Privacy Policy

1. Summary

2. Who is responsible

Webkonsulenterne A/S ("we", "our", "us") is a Danish company registered under CVR 45330710, with its registered office at Hadsundvej 112, 9550 Mariager, Denmark. We operate Cookiely and are the data controller for account, billing, support and website data.

For consent records and data-subject requests relating to your website visitors, you remain the data controller and we act as your data processor under Article 28 GDPR. Our customer-facing Data Processing Agreement describes that relationship.

Privacy questions and rights requests go to our privacy contact at [email protected].

3. What data we collect

3.1 Account data

When you create an account we collect your name, email address and password, which is stored only as a secure hash. We also process sign-in and security information needed to protect your account and provide the service.

3.2 Usage and analytics data

We collect aggregated data about dashboard page views and feature usage using our own analytics. No third-party analytics cookies are set on the dashboard.

3.3 Consent records processed for customers

When visitors to your website interact with the Cookiely consent banner, limited consent evidence may be transmitted to our servers: an anonymised IP address with the last octet zeroed, a pseudonymous browser fingerprint hash, timestamp, policy version and consent choices. We process this data as your Data Processor; you remain the Data Controller for your visitors' data.

3.4 Billing data

Payments are handled by the payment provider shown at checkout. We do not receive or store full card numbers. We retain subscription, invoice and transaction records required to operate your subscription and meet our legal accounting obligations.

3.5 Optional scan notifications

Shopify merchants may provide a notification email address to receive material storefront scan-change alerts. Providing it is optional. It is used only for the requested operational alerts, is never exposed to storefront visitors, and is deleted when alerts are disabled or the Shopify site is deleted.

3.6 Shopify app data

When a merchant installs the Shopify app, we receive the shop's permanent myshopify.com domain, Shopify Shop ID, installed scopes, and encrypted app access and refresh tokens. We use these only to authenticate the installation, provide the signed storefront app proxy, synchronize the app's Shopify-hosted plan, and operate Cookiely. We request write_app_proxy and do not request Shopify customer, order, address, email, phone, or payment scopes.

Shopify storefront consent evidence contains a randomly generated pseudonymous visitor hash, the visitor's consent choices, policy version, Global Privacy Control status, and the Shopify Customer Privacy state applied for the visitor. It does not contain a Shopify customer ID, name, email, raw IP address, raw user agent, or browsing history.

3.7 Shopify storefront scans

At a merchant's request or on a configured schedule, isolated anonymous browser workers inspect representative public storefront routes for cookie names and metadata, storage-key names, minimized resource evidence, and security-header change digests. We do not retain query strings, cookie or storage values, raw security-header values, page content, screenshots, dynamic URL path segments, or Set-Cookie values.

4. Why we process data

• Contract performance (Art. 6(1)(b) GDPR) — to create your account, operate your subscription and deliver the service you requested.
• Legitimate interests (Art. 6(1)(f) GDPR) — to secure the service, prevent fraud, diagnose faults and improve reliability.
• Legal obligation (Art. 6(1)(c) GDPR) — to retain invoices and other records required by Danish law.
• Consent (Art. 6(1)(a) GDPR) — for optional marketing communications, where offered.

For consent evidence and DSAR data that we process on your behalf, our legal basis follows your documented instructions as controller.

5. How long we keep data

6. Your rights

Under the GDPR you may ask us to access, correct or delete your personal data; restrict or object to processing; and provide a portable copy. Where processing is based on consent, you may withdraw it at any time. We may ask you to confirm your identity before completing a request.

Write to [email protected]. We respond within one month; where a request is complex, the GDPR permits an extension and we will explain it to you.

You may also complain to a supervisory authority. In Denmark, that is Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby.

7. Recipients and international transfers

Our current service providers, their purposes and processing locations are listed on our Sub-processors page. We do not sell personal data or share it with advertisers or data brokers.

Where personal data is processed outside the EU/EEA, we rely on an applicable adequacy decision, the European Commission's Standard Contractual Clauses with appropriate safeguards, or another lawful transfer mechanism.

8. Cookies

The public website and legal pages do not use analytics or advertising cookies. Signing in sets strictly necessary session and cross-site request forgery protection cookies. If you choose “remember me”, an additional necessary cookie keeps the session available on that device. Deleting these cookies signs you out.

9. Security

We use access controls, encryption in transit, encryption of stored secrets, password hashing, signed consent evidence, verified payment webhooks and administrative audit logs. No internet service is risk-free, but we review and improve these measures as the service changes.

10. Changes to this policy

We update this policy when the service or legal requirements change. Material changes are announced to account holders before they take effect. Every version states its effective date at the top, and the previous version is available on request.

11. Company details