Privacy policy
Last updated on 14 October 2026
This policy explains what personal data Brandforward collects through Cookiemark and cookiemark.com, why, and what rights you have. It covers two groups of people: our customers and their teams, and the people who visit cookiemark.com.
Two roles
We play two different roles, and this policy is about the first one.
- We are the controller for the data of our customers and their teams, such as your account, your invoices and your mail with us. We decide why and how we use that data.
- We are a processor for the consent records of the visitors to our customers' websites. Each customer is the controller for those records. Our data processing agreement covers that role. If you visited a website that uses Cookiemark, the privacy policy of that website tells you how it handles your choice.
Who we are
Brandforward, Houten, the Netherlands. Mail hello@cookiemark.com with any question about your data. Our Chamber of Commerce number will be added here before the first paid plan starts.
What we collect and why
| Data | Why we use it | Legal basis |
|---|---|---|
| Your email address, first and last name, and when you last signed in | To give you an account, send you sign-in links and show your colleagues who you are. | Contract |
| The email address and IP address of each request for a sign-in link | To stop anyone from flooding an address with sign-in mails. We allow 5 links per address and 15 per IP address in 15 minutes. | Legitimate interest: security |
| Your organisation, team, clients and invitations | To let you work together and give clients access to their own sites. | Contract |
| Your sites, settings, texts, cookie lists and scan reports | To run the service you signed up for. | Contract |
| Billing details, such as your company name, address and VAT number | To take payment and send invoices that meet tax rules. | Contract and legal obligation |
| Your notification choices | To send you only the emails you want, such as scan results. | Contract |
| Emails you send us | To answer you. | Legitimate interest |
Visitors of cookiemark.com
We do not use analytics or advertising on cookiemark.com. We collect data from visitors in two places only.
- The sign-in and free scan forms use Cloudflare Turnstile to tell people from scripts. Turnstile processes your IP address and some details of your browser for that check.
- The free scan stores the address you scan, the report and a screenshot of the start page. To limit scans per person, we store a salted hash of your IP address, never the address itself.
Cookies on cookiemark.com
We only set cookies that the site needs to work. They do not need your consent.
| Cookie | Purpose | Kept for |
|---|---|---|
Supabase session cookies, starting with sb- | Keep you signed in to the dashboard. | Until you sign out, or the session ends |
cm_org | Remembers which organisation or client you last opened. | 1 year, or until you sign out |
cm_next | Remembers which page to open after you sign in. | 1 hour |
The fonts on our site come from Bunny Fonts, which serves them from the EU without cookies.
Who we share data with
We use a small number of companies to run Cookiemark, such as our database host, our payment provider and our mail service. They only process data on our instructions. The list of subprocessors names each one, what it does and where. We do not sell personal data, and we do not share it for advertising.
Where your data is stored
Our database runs in the EU, in Ireland. Some of our providers are companies based outside the EU, or have offices there. Where data may leave the EU, we rely on the safeguards the GDPR allows, such as the EU standard contractual clauses.
How long we keep it
- Your account data, for as long as you have an account. When you delete it, we remove it within 30 days.
- Invoices and the data on them, for 7 years, because Dutch tax law requires it.
- Requests for sign-in links, for as long as we need them to stop abuse.
- Free scan reports, for as long as their link may still be shared, after which we delete them.
Your rights
You may ask us for a copy of your data, and ask us to correct or delete it. You may also object to how we use it, or ask us to limit its use. Most data you can see and change yourself in the dashboard. For anything else, mail us and we reply within a month.
If you think we handle your data wrongly, please tell us first. You also have the right to complain to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens.
Security
You sign in without a password, with a link that works once. Access to customer data in our database is limited to the people in each organisation, enforced by the database itself. Our own admin area asks for a second factor on every sign-in.
Changes
When we change this policy, we update the date at the top. We tell you by email about changes that matter to you.