Privacy Policy

This Privacy Policy sets out the rules for processing personal data by CLEVER AGENT SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ, with its registered office in Kleosin (the "Controller"), in connection with providing services through the CookiePilot platform.

1. Data controller

2. Scope of data collected

The Controller collects the following categories of personal data:

2.1 Data of CookiePilot platform Users

• Email address (required for registration)
• First and last name or company name
• VAT ID (for business customers)
• Billing address
• Payment data (processed by Stripe)
• IP address and device data
• Login and Panel activity history
• Your answer to "How did you hear about us?" (the option chosen and any details)
• Sign-up source: campaign parameters from the link you followed to sign up (e.g. utm_source, utm_medium, utm_campaign), the cookiepilot.io page where you clicked "Sign up", and the sign-up method (e-mail, Google, WordPress plugin, PrestaShop module, AI assistant)
• The country of sign-up, derived from your IP address (we store only the country code, not the IP address)
• Consent to commercial information: whether you gave it, the text and version of the consent, the date it was given or withdrawn, the language and the e-mail address it covers

2.2 End-user data (visitors to customers' websites)

As part of providing the CMP service, we process on behalf of our customers (as a processor):

• Consent identifier (anonymous hash)
• Scope of consent granted (cookie categories)
• Date and time of consent
• Banner version
• IP address (in anonymized form)
• Browser identifier (User Agent)

2.3 Automatically collected data

• Server logs (IP address, browser type, access time)
• Analytics data (via Google Analytics 4)
• Error and performance information

2.4 Contact form data

• Email address, topic and message
• Name and website address, if you provide them
• The page language and the page the form was sent from

We do not store your IP address or browser details with the message. The IP address is used in server memory to limit the number of messages and to check reCAPTCHA (see section 9.7); it also appears in server logs as described in sections 2.3 and 7.

3. Purposes of processing

Personal data is processed for the following purposes:

4. Legal bases for processing

We process personal data on the basis of:

• Art. 6(1)(a) GDPR — consent to processing (e.g. newsletter, marketing cookies)
• Art. 6(1)(b) GDPR — necessity to perform a contract or to take steps before entering into one
• Art. 6(1)(c) GDPR — compliance with a legal obligation (accounting, storing consents)
• Art. 6(1)(f) GDPR — the Controller's legitimate interest (analytics, security, direct marketing)

5. Data recipients

Personal data may be shared with the following categories of recipients:

5.1 Processors

• Stripe — payment processing (Stripe, Inc., USA — SCC)
• Google Cloud Platform — hosting and data storage (Google LLC, USA — SCC)
• Google Analytics — analytics (Google LLC, USA — SCC)
• Resend / Mailgun — transactional email delivery
• The email provider hosting the kontakt@cookiepilot.io mailbox — delivery of notifications about contact form messages
• Google reCAPTCHA — protecting the contact form and the site's admin login against bots (Google Ireland Ltd / Google LLC, USA — EU-US Data Privacy Framework, SCC)
• Sentry — error monitoring

5.2 Public authorities

Data may be shared with state authorities (e.g. the tax office, the data protection authority) on the basis of applicable law.

5.3 Advisors and auditors

In justified cases, data may be shared with law firms, statutory auditors or audit firms.

6. Transfers to third countries

1. Some personal data may be transferred to the USA in connection with the use of Google and Stripe services.
2. Transfers take place on the basis of:
   • Standard Contractual Clauses (SCC) approved by the European Commission
   • European Commission adequacy decisions (the EU-US Data Privacy Framework)
3. The Controller applies additional safeguards, such as encryption and pseudonymization of data.

7. Data retention period

We retain personal data for the following periods:

• Account data — for the term of the contract and 5 years after it ends
• Billing data — 5 years from the end of the tax year in which the invoice was issued
• Consent records — for as long as we process data based on consent and, after consent is withdrawn or processing ends, until claims become time-barred; consents given in the website banner are kept for 2 years
• Analytics data — 14 months (Google Analytics)
• Server logs — 90 days
• Marketing data — until consent is withdrawn or an objection is raised
• Sign-up source data (campaign parameters, page, country, answer to "How did you hear about us?") — while the account exists
• Data of a sign-up started by an AI assistant that was not confirmed — up to 24 hours
• Records of consent to commercial information and its withdrawal — while the account exists
• Contact form messages (in the admin panel and the mailbox) — 3 years from closing the matter, or 3 years from receipt if it was never closed; messages marked as spam — 30 days from receipt

8. Rights of data subjects

Under the GDPR you have the following rights:

8.1 Right of access (Art. 15 GDPR)

You can find out whether we process your data and obtain a copy of it.

8.2 Right to rectification (Art. 16 GDPR)

You can request correction of inaccurate data or completion of incomplete data.

8.3 Right to erasure — "right to be forgotten" (Art. 17 GDPR)

You can request erasure of data if there is no legal basis for further processing.

8.4 Right to restriction of processing (Art. 18 GDPR)

You can request restriction of data processing in certain situations.

8.5 Right to data portability (Art. 20 GDPR)

You can receive your data in a structured format (JSON, CSV) and transfer it to another controller.

8.6 Right to object (Art. 21 GDPR)

You can object to processing based on legitimate interest, including direct marketing.

8.7 Right to withdraw consent (Art. 7(3) GDPR)

You can withdraw your consent to data processing at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

You can withdraw consent to commercial information in the Panel under Settings → Account or by writing to kontakt@cookiepilot.io. Service messages about your account and the service (e.g. address verification, limits, payments) are sent regardless of this consent.

8.8 Right to lodge a complaint

You have the right to lodge a complaint with the supervisory authority — the President of the Polish Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw. You may also contact your own national data protection authority.

To exercise these rights, contact us at kontakt@cookiepilot.io. We will respond within 30 days.

9. Cookies and similar technologies

9.1 What are cookies?

Cookies are small text files saved on a user's device when visiting a website. They are used to remember preferences and improve how the site works.

9.2 Types of cookies used on cookiepilot.io

9.3 Managing cookies

You can manage cookie settings in several ways:

• Through the cookie banner displayed on the site
• In your browser settings
• By clicking the "Manage consent" link in the site footer

9.4 Google Consent Mode v2

We use Google Consent Mode v2, which passes consent information to Google services. As a result:

• Google scripts are blocked until consent is given
• After consent is given, the ad_storage, analytics_storage, ad_user_data and ad_personalization parameters are updated
• Without consent, Google applies data modeling (Consent Mode modeling)

9.5 Sign-up links

When you go from cookiepilot.io to sign up, the link may contain the page where you clicked "Sign up" and campaign parameters (e.g. utm_source). This information travels only in the link — we do not store it in cookies or browser storage. If you sign up with Google, we keep it on our server for up to 10 minutes during the login, and save it with the account only once the sign-up is complete.

9.6 Sign-up through an AI assistant (MCP)

You can also create a CookiePilot account through an AI assistant (e.g. ChatGPT, Claude) that uses our MCP server. In that case:

• The assistant sends us the e-mail address, company name and website you gave it. We keep them on our server for up to 24 hours while waiting for confirmation, and send one message with a link to that address.
• The account is created only when you click the link, set a password and accept the terms on our page. Consent to marketing messages is separate there and unticked by default. If you do not confirm, the data is deleted after 24 hours.
• If the address already has an account, we send a message with a login link and create no new account.
• After you confirm, for 24 hours the assistant can finish setting up only that account: add your website, set up the banner, give you the install code, check the installation and give you a Stripe payment link. It cannot change your password or e-mail, or see invoices.
• As the sign-up source we store the assistant's name (taken from the User-Agent header) and the sign-up method "AI assistant". We do not receive the content of your conversation with the assistant. MCP server logs record only the tool called, the outcome and the time, without the data passed in.
• The legal basis is Art. 6(1)(b) GDPR (steps taken at your request before entering into a contract). Your conversation with the assistant is processed by its provider under its own terms.

9.7 Contact form and Google reCAPTCHA

The contact form on the contact page in every language version is protected by Google reCAPTCHA v3. The reCAPTCHA script loads only when you start filling in the form, not when the page opens. It assesses whether a person is filling in the form based on, among other things, your IP address, browser details and how you use the page, and it may store or read data in your browser. Google receives this data under the Google Privacy Policy. Storing and reading data in your browser relies on the exemption in Art. 5(3) of the ePrivacy Directive (Art. 399 of the Polish Electronic Communications Law) for operations strictly necessary to provide the service you ask for, namely securely accepting your message. The processing of personal data relies on our legitimate interest in protecting the form against spam and abuse (Art. 6(1)(f) GDPR). If you prefer not to use reCAPTCHA, write directly to kontakt@cookiepilot.io. The same mechanism protects the login to the site's admin panel.

10. Google Analytics

1. We use Google Analytics 4 to analyze site traffic and improve our services.
2. Google Analytics collects data such as: IP address (anonymized), device type, browser, geographic location (country/region), pages visited, and visit duration.
3. Data is stored for 14 months and may be transferred to Google servers in the USA.
4. You can opt out of Google Analytics tracking by installing the Google Analytics Opt-out browser add-on.

11. Data security

We apply appropriate technical and organizational measures to protect personal data:

• Encryption — all connections are encrypted with TLS 1.3
• Password hashing — passwords are stored hashed (bcrypt)
• Access control — only authorized persons have access to data
• Regular backups — data is archived regularly
• Security monitoring — continuous monitoring of threats and incidents
• Security audits — regular reviews and penetration tests

12. Changes to the Privacy Policy

1. The Controller reserves the right to change this Privacy Policy in the event of changes in the law, market practices or the scope of services provided.
2. Users will be notified of significant changes by email or via a message in the Panel.
3. The current version of the Privacy Policy is always available at https://cookiepilot.io/polityka-prywatnosci.

13. Contact

For matters related to the protection of personal data, you can contact us:

• Email: kontakt@cookiepilot.io
• Postal address: Józefa Ignacego Kraszewskiego 1 / 16, 16-001 Kleosin, Polska
• Contact form: https://cookiepilot.io/en/contact

We make every effort to respond to inquiries regarding personal data within 30 days of receiving the request.