What we keep, and what we do not.
Last updated 20 September 2026. CookieRay is a HasThemes product. This page is about the hosted service, not your visitors’ sites.
Who this covers
People who scan a site on the landing page, create an account, or install the banner. It does not replace the privacy notice you owe your visitors — you remain the controller of that traffic.
What we store
Account name, email and password hash. Sites you add, scan results, cookie inventory, banner settings, team invites, and consent records for each of your sites. Visitor IP addresses are hashed with a salt; we do not keep the raw address. Card numbers are not stored — checkout is not connected yet.
How long
Consent records are kept for the retention on your plan (one year on Free and Starter, two on Agency and above) and then deleted. Close the account and we delete the tenant data we hold for it.
Who else sees it
Hosting, database and mail providers that run the product. We do not sell account or consent data. A data processing agreement is available on request.
Your rights
Ask for a copy, a correction, or deletion at [email protected].