European Commission's Standard Contractual Clauses.
• The UK International Data Transfer Addendum or International Data Transfer Agreement, where applicable.
• Other legally permitted safeguards.

We assess applicable transfer requirements and implement supplementary measures where necessary.

Our Data Processing Agreement provides further information about international transfers of customer-controlled data.

13. California privacy rights (CCPA/CPRA)

This section applies where the California Consumer Privacy Act, as amended, applies to our processing.

Depending on your interaction with CookieConsentHQ, categories of personal information may include:

We collect this information directly from users, automatically through their interactions with our services or from service providers involved in delivering requested functionality.

We use and disclose these categories for the business purposes described in this policy, including service delivery, billing, security and support.

We do not sell personal information or share it for cross-context behavioral advertising.

We do not use sensitive personal information to infer characteristics about individuals.

Where applicable, California residents may request:

• Access to or knowledge of personal information collected.
• Correction of inaccurate personal information.
• Deletion of personal information.
• Information about applicable disclosures.
• Opting out of selling or sharing, if such activities occur.
• Protection from unlawful discrimination for exercising privacy rights.

Requests may be submitted to support@cookieconsenthq.com.

We may verify your identity or the authority of an authorized agent. We will respond within applicable legal deadlines.

For customer website consent records, CookieConsentHQ generally acts as a service provider. The relevant website operator is responsible for handling California consumer requests, with our assistance as required.

14. Children's privacy

CookieConsentHQ is intended for business users and is not directed to children.

We do not knowingly solicit personal information directly from children through account registration.

If you believe a child has provided personal information to our own service, contact support@cookieconsenthq.com.

15. Third-party websites

Our website may link to third-party websites or services.

Their privacy practices are governed by their own policies.

We are not responsible for the privacy practices of independently operated third-party websites.

16. Changes to this policy

We may update this Privacy Policy to reflect changes in our services, processing activities or legal requirements.

Material changes will be communicated through our website, dashboard or email where appropriate.

The updated date at the top identifies the current version.

17. Contact

For privacy inquiries, data protection requests or complaints:

CookieConsentHQ
Operated by: Hamza Ahmad Aslam
Address: Apartment 401, 29AA, Bahria Town, Lahore, Pakistan
Email: support@cookieconsenthq.com
Website: https://cookieconsenthq.com