Privacy Policy

Effective date: 31 October 2026

This Privacy Policy explains how Vishnuraam S, sole proprietor trading as HextonHQ and TrustCookies ("TrustCookies", "we", "us") collects and uses personal data when you visit trustcookies.com, use our free website scanner, create or use a TrustCookies account, buy a plan, or contact us. It also explains our more limited role for consent records that our customers collect on their own websites.

1. Who we are and how to contact us

Vishnuraam S, reachable at the privacy contact above, is the person who can answer your questions about our processing of your personal data under India's Digital Personal Data Protection Act, 2023 ("DPDP Act").

2. Two different roles — please read this first

2.1 Where we are the controller. We decide why and how your personal data is used when you visit our website, use our free scanner, hold an account, pay us, receive communications from us or contact us. This Privacy Policy covers that processing. In India's DPDP Act terms, we are the Data Fiduciary for it.

2.2 Where we are a processor. Our customers install TrustCookies on their own websites to show a consent banner and record visitors' choices. For those consent records, the website operator is the controller (Data Fiduciary) and we process the records only on its instructions, as its processor (Data Processor), under our Data Processing Agreement. The website operator decides which cookies and other technologies run on its website, how they are categorised and what its banner says, and is responsible for installing and checking TrustCookies on its website. That processing is governed by the website operator's own privacy notice, not by this policy. This applies wherever the visitor is, including visitors from the European Economic Area, the United Kingdom and Switzerland: for them too we act solely as the website operator's processor, have no direct relationship with them, process only the minimised data described below, and never use their data — or any customer's consent records or scan results — for our own advertising, profiling or any other purpose of our own.

If you visited a website that uses TrustCookies and want to access, correct or delete your consent record, or withdraw consent, please contact the operator of that website, or use the cookie settings link on that website. We will help the operator respond, but we cannot act on your request directly: by design, a consent record contains no name, email address, account identifier or IP address, so we cannot find your record without information that only you (in your browser) or the website operator holds. In summary, a consent record contains a pseudonymous identifier derived from a random value stored in your browser, your choices by category, the time, your country and first-level region (worked out from your IP address at the moment of the request, without storing the address), and technical details of the banner version shown. Because the identifier can be linked back to your browser, a consent record is pseudonymised personal data, not anonymous data. Consent records are stored in the European Union.

2.3 Where we offer our services. Our services are not offered to individuals or organisations in the European Economic Area (the European Union, Norway, Iceland and Liechtenstein), the United Kingdom or Switzerland. People there may read our website, but may not use the free scanner, create an account or buy a plan, and we do not direct marketing at them. We do not direct our services at people in those countries. Our website runs analytics only for visitors who consent to them on our cookie banner (section 11). Section 2.2 is different: our customers outside those countries may use TrustCookies on websites visited by people in those countries, and for those visitors we act only as the customer's processor.

3. What we collect, why, and on what basis

The tables below list the personal data we collect in each situation, the purpose, and our legal basis under India's DPDP Act and, where those laws apply, under the EU and UK GDPR. Where we rely on legitimate interests under the GDPR, the interest is stated in the purpose column. Where we rely on consent, you can withdraw it at any time (section 9).

3.1 Visitors to our website (trustcookies.com)

We do not set or read non-essential cookies on our website before you consent (section 11).

3.2 Users of the free website scanner

The free scanner is not offered to people in the European Economic Area, the United Kingdom or Switzerland (section 2.3), and does not ask for your name or email address. The scanner visits the public pages of the website you enter; if those pages contain personal data (for example, a contact email address published on the page), the scanner may encounter it while loading the page. We do not use it for any purpose other than producing the scan result, except as described in section 3.7.

3.3 Account holders and team members

3.4 Billing and payments

We do not receive or store full card numbers or card security codes. Payments are processed by our payment providers, who act as independent controllers for some of this data under their own privacy notices and the rules of card networks, banks and the Reserve Bank of India.

3.5 When you contact us

Please do not send us passwords, authentication codes or card details by email.

3.6 Service and marketing communications

You can unsubscribe from marketing emails at any time using the link in each email. Service notices cannot be switched off while you hold an account, because they are needed to run it.

3.7 Website operators we contact about scan findings

We may scan publicly reachable websites and, where our scan observes cookies or trackers that appear to run before consent, contact the business that operates the website to tell it what we observed. For this purpose we process the website's address, the scan findings, and business contact details published on that website (such as a contact email address), and keep a record of our contact and of any request not to be contacted again.

Every such message tells you how to object. If you object, we will stop contacting you and keep only the minimum information needed to make sure we do not contact you again. You may object at any time by writing to support@trustcookies.com with the subject line "Do not contact".

3.8 Advertising to visitors of our own website (retargeting)

What we may do. No advertising tags are in use on our website at the effective date of this policy. If we start using them, then — and only if you consent to the Marketing category on our own cookie banner — we will place advertising cookies and pixels from Google (Google Ads), Meta (Facebook and Instagram) and LinkedIn on trustcookies.com, and list each of them in our cookie list (section 11). They tell those platforms that your browser or account visited our website and which pages it saw, so that the platforms can show you advertisements for TrustCookies on their services and on other websites and apps, and tell us (in aggregated form) whether our advertising worked. Those platforms may combine this with information they already hold about you, under their own privacy policies, and act as independent controllers (or, in some cases, joint controllers with us for the collection on our website) for that use.

What this covers — and what it never covers. Retargeting concerns only people who visit our own website. We never use our customers' end-user data — consent records, scan results for customers' websites, or any other data we process on our customers' behalf — for our own advertising, profiling or any other purpose of our own, and we never pass it to advertising platforms.

Your choices.

• The advertising tags do not run unless you choose to allow the Marketing category.
• You can withdraw your consent at any time, as easily as you gave it, through the cookie settings link in the footer of every page. From then on, the tags stop running on our website. Withdrawal does not affect processing before it, and does not by itself delete data the platforms already hold — you can manage that in your Google, Meta and LinkedIn advertising settings.
• Under India's DPDP Act, this is processing based on your consent: the itemised data is listed in section 3.1, the purpose is showing you our advertisements and measuring them, and refusing or withdrawing consent does not affect your use of our website or services.
• US residents: under the California Consumer Privacy Act and similar laws, this is "sharing" for cross-context behavioural advertising (and may be treated as a "sale"). You can opt out at any time through "Your Privacy Choices" (Do Not Sell or Share My Personal Information) at https://trustcookies.com/privacy-choices, which is also linked in our website footer. We treat a Global Privacy Control signal from your browser as a valid opt-out of sale and sharing for that browser: our advertising tags, once in use, will not run for a browser that sends it. See section 10.

3.9 What we do not do

• We do not sell personal data for money. Retargeting (section 3.8), if we use it, will be the only "sharing" or "sale" in the sense of US state privacy laws, and you can opt out of it.
• We do not use customers' consent records or other customer data to train artificial-intelligence models, for our own marketing or advertising, or to build profiles.
• We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.
• We do not knowingly collect sensitive or special-category personal data.

4. Where the data comes from

Most personal data comes directly from you. We also receive data from: your organisation, if a colleague invites you to its account; our payment providers (payment status and limited payment method details); our edge network and bot-protection providers (security signals); and, for section 3.7 only, publicly available websites.

5. Who we share it with

We share personal data only as follows:

• Service providers (processors) that help us run TrustCookies, under written contracts that limit their use of the data. By category: edge network, content delivery, security and encrypted backup storage provider; bot-protection (CAPTCHA) provider; infrastructure hosting provider for our database servers in the European Union; transactional email provider; payment processors and payment gateways; and professional tools we use for support and accounting. The current list of providers, with their locations, is at https://trustcookies.com/subprocessors.
• Payment providers and banks, as needed to process payments, refunds, mandates and chargebacks.
• Analytics providers on our own website — Google (Google Analytics 4, Google Tag Manager) and Microsoft (Clarity) — only if you consent to the relevant category. These providers may use the data in accordance with their own terms and privacy policies, including, in some cases, as independent controllers.
• Advertising platforms — Google (Google Ads), Meta and LinkedIn — if we use their tags, and only if you consent to the Marketing category on our banner (section 3.8).
• Other members of your organisation's account, who can see your name, email address, role and the changes you make in the account.
• Professional advisers such as lawyers, accountants and auditors, under confidentiality.
• Authorities, courts and regulators, where we are legally required to disclose information or to establish, exercise or defend legal claims. Where we are allowed to, we will tell you first.
• A successor to our business. TrustCookies is currently run by Vishnuraam S as a sole proprietor. We plan to transfer the business to a limited liability partnership or company formed or controlled by him. On that transfer, and on any later sale, merger or reorganisation of all or part of the TrustCookies business, the personal data described in this policy, and the consent records we process for customers, will pass to the successor, which will become the controller (or, for consent records, the processor) in our place and will be bound by this policy and by our Data Processing Agreement. We will tell account holders by email or in the dashboard at least thirty (30) days before the transfer and update this policy with the successor's details. The purposes for which your data is used will not change because of the transfer.

6. Where we store and transfer data

Our databases, including account data and our customers' consent records, are hosted in the European Union. Requests to our website and service pass through our edge network provider, which operates servers worldwide and processes requests at a location near the person making them. Our personnel may access the data remotely from India to provide support and operate the service, and some of our service providers (for example payment and email providers) are located in other countries, including India and the United States.

Where a transfer of personal data is subject to the transfer rules of the EU GDPR, the UK GDPR or Swiss law — for example, consent records of visitors from those countries that we process for our customers — we rely, to the extent those rules apply, on the European Commission's Standard Contractual Clauses, with the UK International Data Transfer Addendum and the amendments required by Swiss law, as set out in our Data Processing Agreement, together with additional safeguards where needed. You can ask for a copy of the relevant safeguards by writing to us (section 1). Where we transfer personal data from India, we do so in accordance with the DPDP Act and any restrictions notified under it.

7. How we protect it

We use technical and organisational measures appropriate to the risk, including encryption in transit, separation of each customer's data enforced by the database, access restricted to the personnel who need it, salted hashing of passwords, optional two-factor authentication, logging of administrative changes, and backups. Consent records are written to a hash-linked log, a digest of which is periodically anchored to a public timestamping service. A summary of our security measures is available to customers on request.

No method of transmission or storage is completely secure. If we become aware of a personal data breach that affects you, we will notify you and the relevant authorities where the law requires it. To report a security vulnerability, email support@trustcookies.com with the subject line "Security".

8. How long we keep it

We keep personal data only as long as needed for the purposes in section 3, then delete or anonymise it, unless the law requires us to keep it longer.

9. Your rights

Depending on where you live, you may have the following rights over your personal data. To exercise any of them, email support@trustcookies.com with the subject line "Privacy request", or use the settings in your account where available. We may need to verify your identity before we act, and we will not ask for more information than we need to do so.

9.1 EU, UK and similar laws, where they apply. You may have the right to: access your personal data and receive a copy; have inaccurate data corrected; have data erased; restrict our processing; receive data you provided to us in a portable format; object to processing based on legitimate interests, and to object at any time to direct marketing; and withdraw consent at any time, without affecting processing before withdrawal. We respond within one month, which we may extend by up to two further months for complex or numerous requests, telling you why.

9.2 India (DPDP Act). You have the right to: obtain a summary of the personal data we process about you and the processing activities, and the identities of other data fiduciaries and processors with whom it has been shared; correct, complete, update or erase your personal data; withdraw consent at any time, as easily as you gave it, after which we will stop the processing that relied on it within a reasonable time; nominate another person to exercise your rights in the event of your death or incapacity; and have your grievances addressed by our Grievance Officer. We respond to rights requests and grievances as soon as reasonably possible and in any event within ninety (90) days. If you are not satisfied with our response, you may complain to the Data Protection Board of India after using our grievance process.

9.3 California and other US states. See section 10.

9.4 Complaints. You may complain to a data protection authority, in particular in the country where you live or work or where an alleged infringement occurred — for example, the supervisory authority of your EU member state, the UK Information Commissioner's Office, or the Data Protection Board of India. We would appreciate the chance to address your concern first.

9.5 Consent records on customers' websites. Please direct requests about consent records to the operator of the website you visited (section 2.2).

10. Notice for California and other US state residents

10.1 Categories collected. In the past twelve months we have collected the following categories of personal information, for the purposes and from the sources described in sections 3 and 4: identifiers (such as name, email address, IP address); customer records (such as billing details); commercial information (plans purchased); internet or other electronic network activity (such as usage and security logs, and, if you allow it, browsing activity on our website collected by analytics tags (and by advertising tags, once we use them)); and professional information (such as organisation and role). We do not collect sensitive personal information for the purpose of inferring characteristics about you.

10.2 Sale and sharing. If we use advertising tags (section 3.8) and you allow the Marketing category on our banner, we make identifiers (such as cookie identifiers and IP address) and internet activity on our website (pages visited) available to Google, Meta and LinkedIn for cross-context behavioural advertising (section 3.8). This is "sharing" under the California Consumer Privacy Act as amended, and may be a "sale" under it and similar state laws, although we receive no money for it. We do not sell or share any other personal information, and we never sell or share personal information of our customers' End Users (section 2.2). We do not knowingly sell or share the personal information of consumers under 16.

10.3 How to opt out of sale and sharing. Use "Your Privacy Choices" (Do Not Sell or Share My Personal Information) at https://trustcookies.com/privacy-choices (also in the footer of every page), refuse or withdraw the Marketing category in our cookie settings, or send a Global Privacy Control signal from your browser — we honour it automatically as an opt-out of sale and sharing for that browser, without requiring you to sign in. An opt-out applies to the browser or device you use; if you also want it recorded against your account, email us with the subject line "Do not sell or share".

10.4 Your other rights. Where the California Consumer Privacy Act as amended or a similar state law applies, you may have the right to know what personal information we collect, use and disclose; to access, correct and delete it; to opt out of sale and sharing (section 10.3); and not to be discriminated against for exercising your rights. You may use an authorised agent, whose authority we may ask you to confirm. We respond within forty-five (45) days, extendable by a further forty-five (45) days where reasonably necessary, with notice to you. Requests: support@trustcookies.com, subject line "Privacy request".

10.5 Retention and disclosures. Retention periods are in section 8. We disclose personal information for business purposes to the categories of recipients in section 5.

11. Cookies and similar technologies on our own website

We use our own TrustCookies banner on trustcookies.com. Before you make a choice, we use only technologies that are strictly necessary — for example, to deliver and secure the website, to run the bot check on the free scanner, to keep you signed in to your account on app.trustcookies.com, and to remember your cookie choice. We use other technologies only if you consent to the relevant category:

A Global Privacy Control signal is treated as an opt-out of sale and sharing: our advertising tags, once in use, will not run for a browser that sends it. You can change or withdraw your choice at any time using the cookie settings link in the footer of every page.

The current list of cookies and similar technologies, including each advertising cookie and pixel, with its provider, purpose and duration, is at https://trustcookies.com/cookie-policy.

12. Children

Our website and service are intended for businesses and are not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, contact us and we will delete it.

13. Links to other websites

Our website and documentation may link to websites and services run by others. Their own privacy policies apply to them.

14. Changes to this policy

We may update this policy from time to time. We will post the updated version here with a new effective date. If a change materially affects how we use personal data we already hold, we will notify account holders by email or in the dashboard at least thirty (30) days before it takes effect, and, where the law requires, ask for consent again.

15. Contact

For any question about this policy or your personal data, write to support@trustcookies.com (subject line "Privacy request"), contact our Grievance Officer as shown in section 1, or write to Vishnuraam S, sole proprietor trading as HextonHQ and TrustCookies, 3rd Floor, Door No. 1-60/8/A and B, KNR Square, Opp. The Platina, Gachibowli, Hyderabad, Rangareddy District, Telangana — 500032, India.