Privacy policy

Last updated: 9 November 2026

Your privacy matters to us. This policy explains which personal data we process when you use cookiedoo.net, the CookieDoo guide and the CookieDoo service, why, for how long, and what rights you have.

1. Who is responsible

The controller under the General Data Protection Regulation (GDPR) is:

2ΠΙΞ Ο.Ε. (2pix General Partnership)
Ekavis 6, 175 64 Palaio Faliro, Athens, Greece
VAT number: EL801872902
General Commercial Registry (G.E.MI.) number: 164948803000
Phone: +30 210 220 1921
E-mail: [email protected]
Website: www.2pix.eu

For anything about your personal data, write to [email protected]. For help with the service, write to [email protected].

2. Our two roles

• Controller for our own websites, for the accounts of our customers and their team members, for billing and for support.
• Processor for the consent records of the visitors of our customers' websites. The website owner decides what the banner asks and is the controller of those records; we process them only on the owner's instructions, under a data processing agreement. If you visited a website that uses CookieDoo, contact that website's owner first; we will help them answer you.

3. Our websites (cookiedoo.net and docs.cookiedoo.net)

Our websites are delivered through Cloudflare. To deliver pages and protect them from attacks, the request data of your browser is processed: IP address, date and time, the page requested, the referring page, and browser and operating system. Legal basis: our legitimate interest in running secure websites (Art. 6(1)(f) GDPR). These data are kept only briefly, normally no longer than 7 days, unless needed to investigate an attack.

Our websites do not use analytics or advertising and load no fonts or scripts from third parties. The only cookies are those of our own CookieDoo banner, which records your choice (see section 6).

4. Customer accounts

When you create an account at app.cookiedoo.net we process your e-mail address, your password (stored only as a secure hash), the accounts you belong to and your role, the domains you add and the banner settings you choose. When you invite a colleague, we process their e-mail address to send the invitation, which expires after 7 days.

We send you e-mails needed for the service: confirmation of your address, invitations, password resets and reports about your website's cookie scans.

The portal uses one necessary cookie (cookiedoo.auth, 14 days) to keep you signed in. Your language and theme choices are kept only in your browser's local storage.

Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).

5. Website scans

The CookieDoo scanner visits the websites our customers add, like a first-time visitor, and records which cookies and browser storage entries the pages create, on which page, and whether before or after consent. It does not enter forms or log in, and it does not collect personal data of the website's visitors. The results are shown to the customer and used to keep their cookie declaration current. Cookie names that the scanner finds and that are not yet in our cookie database are reviewed by our team, so that the database improves for all customers. To speed this up, the cookie name, the domain that sets it and the host names of the websites where it was found may be sent to an AI service (Anthropic) for a suggestion that our team checks; page addresses and visitor data are never sent.

6. The CookieDoo banner on our customers' websites

When a visitor makes a choice in a CookieDoo banner, we store, on behalf of the website owner, as proof of consent:

• a random Consent ID, the date and time, the choice and the categories allowed, and the version of the banner shown;
• the IP address in anonymised form (the last part of an IPv4 address is set to 0; of an IPv6 address only the first 48 bits are kept);
• a one-way hash of the browser's user agent, not the user agent itself;
• a random visitor key, which links later choices of the same browser.

To remember the choice, the banner stores these items in the visitor's browser: the cookies CookieDooUserId, CookieDooOptionId, CookieDooCategoriesId, CookieDooConsentKey and CookieDooConsent (up to 12 months), the list of blocked cookies in local storage, and, only for the current session, the visitor's region and whether a check for new cookies has run.

For banners that apply different rules by country, the visitor's country is looked up from the IP address through Cloudflare when the banner loads; it is not stored. On a small share of page views, the banner sends the names (never the values) of cookies that the website's declaration does not list, so that the site is scanned again; these names are not stored.

For visitors in the United States, the banner passes their choices to advertising tags through the IAB Global Privacy Platform and honours the Global Privacy Control signal of the browser.

7. Payments

Payments are handled by Stripe. We never see or store card numbers. To invoice and to meet tax obligations we keep the name, e-mail, country, address and tax IDs of the paying customer, the amounts and the invoice references. Legal basis: performance of the contract and our legal obligations (Art. 6(1)(b) and (c) GDPR).

8. Contacting us

If you write to us by e-mail, we process your message and your contact details to answer you. Legal basis: our legitimate interest in answering your request, or steps before a contract at your request (Art. 6(1)(f) and (b) GDPR). We delete the conversation when it is clear that the matter has been fully dealt with, unless it relates to a contract or a legal claim.

9. Service providers and transfers

We use these providers, each bound by a data processing agreement:

• Oracle Cloud Infrastructure: hosting of the service and the database, in a data centre in the European Union;
• Cloudflare: content delivery, DNS, protection against attacks, and storage of our encrypted backups;
• Stripe: payments, invoices and tax calculation;
• Brevo (Sendinblue SAS, France): delivery of our service e-mails;
• Anthropic: suggestions for classifying unknown cookie names (section 5); no personal data is sent.

Cloudflare and Stripe are based in the United States and may process data there. Such transfers rely on the EU–US Data Privacy Framework and/or the European Commission's standard contractual clauses. We do not sell or share personal data for advertising.

10. How long we keep data

• Account data: while the account exists. The account's owner can close it in the portal (Team → Close account); its banners stop at once, and its data is erased automatically within 30 days, except billing records.
• Billing records: for as long as Greek tax law requires, currently five full fiscal years after the year of the invoice.
• Configuration and scan results: while the account exists; deleted when it is closed.
• Consent records (on behalf of our customers): while the customer's account exists, so that the customer can prove consent. When a customer closes their account, they are erased automatically within 30 days; on the customer's request we erase them sooner. Customers can export them as CSV at any time before.
• Website request data: normally up to 7 days (section 3).
• Backups: encrypted, kept for 30 days and then overwritten.

11. Security

All connections are encrypted (HTTPS). Passwords are stored only as secure hashes, consent records contain no full IP addresses, backups are encrypted, and access to the systems is limited to the people who run the service. If an incident affects personal data, we act as the GDPR requires, including informing customers and the authority where needed.

12. Your rights

You have the right to access your data (Art. 15 GDPR), to have it corrected (Art. 16), erased (Art. 17) or its processing restricted (Art. 18), to receive it in a portable format (Art. 20), to object to processing based on legitimate interest (Art. 21), and to withdraw a consent at any time without affecting earlier processing (Art. 7(3)). Write to [email protected]; we may ask you to confirm your identity.

You also have the right to lodge a complaint with the Hellenic Data Protection Authority, Kifisias 1-3, 115 23 Athens, www.dpa.gr.

We do not make decisions based solely on automated processing that have legal or similarly significant effects on you.

13. Children

CookieDoo is a service for businesses and is not directed at children. We do not knowingly collect personal data of children. If you believe a child has given us personal data, write to [email protected] and we will delete it.

14. Changes

We may update this policy when our service or the law changes. The date at the top shows the latest version; for important changes we will inform our customers by e-mail.