Privacy policy
Updated
How Comply Ark Pvt. Ltd. handles personal data on cookiegate.io and inside CookieGate: as the operator of this website and of your account, and as the processor of consent records collected on customers’ websites.
Who we are and what this policy covers
Comply Ark Pvt. Ltd. (“Comply Ark”, “we”, “us”) is a regulatory infrastructure company registered in India, with its registered office at 2, Vrindavan Apartments, Vellakinavu Rd / Indiraji Rd, Kannankulangara, Thrippunithura, Ernakulam, Kerala 682301. We operate this website, cookiegate.io, and the CookieGate platform at app.cookiegate.io, including the script that customers install on their own websites (the “SDK”).
We act in two roles, and this policy is written for both.
For this website and for your CookieGate account, we decide why and how personal data is used. Under the Digital Personal Data Protection Act, 2023 (the “DPDPA”) we are the data fiduciary; under the GDPR and the UK GDPR we are the controller.
For consent records collected on our customers’ websites, the customer decides. We process those records on the customer’s instructions as a data processor, under the agreement we hold with that customer. Section 4 explains what that means for you if you met a CookieGate banner on someone else’s site.
This website: what it collects and when
This website sets no cookies and runs no analytics. It makes no third-party request, so there is nothing for it to ask your consent for.
The one thing it writes to your browser is a note in session storage, and only if you press Pause on the home page scene, so the animation stays paused while you browse. The note holds nothing about you and is cleared when you close the tab.
Writing to us
The form on the contact page sends nothing from this website. When you press Send, it opens your own email app with a message to contact@complyark.com, filled in from the form: your name, your email address, your company and website if you gave them, the topic, your message, and the page the form was on. Nothing reaches us until you send that email yourself. We read it, reply to what you asked and nothing else; your address is not added to any mailing list.
Server logs
Our web server records each request with the IP address, the page requested, the time, the referring page and the user agent, for security and capacity planning. Section 6 gives how long the logs are kept.
What this website does not do
It runs no advertising pixels, no remarketing tags, no session recorders and no social media plugins. Its web fonts are served from this domain, so no font request leaves for a third party. It embeds no third-party frames.
Accounts and billing on the platform
Account data
Your name, work email address, organisation details and authentication data when you create or join a workspace. If you sign in with Google, we receive your name and email address from Google and nothing else.
Billing data
Payments are collected by Razorpay. We store your plan, invoices and payment status. Full card numbers never reach our systems; Razorpay holds them under its own privacy policy.
Service data
The records needed to run and secure the platform: sign-in events, configuration changes, and support conversations. Configuration changes are written to a tamper-evident audit log that is chained in the same way as consent receipts. The audit log is kept for seven years by default.
Your data protection officer
If you add your data protection officer’s contact as a notice block, it appears in the preferences panel of your banner.
Consent records we process for customers
When you meet a CookieGate banner on a customer’s website, the customer is the data fiduciary or controller and we process the record on their behalf. The record is a consent receipt, written against the customer’s website: the time, an anonymous identifier, the domain, the regulation applied, the action, the Global Privacy Control signal, the choice per category, a hash of the record, a receipt identifier, the IP address with its last segment masked, and the browser’s user agent string. A banner log entry is written as well. Receipts are hash-chained and signed so the customer can prove to a regulator that the record has not been altered. We never use these records for our own purposes, never combine them across customers, and never sell them.
If you file a data protection request through a customer’s CookieGate request form, you provide an email address that we verify with a one-time code, the type of request, and whatever you write. The request goes to the customer; we store it for them and show them the response window that applies to it.
The scanner visits a customer’s website as a browser would and records the cookies, scripts, frames and requests it finds. It never visits pages behind a login. It does not collect data about the customer’s visitors.
Banner translations are produced on models we host ourselves. No banner text is sent to a third-party translation service.
Why we process personal data
For each activity, the basis under the DPDPA and under the GDPR.
| Activity | DPDPA | GDPR |
|---|---|---|
| Replying to an email you send us | Legitimate use: you gave us the data for that purpose (s.7(a)) | Legitimate interests (Art. 6(1)(f)), or steps before a contract (Art. 6(1)(b)) |
| Your account, the platform and billing | Consent, given at sign-up (s.6) | Contract (Art. 6(1)(b)) |
| Tax and accounting records | Retention the law requires (s.8(7); Companies Act, 2013, s.128) | Legal obligation (Art. 6(1)(c)) |
| Security logs | Reasonable security safeguards (s.8(5)) | Legitimate interests (Art. 6(1)(f)) |
How long we keep it
One row for each kind of data we hold, with the period we keep it.
| Data | Kept for |
|---|---|
| Consent receipts and banner log entries for customers’ websites | As the customer instructs. Receipts are chained, so one receipt cannot be removed on its own without breaking the customer’s evidence. |
| Emails you send us | 24 months after our last reply, then deleted |
| Server access logs | Up to 14 days |
| Account data | For the life of your workspace, then for the period the law requires |
| Billing records and invoices | Eight years, as section 128(5) of the Companies Act, 2013 requires |
| Platform audit log | Seven years by default |
Who else sees it: our providers
We share personal data only with the providers we need to run this website and the platform:
- Google Cloud: hosting and storage, in Mumbai, India.
- Google Workspace (Gmail): our mailbox, contact@complyark.com, which holds the emails you send us and our replies.
- Razorpay Software Pvt. Ltd.: payment collection and subscription mandates.
- An email delivery provider: the platform’s transactional email.
- Google LLC: Sign-in with Google, only if you choose it for your account.
Nobody else receives personal data from us in the ordinary course. We disclose personal data to a court or authority only where the law compels it, and we tell the affected customer or person unless the law forbids it.
International transfers
Our servers are in Mumbai, India. The providers in section 7 may process data outside India, including Google for the emails you send us and for Sign-in with Google.
If a customer configures a cross-border flow for its own websites, that customer is responsible for its lawfulness.
We do not transfer personal data to any country restricted under section 16 of the DPDPA.
Security
Data is encrypted in transit. Data is encrypted at rest on Google Cloud’s disks. Consent receipts are hash-chained and signed with a key held on our servers, so any alteration is detectable, and any receipt can be checked at a public verification endpoint. The audit log is chained in the same way. Access within a workspace is role-based, and configuration changes are written to the audit log.
No system is perfectly secure. If a breach affects your personal data, we will notify the relevant authority and, where the law requires it, you, within the periods the law sets: 72 hours to the supervisory authority under the GDPR, and the periods the DPDP Rules, 2025 prescribe to the Data Protection Board and to affected individuals.
Your rights, and how to use them
What you can ask for depends on the law that applies to you, and we honour each right that law gives you.
Under the DPDPA
Under the DPDPA you may ask for access to your personal data, for correction and erasure, for redress of a grievance, and you may nominate a person to exercise these rights for you.
Under the GDPR and the UK GDPR
Under the GDPR and the UK GDPR you may ask for access, rectification, erasure, restriction, portability, and to object to processing; you may withdraw consent at any time; and you may complain to your supervisory authority.
Under the CCPA and the CPRA
Under the CCPA and CPRA you may ask what we collect, ask us to delete or correct it, opt out of sale or sharing (we do neither), limit the use of sensitive information (we collect none), and you will not be treated differently for using these rights.
To exercise a right, write to us at contact@complyark.com. We respond within the statutory period that applies to you, and we may ask you to confirm the email address a request concerns.
If a CookieGate banner collected your consent on someone else’s website, that website’s operator is the data fiduciary or controller, and the fastest route is to them. If you write to us instead, we will route your request to the operator and tell you we have done so.
Grievances and the DPDPA
Our grievance officer under the DPDPA is Navaneeth SS, reachable by phone on +91 7994400844. We acknowledge a grievance when it arrives and resolve it within the period the DPDP Rules, 2025 prescribe. If you are not satisfied with our response, you may approach the Data Protection Board of India.
Children
CookieGate is for businesses and is not directed at children. We do not knowingly collect personal data from a child, and a customer may not use CookieGate to do so.
Changes to this policy
We post changes here and update the date at the top. Material changes are announced to account holders by email before they take effect. Previous versions are available on request.
Contact
contact@complyark.com
Or use the contact page. We respond within one business day.