Privacy Policy

Who this covers

This policy covers alpineconsent.com, the AlpineConsent WordPress plugin, and the AlpineConsent Universal Script Tag embedded on a customer's own website. It does not cover a customer's own privacy policy, which they are responsible for publishing on their own site.

Our two roles — please read this first

AlpineConsent acts in two different capacities, and which one applies depends on whose data it is:

• Controller, for visitors to our own website (alpineconsent.com) and for our own customer/account relationship (sign-ups, support, billing).
• Processor, for the consent choices made by our customers' own website visitors through an AlpineConsent banner embedded on a customer's site. We process that data strictly on the customer's documented instructions — the customer remains the controller of it, and is the one responsible for their own site's own privacy notice to their visitors (Art. 13/14 GDPR). Our side of that relationship is governed by our Data Processing Agreement.

Data we collect directly from you

• Account data — email address and a hashed password if you sign up directly, or your name and email if you sign in with Google. We never see or store your Google password.
• Site and scan data — the domains you register, and the results of any scan you run (scripts and cookies found on a page, and for a deep scan, real browser cookie/script data for that page). A scan you run while signed out is stored without any account link.
• Contact form submissions — your name, email, and message, protected by Cloudflare Turnstile (a CAPTCHA alternative) to filter spam.
• Cookies — see our Cookie Policy for the full, real list. In short: a few strictly necessary cookies (keeping you signed in, remembering your own consent choice), and one marketing cookie — only ever set once you've actually granted marketing consent on this site yourself.

Data we process on behalf of our customers

If you run a website using the AlpineConsent widget or WordPress plugin, we act as a data processor for that website's own visitors' consent choices, not a controller of that data. Specifically: when a visitor makes a cookie consent choice, we may store that choice together with a hashed, never-raw version of their IP address, so the choice can be shown as evidence of consent later. These consent records are kept for 36 months by default (shorter or longer depending on the customer's plan), deleted automatically — see the Data Processing Agreement for the full terms.

If a customer enables Google Consent Mode v2, we send only the resulting consent signal (e.g. whether analytics/ad storage is granted) to Google on that customer's behalf and under their instructions — never a visitor's underlying personal data. What Google itself then does with that signal is governed by the customer's own relationship with Google, not by us.

Sub-processors — other services that see your data

• Email delivery (account and notification emails) is sent via Brevo.
• Server-side error monitoring uses Sentry — deliberately server-side only; we don't run a browser-based error tracker, since that would itself be a third-party script needing consent categorization on a cookie-consent product.
• Google, only if you choose to sign in with Google.
• Cloudflare Turnstile — the Contact form, the public Scanner, and blog post comments; see our Cookie Policy for the full list.
• Our own self-hosted infrastructure (servers located in the EU) for everything else — accounts, scans, site configuration.

How long we keep it

• Account data — kept until you delete your account.
• Scan reports — a signed-out (anonymous) one is kept to let its original link keep working, with no way to trace it back to a person.
• Consent-log entries processed for a customer's site — 36 months by default, deleted automatically (see the DPA).
• Backups — a rolling daily backup of the database is kept for about two weeks, stored off-site, encrypted in transit.
• Raw web server access logs (IP, timestamp, requested path, status code, user agent) — we don't yet enforce a fixed automatic deletion schedule for these specifically; we're honest about that gap rather than stating a number we don't actually enforce, and we're working on it.

How we keep it secure

• Encryption in transit (TLS) everywhere.
• Visitor IP addresses tied to a consent record are stored as a salted hash, never in raw form.
• Role-based access control in the admin panel — permissions are granted individually, by role.
• Two-factor authentication (TOTP) is available on every account and recommended, though not currently mandatory.
• Daily, encrypted, off-site backups of the database (see retention above).

We don't currently run a formal, scheduled penetration-testing program or maintain a written incident-response plan beyond our own internal security practices — stated plainly rather than implied otherwise.

Your rights

Under the GDPR, you can ask to access, correct, delete, or export your personal data, or object to how it's used, or withdraw a consent you've given at any time with effect for the future. Reach us through the contact page for any of these — we aim to respond within a month.

If you're a visitor to one of our customers' websites, the customer (not us) is the controller of your consent choice there — reach out to them first. We assist them on request as their processor.

You can also lodge a complaint with the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, Austria — www.dsb.gv.at.

Where your data is stored

Our infrastructure runs within the EU, consistent with the “EU-hosted” positioning described on our About page. Sub-processors listed above may process data outside the EU under their own respective safeguards (e.g. standard contractual clauses).

Changes to this policy

We'll update the “Last updated” date above whenever this page changes in a way that matters. Continued use of the service after a change means you accept the updated policy.

Contact

Questions about this policy or your data — use the contact page. See also our Legal Notice for who operates this service.