Privacy Policy

1. Who We Are

Cookie Banner ("we," "our," or "us") is a Montreal-based software company operating cookie-banner.ca. We provide cookie consent banner tools that help website owners meet their obligations under privacy laws such as PIPEDA, Quebec Law 25, GDPR, and CCPA.

This policy explains what personal information we collect, why we collect it, where it is stored, who we share it with, and the rights you have over it. It is written to meet the requirements of Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and Quebec's Act respecting the protection of personal information in the private sector (as amended by Law 25).

2. Accountability and Privacy Officer

We have designated a person in charge of the protection of personal information (Privacy Officer), who is responsible for our compliance with this policy and with applicable privacy laws.

You can reach our Privacy Officer at privacy@cookie-banner.ca for any question, access request, correction request, or complaint about how we handle personal information.

3. Information We Collect From You

When you create and use an account, we collect:

• Account information — your name, email address, and a securely hashed password, or your Google profile name and email if you sign in with Google.
• Billing information — your subscription plan and payment history. Payments are processed by Stripe; we never see or store your full card number.
• Content you upload — banner configurations, logos, and team or project details you add to your workspace.
• Support communications — messages you send to our support team.
• Security audit logs — records of sensitive account actions (such as sign-ins and settings changes), including the IP address and browser user agent, kept to protect your account.

4. Information We Process on Behalf of Our Customers

When a website uses one of our cookie banners, we process limited information about that website's visitors on the website owner's behalf, solely to record and prove consent:

• A pseudonymous consent ID and a one-way hashed cookie identifier (we cannot reverse these to identify a person)
• The consent decision (accepted, rejected, or customized) and the cookie categories chosen
• The two-letter country code of the visitor, the page path where consent was given, and a timestamp

We do not store visitor IP addresses, names, email addresses, or browsing history in consent records. Banner analytics are aggregated by country and contain no individual-level identifiers.

For this information, the website owner is responsible for the visitor relationship and we act as their service provider. Visitors who have questions about consent collected on a specific website should contact that website's owner first; we will assist the owner in responding.

5. Why We Collect It

• To provide, operate, and secure the service you signed up for
• To process payments and manage subscriptions
• To generate consent records and compliance reports for our customers
• To respond to support requests
• To send service and account emails (for example password resets and billing notices)
• To meet our own legal obligations

We do not sell personal information, and we do not use it for advertising.

6. Consent

We collect, use, and disclose personal information with your knowledge and consent, except where the law permits or requires otherwise. You may withdraw your consent at any time, subject to legal or contractual restrictions, by contacting us or deleting your account. Withdrawing consent may mean we can no longer provide the service to you.

7. Where Your Data Is Stored and Cross-Border Transfers

Our primary database is hosted by Supabase on Amazon Web Services infrastructure. We are in the process of moving primary data storage to AWS Canada (Montreal, Quebec) so that customer and consent data is stored at rest in Canada.

Some processing necessarily occurs outside Canada: our application is served by Vercel from data centres in the United States, payments are processed by Stripe, and transactional email is sent through Resend. Personal information handled by these providers may be stored or processed in the United States and may be accessible to authorities there under local law.

We use contractual and technical safeguards with every provider to ensure a comparable level of protection to that required in Canada.

8. Service Providers We Share Data With

• Supabase — database and file storage hosting (AWS)
• Vercel — application hosting and content delivery (United States)
• Stripe — payment processing (United States)
• Resend — transactional email delivery (United States)
• Google — optional sign-in with Google (OAuth)

Each provider receives only the information needed to perform its function and is bound by its own data processing terms.

9. How Long We Keep It

• Account information — kept while your account is active and deleted when you delete your account, except where we must retain records (for example billing records for tax purposes).
• Consent records — kept for the retention period of the customer's plan so the customer can demonstrate proof of consent, then deleted.
• Security audit logs — automatically purged on a rolling schedule.

10. How We Protect It

We protect personal information with safeguards appropriate to its sensitivity, including encryption in transit (TLS) and at rest, hashed passwords, hashed visitor identifiers, row-level access controls in our database, role-based team permissions, and audit logging of sensitive account actions. Access to production data is limited to those who need it to operate the service.

11. Breach Notification

If a breach of security safeguards creates a real risk of significant harm, we will notify the Office of the Privacy Commissioner of Canada, the Commission d'accès à l'information du Québec where required, and affected individuals as soon as feasible, and we will keep records of all breaches as required by law.

12. Your Rights

Subject to limited legal exceptions, you have the right to:

• Access the personal information we hold about you and know how it is used and to whom it has been disclosed
• Correct inaccurate or incomplete information
• Withdraw consent and request deletion of your information
• Receive computerized personal information you provided to us in a structured, commonly used format (data portability)
• Challenge our compliance with this policy

To exercise any of these rights, contact our Privacy Officer at privacy@cookie-banner.ca. We respond to requests within 30 days. If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, in Quebec, the Commission d'accès à l'information (cai.gouv.qc.ca).

13. Cookies on Our Own Website

We practice what we preach: cookie-banner.ca uses only cookies that are necessary to operate the site, such as authentication session cookies. We do not use third-party advertising or tracking cookies on our website.

14. Children

Our services are intended for businesses and are not directed at children under 14. We do not knowingly collect personal information from children.

15. Changes to This Policy

We may update this policy from time to time. We will post the updated version on this page with a new "Last updated" date, and we will notify account holders of material changes by email or in the dashboard.