What we collect, why, for how long, who helps us, and your rights. Short version: we collect little, we sell nothing, and the plugin never sends us anything about your visitors.
Last updated: 6 November 2026.
Who is responsible
Djase Amcou LC, 1021 E Lincolnway #8431, Cheyenne, WY 82001, United States, is the controller: responsible for the processing described here. Contact for anything about your data: info@djaseamcou.com.
Our representative in the European Economic Area
Because we are based outside the European Economic Area (the European Union, Iceland, Liechtenstein and Norway) and offer our services to people there, we have appointed a representative in Belgium (GDPR, article 27). It acts for the whole European Economic Area. You can contact them about anything related to your data.
| Name | Address | Contact | |
|---|---|---|---|
| EEA representative | Les Écrits du Web SRL | Rue des Écoles 55A1, 4600 Visé, Belgium | ben@lesecritsduweb.be |
No representative in Switzerland is required (Swiss FADP, art. 14).
What we collect, and why
| When | Data | Why | Legal basis | Kept |
|---|---|---|---|---|
| Browsing this site | Technical server logs kept by our host (IP address, page, date, browser). | Security and running the site. | Legitimate interest. | As long as our host keeps them for security, then deleted |
| Audience measurement | Pages seen, approximate location, device, through Google Analytics (Site Kit). | Understanding how the site is used. | Your consent, given in the banner. | 14 months |
| Free trial | E-mail, website domain, browser language, IP address, dates. | Sending your trial key; one trial per site and per address. | Pre-contractual steps; legitimate interest (preventing abuse). | 3 years after the trial (IP address: 12 months) |
| Free key for a non-commercial site | Personal e-mail, website address, your message, IP address, dates, our decision and its reason. | Reading your request, sending the key, renewing it; one key per person and per site. | Pre-contractual steps; legitimate interest (preventing abuse). | 3 years after the request (IP address: 12 months) |
| Customer account | E-mail, name, company, billing country, VAT number, payment provider customer number; Google account identifier if you link Google sign-in. | Selling, delivering and managing your keys. | Contract. | As long as you are a customer, then 3 years |
| Payments and invoices | Amounts, taxes, billing address, invoice history. Card details stay with Stripe. | Payment, invoicing, tax obligations. | Contract; legal obligation. | As long as tax law requires (up to 10 years) |
| Keys and sites | Key, domains where it is used, plugin version, IP address of the site’s server, dates of activation and checks. | Checking that a key is valid and used within its limits. | Contract. | As long as the key exists, then 3 years (IP address: 12 months) |
| Support | Your requests and our answers, in your account and by e-mail. | Answering you. Our support team reads them in its own internal tool. | Contract. | 2 years after your last key ends, then deleted |
| Checks of your live site (Cookie Rocks Pro) | The domains where your key is active. On a few of their public pages, visited as an ordinary visitor three days after activation and then from time to time: the names of the cookies set before consent and the addresses of the sites that set them, never their values. Nothing about your visitors. | Checking that every cookie waits for consent, writing to you through support with what to do, and updating Cookie Rocks quickly if it did not know a cookie. | Contract (Pro support). You can turn these visits off in your account, or by writing to support@cookierocks.com. | As long as the key is active |
| Reports of unknown cookies | The script address, site, plugin version, message and, if you give it, your e-mail. | Adding the cookie to the list. | Legitimate interest. | 2 years |
| E-mails we send | Address, subject, date. | Keys, receipts, renewals, support, sign-in links. Reminders before the end of a trial or a key: you can turn them off in one click in each reminder, or in your account. | Contract; legitimate interest for reminders. | As above |
What the plugin sends us
Cookie Rocks runs on your own site. No data about your visitors ever reaches us. Their choices and the register of proofs stay in your WordPress database.
On its own, the plugin contacts our servers only to read our public feeds (alerts, law fact sheets, the list of known cookies, updates) and, for Cookie Rocks Pro, to check your licence key: it sends the key, the domain of the site and the plugin version. We keep the domain and the plugin version with the key, with the dates of activation and of the last check, to manage the licence and to count sites by version. Reading the feeds sends only the plugin version, never the address of your site; we count these reads without keeping IP addresses.
If you turn on a copy of your proofs, it goes straight from your site to the storage you choose: Dropbox, a WebDAV server (such as Nextcloud or kDrive), a signed webhook or an e-mail address. It never passes through our servers. The passwords and tokens of these destinations are stored sealed on your site.
When you click Send to Cookie Rocks on an unknown script in the plugin, your site sends us that script’s address and your plugin version, so that we can identify the tool and add it to the catalogue. The address can contain a business name. We do not record your site’s address or your server’s IP address with the report, though our host’s access logs may hold that IP address for a short time. Legal basis: our legitimate interest in keeping the catalogue accurate. We delete a report 12 months after the last report for that script.
The Cookie Rocks app for Dropbox
Cookie Rocks Pro can send the register of proofs of your site to your own Dropbox, through the “Cookie Rocks” app.
- The app only has access to its own app folder in your Dropbox, Apps/Cookie Rocks. It cannot see the rest of your Dropbox. It writes the files there and lists that folder, to delete the packages older than your proof retention if you ask for it.
- You connect it from your own WordPress site, on the Proofs page of the plugin. The access token stays encrypted on your site: Cookie Rocks never receives it.
- The files are the register of your visitors’ cookie choices: a random identifier, the date, the choices made and the version of the banner texts, never an IP address or a name. They go from your site to your Dropbox without passing through the servers of Cookie Rocks. We never read or keep them.
- To show you which account is connected, the plugin reads its name or e-mail address and keeps it on your site only.
- You can revoke the access at any time, from the Proofs page of the plugin or from the settings of your Dropbox account.
- Dropbox acts as your processor, under its own terms. Cookie Rocks is not a party to that processing.
Who helps us (processors)
| Provider | Where | What for |
|---|---|---|
| Infomaniak Network SA | Switzerland | Hosting of the site and its database, e-mail sending. |
| Stripe | Ireland and United States | Payments, invoices, tax calculation. Stripe also acts on its own account for fraud prevention. |
| United States and others | Sign-in with Google if you choose it; audience measurement if you accept it; storage of our encrypted backups. | |
| Slack | United States | Internal alerts to our team. For a support request, the alert contains its subject and your message (never your e-mail address or a licence key), so that we can answer faster. |
When data leaves the European Economic Area or Switzerland, it goes to a country recognised as protecting it adequately (such as Switzerland, or the United States for companies under the EU-US Data Privacy Framework) or under the European Commission’s standard contractual clauses.
Backups
Our database is backed up every night and after each sale. Backups are encrypted before they leave the server; only we hold the key. They are kept 14 days on the server. Encrypted copies also go to our backup storage and backup mailbox: the copy of each day is replaced a month later, and one copy per month is kept for 12 months.
Your rights
You can ask to see, correct, delete or receive a copy of your data, object to a processing based on our legitimate interest, or withdraw a consent at any time (for audience measurement: the “Cookie settings” link at the bottom of every page). Write to info@djaseamcou.com; we answer within one month. Some data must be kept for tax reasons even if you ask us to delete it. You can also lodge a complaint with a data protection authority (the supervisory authority): in the European Economic Area (the European Union, Iceland, Liechtenstein and Norway), the one of your country (list of authorities); in the United Kingdom, the Information Commissioner’s Office (ico.org.uk); in California, the California Privacy Protection Agency (privacy.ca.gov).
Browser privacy signals
This site honours the Global Privacy Control (GPC) signal. When your browser sends it, we treat it as a request to opt out of the sale and sharing of your personal information and of targeted advertising, on this browser or device. To send it, turn on Global Privacy Control in your browser or in an extension that supports it (globalprivacycontrol.org). We do not respond to Do Not Track signals, because there is no common standard for them. We do not sell personal information. The legal basis of each use of your data is given in the table above.
Security
Keys are stored encrypted, connections use HTTPS, team accounts use strong authentication, and sign-in links work once, for a short time. No password is stored for customers.
Changes
We will update this page when our processing changes, with the date at the top. Important changes are announced by e-mail to customers.