Privacy Policy

Who we are

Cookie Gate is operated by Comply Ark Technical ("Comply Ark", "we", "us"), an India-based company building consent-management infrastructure. This policy covers the cookiegate.io website and the Cookie Gate platform (app.cookiegate.io and related services).

We wear two hats, and this policy is honest about both:

• For your account and our own website, we decide how data is used — we act as the data fiduciary / controller.
• For consent records collected on our customers' websites, the customer decides; we process those records on their instructions as a processor.

What we collect

Account data. Name, work email, organisation details, and authentication data when you create a workspace. If you sign in with Google, we receive your name and email from Google.

Billing data. Payments are processed by Razorpay. We store your plan, invoices and payment status — we never store full card numbers.

Service data. Logs and usage needed to run and secure the platform: sign-in events, configuration changes (kept in a tamper-evident audit log), and support conversations.

On behalf of our customers. When a visitor interacts with a Cookie Gate banner on a customer's site, we record the consent decision as a receipt: a pseudonymous visitor identifier, the choice made, a country/region-level location, the regulation applied, and a timestamp. Visitors filing data-protection requests provide an email address, verified by one-time code.

What we do not do

• We do not sell personal data.
• We do not run third-party advertising trackers on cookiegate.io.
• Our web fonts are self-hosted — no font requests leave for third parties.

Why we process data

To provide the service under our contract with you; to meet legal obligations (tax, accounting); for legitimate interests like fraud prevention and service security; and, where required, with your consent. Consent records processed for customers exist precisely so that they can demonstrate compliance — that processing is governed by our agreement with the customer.

Retention

Account data lives as long as your workspace does, then for the period required by law. Consent receipts and audit logs are retained according to the customer's configured retention policy; their tamper-evident chaining means we preserve integrity for exactly as long as they are kept.

Security

Data is encrypted in transit; consent receipts are hash-chained and HMAC-signed so alteration is detectable; access is role-based and audit-logged. No system is perfectly secure, and we will notify affected parties of incidents as the law requires.

Sharing and subprocessors

We share data only with providers needed to run the service: cloud infrastructure (Google Cloud Platform), payment processing (Razorpay), and transactional email delivery. Subprocessors are bound by data-processing terms. We disclose data to authorities only where legally compelled.

International transfers

Our infrastructure is hosted in cloud regions selected for the service; where personal data crosses borders we rely on appropriate safeguards under applicable law.

Your rights

Depending on your jurisdiction, you may have rights to access, correct, delete, or port your data, to object to or restrict processing, and to withdraw consent. Write to hello@cookiegate.io and we will respond within the statutory period that applies to you. If a Cookie Gate banner collected your consent on someone else's website, the fastest path is that website's operator — but we will help route your request either way.

Grievances (India)

Consistent with the DPDPA, grievances can be raised at hello@cookiegate.io; we acknowledge and address them within the timelines the law prescribes.

Children

The service is for businesses and is not directed at children.

Changes

We will post changes here and update the date above; material changes are announced to account holders by email.

Contact

Comply Ark Technical · hello@cookiegate.io