DRAFT – do not publish – pending legal review (TAS-793)

Draft of 2026-10-28 for TAS-792. English translation of ../de/datenschutzerklaerung.md. This privacy policy covers our own website and the service as a controller. It does not replace the texts customers generate for their websites (those come from the clause library packages/legal). The website (TAS-791) is not built yet; what it uses in cookies, analytics and logs is open and marked with [placeholders]. Open questions: open-questions.md.

Privacy policy

As of: [date]

1. Controller

Dipl.-Ing. Samir Alibabic – Online Marketing (sole proprietorship), Klugstraße 99, 80637 München, Germany Email: support@okconsent.com

We have not appointed a data protection officer.

2. What this policy covers

This policy covers our websites okconsent.com and okconsent.de (including the documentation at okconsent.com/docs), the dashboard (app.okconsent.com) and the programming interfaces of the OKConsent service, as far as we process personal data as a controller.

For visitors to our customers' websites we process data on the customers' behalf (section 6). The respective customer is responsible for those websites.

3. Data, purposes, legal bases

3.1 Visiting our website

[The website is not built yet. The following text describes the target state and must be checked against the actual server settings before publication.]

When you open our website, our server processes technically necessary data so that the page is delivered and runs securely: IP address, time, requested address, status code, amount of data transferred, browser identifier. [Whether and for how long the server keeps access logs with this data is to be decided: period [days]. The proxy keeps no address for the consent record path. Access log of the proxy for website, dashboard and API overall: [present / absent; define content and period, see open-questions.md].] The legal basis is Art. 6(1)(f) GDPR (operation and security of the website). Hosting: Hetzner (section 7).

Audience measurement. On our website we measure usage with Umami, audience measurement software that we run ourselves (instance: [address of the instance; the repository names analytics.samiralibabic.com, confirm]; server: [hosting provider and location]). Umami sets no cookies [confirm the instance's configuration]. It records page views, referrer address, browser, operating system, device type and approximate location. From the website ID, IP address, user agent and a salt that rotates monthly by default, Umami derives an anonymous session identifier; the IP address is processed in this calculation but not stored in the session record. Retention of the data: [define; Umami deletes nothing by itself]. The legal basis is Art. 6(1)(f) GDPR (audience measurement to improve the website); you may object under Art. 21 GDPR. [Whether § 25 TDDDG applies to this measurement and whether it needs consent is open, see open-questions.md.]

Holding page at launch. At launch okconsent.com and www show one page with a short description of OKConsent, the legal notice and this privacy notice. The website sets no other cookies [check at go-live]. The holding page has its own, shorter privacy notice (apps/holding-page): it sets no cookies, measures nothing (no Umami), loads nothing from third parties, and the server keeps no access log once the check of the proxy at the first deployment has confirmed that (docs/operations.md).

3.2 Account and sign-in

For registration and sign-in we process:

• email address, display name, whether the address is verified;
• when signing in with GitHub: the address of the profile picture, the account ID at GitHub and the permission granted. GitHub's access and refresh tokens are not stored; we use them once to read the profile;
• per sign-in a session (token, expiry, active organization). Sessions contain no IP address and no user agent;
• counters for abuse prevention: the limit on sign-in attempts per IP address (Better Auth) lives in memory only. In addition we count sign-in links per recipient (as an HMAC of the email address, not the address itself) and invitations per sender (user ID) in the database table email_limit; the rows are deleted after their time window ends (at most 15 minutes and one hour respectively; the counters of the cancellation page are described in the section on Stripe and last up to a day).

Purpose: performing and preparing the contract (sign-in, access to the account) and security. Legal basis: Art. 6(1)(b) and (f) GDPR.

Dashboard cookies. All are strictly necessary for operating the dashboard or serve a setting you asked for (§ 25(2) no. 2 TDDDG) [check the classification of the two convenience cookies]:

Expired sessions are deleted daily.

3.3 Organizations, members, invitations, log

When you invite members, we process their email address and the invitation (valid for 7 days). For each organization we keep an audit log recording who changed what and when (sign-in, members, API keys, publications, plan changes, exports). It contains user IDs and no IP addresses. Legal basis: Art. 6(1)(b) and (f) GDPR (traceability and security).

3.4 Use of the service

We process the data you create in the service (sites, configurations, scan results, details for legal texts, generated legal texts, approvals, API keys as a hash). Where this includes data of visitors to your websites, section 6 and the data processing agreement apply. Legal basis: Art. 6(1)(b) GDPR.

3.5 Emails

We send emails that serve to perform the contract (sign-in link, invitations, approval requests, alerts about deviations, notices about plan changes and downgrades). These are not advertising emails. Sending is through Scaleway Transactional Email (section 7). Legal basis: Art. 6(1)(b) GDPR.

3.6 Payment and billing

For paid plans we use Stripe. You pay on Stripe's pages (Checkout) and manage payment methods and invoices in Stripe's customer portal. You cancel and withdraw through our own page without sign-in; there we process the details you give (identification of the contract, name, email address, optionally the name of your organization, type of declaration, for an extraordinary cancellation the wished end and the reason), the time of receipt and the result (end of the contract, refund) to handle your declaration, to confirm receipt to you by email (also a copy to the other owners of your organization, with the button "That wasn't me" with which an owner undoes a declaration that someone else made) and to prove it (Art. 6(1)(b) and (c) GDPR). To protect against abuse we count requests per network of your internet address (for IPv6 the /64 network) for up to an hour. A declaration that stays under that hourly limit and does not come from a signed-in owner we count in addition for up to a day (24 hours from the first declaration counted): per customer (an organization with a paid plan), or per email address if the details cannot be assigned to a single customer (no account, or an owner of several paid organizations that the details do not tell apart). The page then causes at most one email a day per customer and at most one a day per such address; a further declaration of the same day is only recorded, not mailed by itself and not carried out by itself, and neither is a declaration over the hourly limit; we then send the confirmation by hand (who sent it and when is kept with the declaration). The emails we cause ourselves, and the notices to the owners that a withdrawal was carried out or a declaration was undone (with name and the email address given, without a link), do not count toward these limits. Once a day on which something is open for us, we send ourselves an email listing the open declarations (kind, time of receipt, email address given, refund still open and its deadline), so that no refund misses the deadline of 14 days. The declaration of a signed-in owner is subject to none of these limits, the hourly one included, and is not counted; it is carried out at once and confirmed. To recognise a signed-in owner the public page reads the dashboard's session cookie when the browser sends it (it is not required, and nothing is stored for this). The counters hold only check values (hashes formed with a permanent secret key of ours; the one per customer from the customer's identifier), not the addresses; the link of the button contains the identifier of the declaration and a signature that we do not store; a counter is deleted once its time window has ended (the clean-up runs with the next counted request, at most once a minute); we treat these check values as personal data (legitimate interest, Art. 6(1)(f) GDPR) and do not store your internet address with the declaration. We keep the declaration as long as the contract and the statutory retention periods require [duration: open-questions.md, Q2]. Stripe processes your name, email address, billing address, payment details and whether you order as a consumer or a business. We store the link between your organization and the Stripe customer and subscription, the plan, and whether you are a consumer or a business. We do not see payment details (for example the card number). Legal bases: Art. 6(1)(b) GDPR (contract), Art. 6(1)(c) GDPR (tax and commercial law duties). For part of the processing (for example fraud prevention) Stripe is a controller in its own right; Stripe's privacy policy then applies in addition.

3.7 Contact

When you write to us, we process your message and your email address in order to reply. Legal basis: Art. 6(1)(b) and (f) GDPR. Email sent to support@okconsent.com is forwarded by the free email forwarding of Namecheap, Inc. (USA) to our Google Workspace mailbox ([Google entity under the Workspace contract; under Google's terms for customers in the EEA: Google Cloud EMEA Limited, Dublin – to be confirmed]; group company Google LLC, USA). Both process your email address and your message to deliver and store it; they are recipients within the meaning of Art. 13(1)(e) GDPR (section 7), and data may reach the USA in this way (section 8). [Draft: the forwarding and the mailbox apply until Samir's new email setup exists; recipients, basis of the transfer and a data processing agreement with Namecheap: legal review, open-questions.md.]

3.8 Security and error tracking

For security we limit requests and log operating events (request path without query, status code, duration); the logs contain no personal data. Unexpected errors may be reported to an error tracking service after email addresses, IP addresses, query values, credentials and answers have been removed. At launch this service is switched off; if we switch it on, we will name the provider here and in the list of subprocessors. Legal basis: Art. 6(1)(f) GDPR.

3.9 Backups

We back up the database daily, encrypted [confirm encryption], to storage at Scaleway in the EU. Deleted data stays in the backups for up to 35 days. Legal basis: Art. 6(1)(f) GDPR (availability and recovery).

4. Obligation to provide data

To use the service we need your email address. For paid plans we need the details required for the invoice and payment. Without them we cannot perform the contract.

5. Automated decisions

[We take no decisions based solely on automated processing that produce legal effects concerning you (Art. 22 GDPR). To check: the automatic move to the free plan after a finally failed payment, see open-questions.md.]

6. Visitors to our customers' websites

Our customers add a script from OKConsent to their websites. When you visit such a website:

• Your browser loads the script through a content delivery network (Bunny.net), which serves from Europe only. The network and, where applicable, our servers see your IP address and usual request data; the network logs accesses with anonymised IP addresses and keeps the logs for as short a time as possible. Our delivery service sets no cookies and logs nothing.
• If the website operator has switched on consent records, your browser sends with your decision a random ID, your choices, the time, language and path of the page to our server. We store no IP address, no user agent and no full URL.
• We process this data on behalf of the website operator. You exercise your rights (access, deletion) towards them; their privacy policy names the controllers.

7. Recipients

[Data processing agreements exist with Hetzner, Scaleway and Bunny.net, confirm.] Domain and DNS: Namecheap, Inc. (USA); no visitor data beyond resolvers' DNS queries is processed.

8. Transfers to third countries

Processing takes place mostly in the EU. Stripe, GitHub, Namecheap (email forwarding) and Google (mailbox) belong to groups in the USA or are seated there. Where data is transferred there, it relies on the European Commission's adequacy decision on the EU-US Data Privacy Framework, as far as the provider is certified [check current status], and otherwise on standard contractual clauses (Art. 46 GDPR). You can obtain copies of the safeguards on request.

9. Retention

10. Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). Where processing rests on your consent, you can withdraw it at any time with effect for the future.

Right to object (Art. 21 GDPR). You may at any time object, on grounds relating to your particular situation, to processing of your data that we base on Art. 6(1)(f) GDPR.

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The competent one is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, Germany.

For access, erasure and all other requests write to support@okconsent.com.

11. Changes

We adapt this policy when the service or the law changes. The version currently published applies.