OKConsent · version 73216e5a096abbeb
DRAFT – do not publish – pending legal review (TAS-793)
Draft of 2026-10-28 for TAS-792. English translation of ../de/datenschutzerklaerung.md. This privacy policy covers our own website and the service as a controller. It does not replace the texts customers generate for their websites (those come from the clause library
packages/legal). The website (TAS-791) is not built yet; what it uses in cookies, analytics and logs is open and marked with [placeholders]. Open questions: open-questions.md.
As of: [date]
Dipl.-Ing. Samir Alibabic – Online Marketing (sole proprietorship), Klugstraße 99, 80637 München, Germany Email: support@okconsent.com
We have not appointed a data protection officer.
This policy covers our websites okconsent.com and okconsent.de (including the documentation at okconsent.com/docs), the dashboard (app.okconsent.com) and the programming interfaces of the OKConsent service, as far as we process personal data as a controller.
For visitors to our customers' websites we process data on the customers' behalf (section 6). The respective customer is responsible for those websites.
[The website is not built yet. The following text describes the target state and must be checked against the actual server settings before publication.]
When you open our website, our server processes technically necessary data so that the page is delivered and runs securely: IP address, time, requested address, status code, amount of data transferred, browser identifier. [Whether and for how long the server keeps access logs with this data is to be decided: period [days]. The proxy keeps no address for the consent record path. Access log of the proxy for website, dashboard and API overall: [present / absent; define content and period, see open-questions.md].] The legal basis is Art. 6(1)(f) GDPR (operation and security of the website). Hosting: Hetzner (section 7).
Audience measurement. On our website we measure usage with Umami, audience measurement software that we run ourselves (instance: [address of the instance; the repository names analytics.samiralibabic.com, confirm]; server: [hosting provider and location]). Umami sets no cookies [confirm the instance's configuration]. It records page views, referrer address, browser, operating system, device type and approximate location. From the website ID, IP address, user agent and a salt that rotates monthly by default, Umami derives an anonymous session identifier; the IP address is processed in this calculation but not stored in the session record. Retention of the data: [define; Umami deletes nothing by itself]. The legal basis is Art. 6(1)(f) GDPR (audience measurement to improve the website); you may object under Art. 21 GDPR. [Whether § 25 TDDDG applies to this measurement and whether it needs consent is open, see open-questions.md.]
Holding page at launch. At launch okconsent.com and www show one page with a short description of OKConsent, the legal notice and this privacy notice. The website sets no other cookies [check at go-live]. The holding page has its own, shorter privacy notice (apps/holding-page): it sets no cookies, measures nothing (no Umami), loads nothing from third parties, and the server keeps no access log once the check of the proxy at the first deployment has confirmed that (docs/operations.md).
For registration and sign-in we process:
email_limit; the rows are deleted after their time window ends (at most 15 minutes and one hour respectively; the counters of the cancellation page are described in the section on Stripe and last up to a day).Purpose: performing and preparing the contract (sign-in, access to the account) and security. Legal basis: Art. 6(1)(b) and (f) GDPR.
Dashboard cookies. All are strictly necessary for operating the dashboard or serve a setting you asked for (§ 25(2) no. 2 TDDDG) [check the classification of the two convenience cookies]:
| Cookie | Purpose | Lifetime |
|---|---|---|
__Secure-better-auth.session_token |
sign-in (HttpOnly, Secure, SameSite=Lax) | session of 7 days; it renews once a day while you use the dashboard [confirm behaviour] |
locale |
chosen language (HttpOnly) | 1 year |
last-org |
last opened organization (HttpOnly) | 1 year |
Expired sessions are deleted daily.
When you invite members, we process their email address and the invitation (valid for 7 days). For each organization we keep an audit log recording who changed what and when (sign-in, members, API keys, publications, plan changes, exports). It contains user IDs and no IP addresses. Legal basis: Art. 6(1)(b) and (f) GDPR (traceability and security).
We process the data you create in the service (sites, configurations, scan results, details for legal texts, generated legal texts, approvals, API keys as a hash). Where this includes data of visitors to your websites, section 6 and the data processing agreement apply. Legal basis: Art. 6(1)(b) GDPR.
We send emails that serve to perform the contract (sign-in link, invitations, approval requests, alerts about deviations, notices about plan changes and downgrades). These are not advertising emails. Sending is through Scaleway Transactional Email (section 7). Legal basis: Art. 6(1)(b) GDPR.
For paid plans we use Stripe. You pay on Stripe's pages (Checkout) and manage payment methods and invoices in Stripe's customer portal. You cancel and withdraw through our own page without sign-in; there we process the details you give (identification of the contract, name, email address, optionally the name of your organization, type of declaration, for an extraordinary cancellation the wished end and the reason), the time of receipt and the result (end of the contract, refund) to handle your declaration, to confirm receipt to you by email (also a copy to the other owners of your organization, with the button "That wasn't me" with which an owner undoes a declaration that someone else made) and to prove it (Art. 6(1)(b) and (c) GDPR). To protect against abuse we count requests per network of your internet address (for IPv6 the /64 network) for up to an hour. A declaration that stays under that hourly limit and does not come from a signed-in owner we count in addition for up to a day (24 hours from the first declaration counted): per customer (an organization with a paid plan), or per email address if the details cannot be assigned to a single customer (no account, or an owner of several paid organizations that the details do not tell apart). The page then causes at most one email a day per customer and at most one a day per such address; a further declaration of the same day is only recorded, not mailed by itself and not carried out by itself, and neither is a declaration over the hourly limit; we then send the confirmation by hand (who sent it and when is kept with the declaration). The emails we cause ourselves, and the notices to the owners that a withdrawal was carried out or a declaration was undone (with name and the email address given, without a link), do not count toward these limits. Once a day on which something is open for us, we send ourselves an email listing the open declarations (kind, time of receipt, email address given, refund still open and its deadline), so that no refund misses the deadline of 14 days. The declaration of a signed-in owner is subject to none of these limits, the hourly one included, and is not counted; it is carried out at once and confirmed. To recognise a signed-in owner the public page reads the dashboard's session cookie when the browser sends it (it is not required, and nothing is stored for this). The counters hold only check values (hashes formed with a permanent secret key of ours; the one per customer from the customer's identifier), not the addresses; the link of the button contains the identifier of the declaration and a signature that we do not store; a counter is deleted once its time window has ended (the clean-up runs with the next counted request, at most once a minute); we treat these check values as personal data (legitimate interest, Art. 6(1)(f) GDPR) and do not store your internet address with the declaration. We keep the declaration as long as the contract and the statutory retention periods require [duration: open-questions.md, Q2]. Stripe processes your name, email address, billing address, payment details and whether you order as a consumer or a business. We store the link between your organization and the Stripe customer and subscription, the plan, and whether you are a consumer or a business. We do not see payment details (for example the card number). Legal bases: Art. 6(1)(b) GDPR (contract), Art. 6(1)(c) GDPR (tax and commercial law duties). For part of the processing (for example fraud prevention) Stripe is a controller in its own right; Stripe's privacy policy then applies in addition.
When you write to us, we process your message and your email address in order to reply. Legal basis: Art. 6(1)(b) and (f) GDPR. Email sent to support@okconsent.com is forwarded by the free email forwarding of Namecheap, Inc. (USA) to our Google Workspace mailbox ([Google entity under the Workspace contract; under Google's terms for customers in the EEA: Google Cloud EMEA Limited, Dublin – to be confirmed]; group company Google LLC, USA). Both process your email address and your message to deliver and store it; they are recipients within the meaning of Art. 13(1)(e) GDPR (section 7), and data may reach the USA in this way (section 8). [Draft: the forwarding and the mailbox apply until Samir's new email setup exists; recipients, basis of the transfer and a data processing agreement with Namecheap: legal review, open-questions.md.]
For security we limit requests and log operating events (request path without query, status code, duration); the logs contain no personal data. Unexpected errors may be reported to an error tracking service after email addresses, IP addresses, query values, credentials and answers have been removed. At launch this service is switched off; if we switch it on, we will name the provider here and in the list of subprocessors. Legal basis: Art. 6(1)(f) GDPR.
We back up the database daily, encrypted [confirm encryption], to storage at Scaleway in the EU. Deleted data stays in the backups for up to 35 days. Legal basis: Art. 6(1)(f) GDPR (availability and recovery).
To use the service we need your email address. For paid plans we need the details required for the invoice and payment. Without them we cannot perform the contract.
[We take no decisions based solely on automated processing that produce legal effects concerning you (Art. 22 GDPR). To check: the automatic move to the free plan after a finally failed payment, see open-questions.md.]
Our customers add a script from OKConsent to their websites. When you visit such a website:
| Recipient | Purpose | Seat |
|---|---|---|
| Hetzner Online GmbH | hosting of the servers | Germany (data centre Nuremberg) |
| Scaleway SAS | sending email (Transactional Email) and storage for backups | France |
| Bunny.net (BunnyWay d.o.o.) | content delivery network (script delivery) | Slovenia; served from Europe only |
| Umami instance (run by us) | audience measurement of the website | [hosting provider and location] |
| Stripe Payments Europe, Ltd. (group Stripe, Inc.) | payment processing, invoices, customer portal | Ireland; group USA |
| GitHub, Inc. (Microsoft) | optional sign-in | USA |
| Namecheap, Inc. | free email forwarding of email to support@okconsent.com | USA |
| [Google entity under the Workspace contract; under Google's terms for customers in the EEA: Google Cloud EMEA Limited, Dublin – to be confirmed] (Google Workspace; group Google LLC) | mailbox in which email to support@okconsent.com arrives and is stored | [Ireland, to be confirmed]; group USA |
| [Tax adviser, bookkeeping: if used] | tax duties | [seat] |
[Data processing agreements exist with Hetzner, Scaleway and Bunny.net, confirm.] Domain and DNS: Namecheap, Inc. (USA); no visitor data beyond resolvers' DNS queries is processed.
Processing takes place mostly in the EU. Stripe, GitHub, Namecheap (email forwarding) and Google (mailbox) belong to groups in the USA or are seated there. Where data is transferred there, it relies on the European Commission's adequacy decision on the EU-US Data Privacy Framework, as far as the provider is certified [check current status], and otherwise on standard contractual clauses (Art. 46 GDPR). You can obtain copies of the safeguards on request.
| Data | Period |
|---|---|
| Account (email, name), memberships | until the account is deleted (at launch by hand, on request by email to support@okconsent.com) |
| Sessions | 7 days, renewed on use; expired sessions are deleted daily |
| Audience measurement (Umami) | [define period] |
| Audit log | 1 year; entries older than a year are deleted daily |
| Invoices, receipts | 8 years (§ 147 AO, § 257 HGB) [check] |
| Email correspondence | until dealt with, then per statutory retention periods |
| Backups | 35 days |
| Website server access logs | [define period] |
You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). Where processing rests on your consent, you can withdraw it at any time with effect for the future.
Right to object (Art. 21 GDPR). You may at any time object, on grounds relating to your particular situation, to processing of your data that we base on Art. 6(1)(f) GDPR.
You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The competent one is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, Germany.
For access, erasure and all other requests write to support@okconsent.com.
We adapt this policy when the service or the law changes. The version currently published applies.