Skip to content
CookieType

Privacy Policy

What CookieType collects from merchants and their storefront visitors, why, who processes it, and how long it is kept.

Last updated

Who we are

CookieType ("the App", "we", "us") is an independent cookie consent app for Shopify stores. This policy covers the App and this website, cookietype.com.

Our role

  • For merchants' own data — your account, settings and support conversations — we are the controller.
  • For your storefront visitors' consent records, you, the merchant, are the controller and we process them on your behalf. A data processing agreement is available on request from support@cookietype.com.

What we collect from merchants

Through Shopify. When you install the App, Shopify gives us your store's name, domain and contact email address, and the access you approve: your privacy settings (to keep Shopify's consent regions in step with yours and switch off Shopify's own banner), your themes (to place the banner and read your brand colours) and your legal policies (to pre-fill your privacy policy link). We do not access customer, order or product data.

From you, in the App. Your banner settings, regions, wording and translations; the IDs of tools you connect (such as a Google Analytics measurement ID or a Meta Pixel ID); notification settings, including any extra addresses you add to receive alerts; support requests, with any screenshots you attach; and, if your store is password-protected, the storefront password you give the cookie scanner so it can reach your store.

Error reports. When something fails, technical details about the error are recorded so we can fix it.

What we collect from storefront visitors

When a visitor makes a choice on your banner, we save a consent record: the date and time, the visitor's country and region, whether they were on mobile or desktop, what they chose for each category, how they chose (banner, preferences panel, reopen button or a Global Privacy Control signal), any Do not sell or share choice, their language, and a fingerprint of the banner settings they were shown.

Note: Consent records do not contain IP addresses or browser details, and are not linked to Shopify customer accounts. A visitor's IP address is used only at the moment of the request, by our edge provider, to work out their country and region; it is not stored.

Cookies

  • On your storefront, the banner sets one first-party cookie, _cb_consent, which remembers the visitor's choice for the period you set under Ask again after (6 or 12 months). It also caches the banner's settings in the browser's local storage; that copy contains no personal data. The banner itself sets no advertising or tracking cookies.
  • In the Shopify admin, the App relies on Shopify's own session handling and sets no tracking cookies.
  • On cookietype.com, we set no cookies and use no analytics.

Cookie scans

The cookie scanner opens your storefront in a browser, as a visitor would, and records the names, domains and categories of the cookies it finds. It does not collect data about your visitors.

This website's contact form

If you write to us through the contact form, we receive your name, email address, store address (if you give it), subject and message, delivered to our support inbox by email. We use them only to answer you.

How we use information

  • To provide the App: show the right banner to each visitor, record consent, run scans and keep Shopify's privacy settings in step.
  • To give you consent analytics and exports for your own store.
  • To answer support requests.
  • To send service emails, such as alerts when a privacy law that affects your regions changes. Optional emails, like the monthly summary, can be switched off under Settings.
  • To keep the App secure and reliable, and to fix errors.

We do not sell personal information, share it with advertisers or data brokers, or use visitors' consent records for anything other than providing the App to the merchant.

Sub-processors

We share information only with these providers, only as needed to run the App, each under contractual data-protection commitments:

  • Cloudflare — delivers banner settings from its edge network, determines visitors' country and region, stores consent records, and runs the browser the cookie scanner uses.
  • DigitalOcean — hosts our application servers and databases, including merchant settings and copies of consent records.
  • Resend — sends our emails: alerts, support replies and contact-form messages.
  • Sentry — error monitoring. Receives technical details when something fails.
  • Shopify — authentication, billing, app distribution and your store's privacy settings.

We may also disclose information when the law requires it — to answer a lawful request, or to protect our rights, our merchants or their visitors.

Security

All traffic between merchants, visitors and our servers is encrypted in transit (TLS), and our databases are hosted with providers that encrypt data at rest. Access is limited to the people who need it. Shopify's privacy webhooks are verified before we act on them. No system is perfectly secure, but we work to keep your data safe.

International transfers

Our sub-processors may process information outside your country, including in the United States. Cloudflare serves requests from the data centre nearest the visitor. Where required, we rely on adequacy decisions, Standard Contractual Clauses or equivalent safeguards.

How long we keep information

  • Consent records are kept for the period you choose under Settings, then deleted automatically each night.
  • Merchant data — settings, scans, support requests and consent records — is deleted when Shopify tells us your store's data must be erased, which Shopify does 48 hours after you uninstall the App.
  • Contact-form messages are kept only as long as needed to answer and follow up on them.

Your rights

In the EEA, the UK or Switzerland, you can ask to access, correct or delete your personal information, restrict or object to its processing, receive a copy in a portable format, and withdraw consent where we rely on it. You can also complain to your data protection authority. We process merchant information to provide the App you have installed, for our legitimate interest in running and improving it, and to meet legal obligations.

In California, you can ask to know, delete or correct the personal information we hold, and you will not be treated differently for doing so. We do not sell or share personal information for cross-context behavioural advertising.

Storefront visitors can change or withdraw consent at any time from the banner's reopen button or preferences link. For anything else about a store's consent records, contact that store — they control those records, and we help them respond.

To use any of these rights, email support@cookietype.com.

Children

The App is for Shopify merchants. We do not knowingly collect personal information from children under 13 (or under 16 in the EEA). If you believe a child has given us personal information, contact support@cookietype.com and we will delete it.

Changes to this policy

We update this policy when our practices, providers or legal obligations change. The date at the top shows the latest version, and we tell merchants about material changes by email or in the App.

Contact

Questions, requests or complaints: support@cookietype.com.