Privacy Policy

1.1. Customer Data (Service Users)

For the management of your account and the provision of the SaaS service, we collect:

• Identity information: First name, Last name, Company name, Intracommunity VAT number.
• Contact details: Professional email address, phone number, billing postal address.
• Financial data: Transaction and invoice history (credit card details are processed securely and directly by our certified payment provider Stripe PCI-DSS, without transiting through our servers).

1.2. End-User Visitor Data (Websites)

In order to provide auditable proof of consent while respecting visitor anonymity, our embed.js script records the following information:

• Cryptographic Proof of Consent: A digest (SHA-256 hash) combining the truncated IP address and the User-Agent of the visitor's browser. This process prevents direct re-identification of the person while guaranteeing the uniqueness of the proof before supervisory authorities (CNIL).
• Choice data: Accepted or refused cookie categories (essential, analytical, marketing, personalization).
• Time data: Precise timestamp (date and time) of the interaction with the banner.
• Session identifier: A unique encrypted randomly generated token by CookiesWork, stored locally in the browser for a duration of 180 days.

The data processing carried out by CookiesWork meets specific purposes and is based on clear legal bases:

• Performance of a contract: Creation of your account, provision of access to the admin console, subscription processing, and billing.
• Compliance with a legal obligation (for our customers): Recording and supplying legal proof of end-users' consent, in accordance with Article 7(1) of the GDPR.
• Legitimate interest: Fraud prevention, abuse detection, securing the CMP infrastructure, and anonymized usage statistics to improve the service.

Your personal data is strictly confidential and is not sold or shared with third parties for advertising purposes under any pretext. We only use trusted technical processors that comply with the GDPR:

• Cloud hosting: Google Cloud Services (France region) for database storage (MongoDB) and API processing.
• Payment processing: Stripe Inc. (USA/Europe) for credit card transactions.
• Transactional/Billing emails: Resend (France/Europe).

• Customer account data: Retained for the duration of the contractual relationship, then archived for a period of 3 years for statistics and support purposes. Accounting documents (invoices) are archived for 10 years in compliance with French Commercial Code obligations.
• Proof of consent (Consent Registry): Retained for a rolling period of 5 years from their registration. This period corresponds to the legal prescription period in the event of legal action or CNIL audits.

In accordance with the GDPR, you have the following rights regarding your personal data: right of access, rectification, erasure (right to be forgotten), restriction of processing, data portability, and opposition.

To exercise your rights, or for any questions related to this policy, you can contact our DPO (Data Protection Officer):

• By email: ...
• By post: CarSens – DPO, 144 avenue Charles de Gaulle, 92200 Neuilly-sur-Seine, France

If you believe, after contacting us, that your rights are not being respected, you may file a complaint directly with the National Commission on Informatics and Liberty (CNIL - cnil.fr).

CookiesWork uses cookies and similar technologies to run its platform, analyze traffic, and secure transactions. Here is the detailed list of trackers we may place on your terminal: