CookiLow separates a public website scan from account data, customer evidence and billing records. This notice explains each boundary and the choices available to you.
Last updated: 20 September 2026 · Version INT-2026-09-20The table connects the data, purpose, legal basis and retention criterion instead of hiding them in separate paragraphs.
Return the scan requested by the user
Steps requested before entering a contract
Processed for the scan and limited operational troubleshooting; a permanent workspace record is created only after account sign-up
Measure use, attribute sign-ups and improve the conversion path
Consent for optional analytics and advertising measurement
According to the configured first-party and Google Analytics retention periods; exact settings will be published before activation
Create and operate the customer workspace
Contract and steps requested before entering a contract
For the account term, then deleted or anonymised under the account closure schedule
Protect the service, investigate abuse and answer requests
Legitimate interests in service security; contract for support
Rotated under the operational security schedule; support records remain only while needed for the request and legal defence
Take payment, issue documents and meet accounting duties
Contract and legal obligation
For the period required by applicable Norwegian accounting and tax rules
Launch boundary: paid international accounts are not open yet. Before they open, CookiLow will publish the exact account deletion timetable, named subprocessors, processing locations and any international-transfer safeguards. The public scanner does not grant permission for unrelated marketing.
The international site is being prepared for Google Analytics 4, Google Tag Manager and first-party server events. These tools are not presented as active on the international route today. Before activation, the published implementation must pass a browser test confirming that Google analytics and advertising requests remain blocked until the relevant consent is granted.
Page path, referrer, campaign parameters, device/browser context and actions such as scan start, registration or plan selection.
Event ID, pseudonymous session ID, timestamp, event name and relevant transaction values can be recorded for reliability and deduplication.
Approved events may be forwarded through Google tags or server-side tagging only under the configured analytics and advertising consent signals.
For the CookiLow website, account, billing and service security, DIGITAL GROUP AS acts as controller. When a customer later uses CookiLow to store visitor consent evidence, that customer determines the purpose and CookiLow acts as processor under a data processing agreement.
Review the processing boundaryWe may need to verify identity before disclosing or changing account data. Exercising a right is free unless a request is manifestly unfounded or excessive under applicable law.
Email hello@cookilow.comAuthorised personnel and suppliers may access data only where needed for hosting, authentication, email, support, payments or security. The named subprocessor register, EEA processing locations and transfer safeguards must be published before paid accounts or customer consent-evidence storage are enabled.