Privacy policy
What we collect, why, who we share it with and how long we keep it. We collect as little as we can.
Last updated 30 October 2026
Who we are
Cookie Copilot is run by Parachute Digital Solutions Limited, a company registered in Scotland (number SC449352) at 27 Woodside Place, Glasgow, G3 7QL. We’re the controller of the personal data described in this policy. Questions about it, or requests to use your rights, go to hello@cookiecopilot.com.
Two kinds of data
Our customers’ data. When you sign up and use Cookie Copilot, we collect details about you and your organisation. This policy covers that.
Our customers’ visitors’ choices. When someone visits a website that uses our banner, we record the choice they make on behalf of that website’s owner. The website owner is the controller and we’re their processor, under our data processing agreement. If you visited a website and want to ask about your choice, contact that website’s owner.
What we collect and why
| What | Why | Lawful basis |
|---|---|---|
| Your name, email address and password (stored only as a secure hash) | To create your account and let you sign in | Contract |
| Your organisation’s name and the websites you add | To set up and run your banners | Contract |
| Email addresses of people you invite | To send them an invitation to your account | Legitimate interests: letting you share access with your team |
| Billing details: your plan, subscription status, billing address and VAT number. Stripe holds your card details; we never see them. | To take payment and keep tax records | Contract, and legal obligation for tax records |
| Access to your Google Tag Manager, if you connect it | To install the banner in your container. The access lasts about an hour and is kept only in an encrypted cookie in your browser, not on our servers. | Contract |
| The public pages of websites you add | To check for trackers and other banners, and confirm ours is installed | Contract |
| Technical data such as IP addresses in our hosting provider’s logs | To keep the service secure and working | Legitimate interests: security |
Our rate limits use one-way hashes of IP and email addresses, so neither is stored. Our own website, cookiecopilot.com, sets no cookies and uses no analytics. See our cookie policy.
Emails we send
We send emails you need to use the service: confirming your address, invitations, password resets and billing receipts. We don’t send marketing emails unless you’ve asked for them, and every marketing email will let you unsubscribe.
Who we share data with
We don’t sell personal data. We use these companies to run the service, under contracts that require them to protect it:
| Company | What for | Where |
|---|---|---|
| Vercel Inc. | Hosting the website, dashboard and banner, and receiving consent records | United States company. The dashboard and consent recording run in London; requests pass through Vercel’s worldwide network. |
| Neon (a Databricks company) | Database that stores accounts, settings and consent records | London (Amazon Web Services, eu-west-2) |
| Resend | Sending account emails, such as confirmations, invitations and password resets | Ireland (Amazon Web Services, eu-west-1) |
| Stripe Payments UK Ltd | Taking payments and managing subscriptions | United Kingdom, with processing by Stripe group companies including in the United States |
| Only if you connect Google Tag Manager: to read and publish your container | Google’s own terms and privacy policy apply |
We may also share data if the law requires it, or to protect our rights or someone’s safety.
Transfers outside the UK
Some of these companies are based in, or process data in, the United States. Where that happens, the transfer is protected by the UK Extension to the EU-US Data Privacy Framework or by the UK’s International Data Transfer Addendum to standard contractual clauses.
How long we keep it
- Account and organisation details: while your account is open. When you close it, we delete them within 90 days.
- Billing and tax records: six years, as UK tax law requires.
- Sign-in sessions, invitations and email links: deleted automatically once they expire.
- Visitors’ consent records: 24 months from each choice, then deleted automatically.
Your rights
Under UK GDPR you can ask us to:
- give you a copy of the personal data we hold about you
- correct anything that’s wrong
- delete your data
- limit how we use it, or object to how we use it
- give you your data in a format you can take elsewhere
Email hello@cookiecopilot.com. We’ll reply within one month. If you’re unhappy with how we’ve handled your data, you can complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113.
Keeping data safe
Everything is sent over encrypted connections and stored in encrypted databases. Passwords are hashed. Visitors’ IP addresses are shortened before they’re stored. Only the people who need to can access customer data.
Changes to this policy
If we change this policy in a way that matters, we’ll tell customers by email before the change takes effect. The date at the top shows the latest version.