Privacy Policy
Last updated: 11 October 2026
This policy explains what personal data FrostBanner processes, why, and what your rights are. FrostBanner plays two roles:
- Controller for the data of our customers (people who create an account) and of visitors to frostbanner.com.
- Processor for the consent data of visitors to our customers' websites. For that data the website owner is the controller; our obligations are set out in the Data Processing Agreement.
1. Who is responsible
Artem Galyeyev, sole proprietor (empresário em nome individual), NIF 247017841, Maia, Portugal. Privacy contact: support@frostbanner.com.
2. Data we process as controller
| Data | Purpose | Legal basis | Kept for |
|---|---|---|---|
| Email address, plan, account dates, language | Creating and running your account, sending sign-in links | Contract (Art. 6(1)(b) GDPR) | While your account exists; deleted within 30 days after closure |
| Sign-in links and sessions (stored only as hashes) | Secure sign-in | Contract; legitimate interest in security (Art. 6(1)(f)) | Links 15 minutes, sessions 30 days |
| Subscription status from Paddle (plan, period, status) | Giving you the features you paid for | Contract | While your account exists, plus records required by tax law |
| Messages you send us | Answering support requests | Contract; legitimate interest | Up to 2 years |
| Technical request data (IP address, browser) in server logs | Security, abuse prevention, rate limiting | Legitimate interest | Short-term logs of our hosting provider |
Card and payment details are collected by Paddle, not by us. Paddle acts as an independent controller for payment data; see Paddle's privacy notice.
3. Data we process for our customers (processor)
When a visitor makes a choice in a FrostBanner banner, we store: a random consent ID, the categories accepted or refused, the banner version, the action, the visitor's country, the page address (without query parameters), the time, and a hash of the IP address and browser string. The IP address itself is never stored; the hash uses a secret key and a salt that changes every month, and old salts are deleted. These records are kept for 12 months and then deleted automatically.
4. Cookies on frostbanner.com and in the banner
frostbanner.com does not use analytics, advertising or tracking cookies. The dashboard sets one strictly necessary cookie to keep you signed in. The banner, on any website, stores the visitor's choice (cookie and local storage “fb_consent”) and a cached copy of the banner settings; these are necessary to remember the choice and are not used for tracking. The live demo on our home page works the same way.
5. Who receives data
- Cloudflare, Inc. — hosting, database and content delivery.
- Resend — sending sign-in emails (EU region, Ireland).
- Paddle.com — Merchant of Record: checkout, payments, invoices, taxes and refunds.
- Professional advisers (e.g. accountants) and public authorities when required by law.
We do not sell personal data and do not use it for advertising.
6. International transfers
Some providers are based in, or may access data from, countries outside the European Economic Area, such as the United States. In that case transfers are protected by an adequacy decision of the European Commission (including the EU–US Data Privacy Framework where the provider is certified) or by the Commission's Standard Contractual Clauses.
7. Security
All traffic uses HTTPS. Sign-in links and sessions are stored only as hashes, IP addresses are never stored in clear, cookies are HttpOnly and Secure, access to the dashboard is limited to the account owner, and requests are rate-limited. Access to production systems is limited to the operator.
8. Your rights
Under the GDPR you have the right to access, rectify and erase your data, to restrict or object to processing, to data portability, and to withdraw consent where processing is based on consent. Write to support@frostbanner.com; we reply within one month. If you are a visitor of a customer's website, please contact that website first — we will help them answer you. You can also complain to a supervisory authority; in Portugal this is the Comissão Nacional de Proteção de Dados (CNPD).
9. Changes
We will post changes here and update the date above. Material changes will be announced to customers by email.