Privacy Policy

Last updated: 4 November 2026

On this page

Pixadoro Ltd. (“Company”, “we”, “us”, “our”) is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, disclose, and protect your personal data when you visit our website at kukie.io, use our platform at app.kukie.io, or interact with any of our services (collectively, the “Services”).

By using our Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, please do not use our Services.

Important: This Privacy Policy applies to the personal data we collect from you as our customer or website visitor. It does not apply to any data we process on your behalf as a data processor when you use our cookie consent management platform to collect consent from your own website visitors. That processing is governed by our Data Processing Agreement.

1. Data Controller

The data controller responsible for the processing of your personal data is:

Pixadoro Ltd.
Blvd. Cherni Vrah 47, 1407, Sofia, Bulgaria
Company number: 206777328
VAT: BG206777328
Email: support@kukie.io

For any enquiries regarding this Privacy Policy or your personal data, please contact us at support@kukie.io.

1.1. Data Protection Contact

We have designated a privacy contact who is responsible for overseeing questions in relation to this Privacy Policy and our processing of personal data. If you have any questions about this Privacy Policy, or wish to exercise any of the rights described in section 11, please contact our privacy contact:

Privacy contact, Pixadoro Ltd.
Blvd. Cherni Vrah 47, 1407, Sofia, Bulgaria
Email: support@kukie.io

You have the right to make a complaint at any time to your supervisory authority for data protection matters (see section 11.8). We would, however, appreciate the chance to address your concerns before you approach the authority, so please contact us in the first instance.

2. Legal Basis for Processing

We process your personal data only when we have a lawful basis to do so. The legal bases we rely on include:

Performance of a contract (Article 6(1)(b) GDPR): Processing necessary to provide the Services you have subscribed to, manage your account, and fulfil our contractual obligations to you.
Legitimate interests (Article 6(1)(f) GDPR): Processing necessary for our legitimate business interests, such as improving the Services, ensuring security, preventing fraud, and communicating with you about your account, provided these interests are not overridden by your fundamental rights and freedoms.
Legal obligation (Article 6(1)(c) GDPR): Processing necessary to comply with applicable laws, regulations, or legal proceedings.
Consent (Article 6(1)(a) GDPR): Where we rely on your consent, such as for marketing communications. You may withdraw your consent at any time by contacting us or using the unsubscribe mechanism provided.

3. Personal Data We Collect

We collect and process the following categories of personal data:

3.1. Account Data

When you register for an account, we collect your name, email address, password (stored in hashed form), and organisation name. If you enable two-factor authentication, we store the associated recovery codes in encrypted form.

3.2. Billing and Financial Data

When you subscribe to a paid plan, we collect billing-related information including your payment method details (processed and stored by our payment provider, Stripe - we do not store your full card details), VAT number (if applicable), and billing address. Transaction records, invoices, and subscription history are maintained for accounting and legal purposes.

3.3. Site and Configuration Data

We collect the domain names you register on the platform, your banner configuration settings (layout, colours, texts, translations, region rules), cookie categorisations, legal document content you create using our generator, and script or service configurations.

3.4. Scan Data

When you run a cookie scan, we collect and store the scan results, including the cookies and tracking technologies detected on your website, page URLs crawled, and categorisation data.

3.5. Technical and Usage Data

When you access the Services, we automatically collect technical information including your IP address, browser type and version, operating system, device type, referring URL, pages visited within our platform, timestamps, and general usage patterns. This data is collected through server logs and may be supplemented by analytics tools.

3.6. Communication Data

If you contact us via email, our contact form, or other channels, we collect the content of your communications along with associated metadata (such as your email address and the date and time of the message).

3.7. Team and Invitation Data

If you invite team members to your organisation, we collect and process the email addresses of invitees and their role assignments within the organisation.

4. How We Collect Your Data

4.1. Directly from You

We collect data you provide when you register an account, subscribe to a plan, configure your sites, create legal documents, contact us, or otherwise interact with the Services.

4.2. Automatically

We collect technical and usage data automatically when you access our website or platform through server logs, cookies, and similar technologies. See Section 9 for details on cookies we use.

4.3. From Third Parties

We may receive data from our payment processor (Stripe) regarding the status of your transactions and subscriptions.

5. How We Use Your Data

We use your personal data for the following purposes:

5.1. Providing the Services

Creating and managing your account and organisations
Processing your subscriptions and payments
Delivering the cookie consent management platform, including the banner script, cookie scanner, consent logging, analytics, and legal document generator
Providing customer support and responding to your enquiries

Legal basis: Performance of a contract.

5.2. Improving the Services

Analysing usage patterns to improve the platform’s functionality, performance, and user experience
Identifying and fixing bugs, errors, and security issues
Developing new features and capabilities

Legal basis: Legitimate interests (improving and maintaining the quality of our Services).

5.3. Security and Fraud Prevention

Protecting the Services against unauthorised access, abuse, and security threats
Detecting and preventing fraudulent activity, including trial abuse
Monitoring compliance with our Terms of Service

Legal basis: Legitimate interests (security of our systems and protection against fraud).

5.4. Communications

Sending transactional emails related to your account and subscription (e.g. trial reminders, scan completion notifications, subscription changes, site transfer requests)
Notifying you of changes to our Terms, Privacy Policy, or Services
Sending marketing communications, where you have opted in or where permitted by applicable law

Legal basis: Performance of a contract (transactional), legitimate interests (service updates), and consent (marketing).

5.5. Legal Compliance

Complying with applicable tax, accounting, and regulatory obligations
Establishing, exercising, or defending legal claims

Legal basis: Legal obligation and legitimate interests.

5.6. Aggregated Statistics

We may create aggregated, anonymised statistics from your data (such as total pages scanned across the platform) for use in marketing materials and platform improvement. This data cannot be used to identify you.

Legal basis: Legitimate interests.

We do not sell, rent, or trade your personal data. We may share your data in the following circumstances:

6.1. Service Providers (Sub-processors)

We engage trusted third-party service providers who process personal data on our behalf to help us operate and improve the Services. These providers are contractually bound to process data only on our instructions and to implement appropriate security measures.

Current sub-processors:

Hetzner Online GmbH (Gunzenhausen, Germany) - Server hosting and infrastructure. Data stored in the European Union (EU). Privacy Policy
Cloudflare, Inc. (San Francisco, USA) - CDN, DDoS protection and DNS for our websites, the platform and the banner script, including the country detection used to choose a banner’s regional rules. Processes the IP address and browser details of every visitor in transit. Also provides Turnstile, the bot check on registration, the contact form, our free tools and Customers' privacy request forms (the check runs in your browser, and we send Cloudflare your IP address to verify its result), and the certificates and encrypted connections for the consent subdomains Customers set up for HTTP consent cookies. Privacy Policy
Stripe, Inc. (San Francisco, USA) - Payment processing. Processes billing and payment data. Privacy Policy
MailerLite (Vilnius, Lithuania) - Newsletter delivery. Stores the email address and opt-in IP address of newsletter subscribers, from the site footer signup and the contact form’s marketing opt-in. For footer signups MailerLite is the sole store of this data; contact-form opt-ins are additionally retained by us as part of your contact submission (see section 8). Privacy Policy
Functional Software, Inc. (Sentry) (San Francisco, USA) - Error monitoring for the platform. Error reports are stored in Sentry’s EU data region (Germany) and are stripped of cookies, request bodies, headers and user details before they are sent. Privacy Policy
NS1.bg (Bulgaria) - Offsite backup storage and email hosting. Receives encrypted-in-transit copies of our database backups (which include account, billing and consent data, and the requests sent through Customers’ privacy request forms) every six hours; backups are retained for 30 days. Also runs the mail server that sends our account and service emails, including the confirmation email of Customers’ privacy request forms (so it processes the recipient’s email address and the message) and hosts the support@kukie.io mailbox (so it holds the correspondence you send us). Data stored in the European Union (EU).
Google Ireland Limited (Dublin, Ireland) - Website analytics and advertising on kukie.io (Google Analytics and Google Ads). Receives the pages visited, the referring page and browser and device details, in the European Economic Area, the United Kingdom, Switzerland and Brazil only after you accept (see sections 9.3 and 9.4). Not used on the platform, except the Google Ads sign-up report described in section 9.4. Privacy Policy
Ahrefs Pte. Ltd. (Singapore) - Cookieless visit counting on kukie.io (Ahrefs Web Analytics), on the same terms as Google Analytics (see section 9.3). Receives the page visited, the referring page and browser details. Not used on the platform. Privacy Policy
jsDelivr (open-source content delivery network) - Serves two open-source files (the Vue.js library and a Tailwind CSS stylesheet) to the Stripe payment confirmation page of the platform, a page used only when a card payment needs extra confirmation. Receives the IP address and browser details of a Customer who opens that page. Privacy Policy

We also use the GeoLite2 geolocation database from MaxMind, Inc. (Waltham, USA) to determine a visitor’s country when our content delivery network does not supply it. The database is downloaded to our own servers and queried there with the visitor’s IP address, so no personal data is sent to MaxMind, and MaxMind is not a sub-processor.

We will update this list before a new sub-processor begins processing personal data, and registered Customers will be notified of the change by email so they have the opportunity to object.

6.2. Legal Requirements

We may disclose your personal data if required to do so by law, regulation, legal process, or governmental request, or if disclosure is necessary to protect our rights, property, or safety, or the rights, property, or safety of others.

6.3. Business Transfers

In the event of a merger, acquisition, or sale of all or a portion of our assets, your personal data may be transferred to the acquiring entity. We will notify you of any such change and any choices you may have regarding your personal data.

We may share your data with third parties when you have given us explicit consent to do so.

AI apps you connect. Where your plan includes the AI Connector, you can connect an AI app you choose, such as Claude or ChatGPT, to your Kukie.io account. The app then reads the data of your organisation that your role and the sites you chose give it access to and, if you allow it, changes it. We send that data to the app only when the app asks for it on your behalf. This can include your organisation’s name, its plan, its sites and their settings, scan results, aggregate consent figures, and the display names of team members next to changes made through the connector. It never includes another team member’s email address. The app’s provider handles the data under its own terms and privacy policy, which you agree with that provider. It acts on your request, as a recipient you chose, not as our sub-processor. You can disconnect an app at any time on the AI Connector page of your account, and organisation owners and admins can disconnect any app connected to their organisation.

7. International Data Transfers

Your personal data is primarily stored and processed on servers located within the European Union (EU), operated by Hetzner Online GmbH.

Some of our sub-processors (notably Stripe, Cloudflare and Sentry) are based in the United States. Where personal data is transferred outside the European Economic Area (EEA), we ensure that appropriate safeguards are in place, including:

European Commission adequacy decisions
Standard Contractual Clauses (SCCs) approved by the European Commission
EU-U.S. Data Privacy Framework certification (where applicable)

You may request a copy of the applicable transfer safeguards by contacting us at support@kukie.io.

8. Data Retention

8.1. Account Data

We retain your account data for as long as your account is active. If you delete your account, we will delete your personal data within 30 days, except where we are required by law to retain certain information (e.g. for tax and accounting purposes, which may require retention for up to 10 years under Bulgarian law).

8.2. Billing Data

Billing and transaction records are retained for the period required by applicable tax and accounting regulations (up to 10 years from the end of the financial year in which the transaction occurred).

8.3. Configuration and Scan Data

Site configurations, banner settings, and scan results are deleted when you remove the associated site from your account or when your account is deleted.

End-user consent logs collected through the banner script are retained for the retention period of your subscription plan (currently 12, 24 or 36 months, depending on the plan), or for a shorter period you choose for a site in its settings. Records are deleted automatically by a daily job within one month after that period ends, and may afterwards only be used in aggregated, anonymised form for platform statistics. Where you turn on Advanced Analytics for a site, its daily counts are deleted on the same schedule as the site's consent logs.

8.5. Communication Data

Support correspondence is retained for a reasonable period to resolve enquiries and for quality assurance, typically no longer than 2 years after the last interaction.

8.6. Technical Logs

Server logs and technical data are typically retained for no longer than 90 days, unless longer retention is required for security investigations or legal proceedings.

Our audit log is kept separately. Security events (such as sign-ins, sign-outs, failed sign-in attempts, password, two-factor and API key changes, and account deletion) are recorded with the full IP address and kept for up to 12 months, so that we can detect and investigate unauthorised access to accounts (legitimate interest, Article 6(1)(f) GDPR). They are kept for that period even after an account is deleted, because investigating the misuse of an account can require them. Actions taken by our own administrators are also recorded with the full IP address and kept for up to 60 days. Records of the actions you take in the dashboard are kept for up to 180 days with a shortened IP address.

8.7. Backups

We take full database backups every six hours. Backup copies are stored with our offsite backup provider (see the sub-processor list in section 6.1) within the European Union and are retained for 30 days, after which they are automatically deleted. Personal data deleted from the live system therefore leaves the backup cycle within 30 days, consistent with the deletion window in section 8.1. Backups are used only for disaster recovery and are not used to restore individual records that you have deleted.

8.8. AI Connector Records

If you use the AI Connector, we keep a record of each connection (the app, where its sign-in went, the organisation, the access and sites you chose, and when it was connected, last used and ended) for as long as your account exists. We log each request an app makes with the tool it used, the outcome, the time it took and the size of the answer, but never what it asked for or what we answered, and we keep that log for 90 days. Changes an app makes, with the settings before and after, are kept for 180 days so that they can be reviewed and undone. Sign-in tokens expire after 1 hour (access) and 30 days (renewal); revoked tokens are deleted within an hour and expired ones 7 days after they expire. Connecting an app, creating an AI key and ending a connection are security events (section 8.6).

9. Cookies on Our Website

When you visit our marketing website (kukie.io) and platform (app.kukie.io), we may use the following types of cookies:

9.1. Strictly Necessary Cookies

These cookies are essential for the operation of the Services. They include session cookies for authentication, CSRF protection tokens, and language preferences. These cookies cannot be disabled as the Services would not function without them.

9.2. Functional Cookies

These cookies enable enhanced functionality and personalisation, such as remembering your dashboard preferences and display settings.

9.3. Analytics

We use Google Analytics on our marketing website (kukie.io) to see how it is used, for example which pages visitors read and where they came from. It does not run on the platform (app.kukie.io).

In the European Economic Area, the United Kingdom, Switzerland and Brazil, Google Analytics loads only after you accept analytics cookies in our cookie banner. Until then, and if you decline, your browser sends nothing to Google Analytics. Once you accept, it sets its cookies (_ga and _ga_*), and our banner tells Google what you chose through Google Consent Mode. In other countries, Google Analytics runs from your first visit, unless your browser sends a Global Privacy Control or Do Not Track signal. Wherever you are, you can turn it off at any time in the banner: the page reloads, its cookies are deleted and it stops. As the old page closes, it can send Google one last measurement, without cookies and marked as declined. Google Analytics does not store your IP address.

We also use Ahrefs Web Analytics to count visits to kukie.io. It sets no cookies and does not recognise you from one day to the next. It follows the same rule as Google Analytics: in the countries above, it runs only after you accept analytics cookies.

9.4. Advertising Cookies

We advertise Kukie.io in Google search results. Our marketing website (kukie.io) uses the Google Ads tag, loaded through the same Google tag as Google Analytics. In the European Economic Area, the United Kingdom, Switzerland and Brazil, the tag loads only after you accept marketing cookies in our cookie banner. Until then, and if you decline, your browser sends nothing to Google Ads. In other countries it runs from your first visit, unless your browser sends a Global Privacy Control or Do Not Track signal. Wherever you are, you can turn it off at any time in the banner, and it stops when the page reloads. When it runs, it tells Google which of our pages you visited, which Google can use to show you our ads on other websites, and it sets cookies. These include _gcl_au on kukie.io and, when you arrive from one of our ads, _gcl_aw on kukie.io and Google’s GCL_AW_P for about 90 days on google.com, googleadservices.com and doubleclick.net, kept for kukie.io only. Where your browser allows third-party cookies, Google also sets IDE for about 13 months and test_cookie for 15 minutes on doubleclick.net. Google describes its cookies in How Google uses cookies. Our banner tells Google what you chose through Google Consent Mode.

If you create an account while marketing cookies are allowed on kukie.io (after you accept them, or, in countries where our banner only informs you, once it has closed without you turning them off), app.kukie.io tells Google Ads, once, that your visit led to a sign-up, so we can see which of our ads work. Otherwise app.kukie.io sends nothing to Google. Google Ireland Limited receives this information as an independent controller and handles it under the Google Privacy Policy.

You can manage your cookie preferences at any time through the cookie banner displayed on our website or through your browser settings. Disabling certain cookies may affect the functionality of the Services.

10. Data Security

We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it against unauthorised access, alteration, disclosure, or destruction. These measures include:

Encryption of data in transit using TLS/SSL
Hashed and salted password storage
Two-factor authentication option for user accounts
Regular security audits and vulnerability assessments
Access controls limiting data access to authorised personnel on a need-to-know basis
Infrastructure hosted in EU data centres with physical security measures
Cloudflare DDoS protection and WAF
For the AI Connector: sign-in through OAuth 2.1 with PKCE or an expiring AI key stored only as a hash, access limited to the organisation, sites and permission you choose, every change previewed and recorded and, except starting a scan, undoable, and connections you or an organisation owner or admin can end at any time

While we strive to protect your personal data, no method of transmission over the Internet or method of electronic storage is completely secure. We cannot guarantee absolute security, but we are committed to implementing industry-standard safeguards.

11. Your Rights

Under applicable data protection laws, including the GDPR, you have the following rights regarding your personal data:

11.1. Right of Access

You have the right to request a copy of the personal data we hold about you and to obtain information about how we process it.

11.2. Right to Rectification

You have the right to request that we correct any inaccurate or incomplete personal data we hold about you. You can also update most of your account information directly through the dashboard.

11.3. Right to Erasure

You have the right to request that we delete your personal data, subject to any legal obligations that require us to retain it. You can delete your account at any time from the account settings page.

11.4. Right to Restriction of Processing

You have the right to request that we restrict the processing of your personal data in certain circumstances, such as when you contest the accuracy of the data or object to our processing.

11.5. Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit it to another controller. You can export your data from the dashboard at any time.

11.6. Right to Object

You have the right to object to the processing of your personal data where we rely on legitimate interests as the legal basis. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.

Where processing is based on your consent, you have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

11.8. Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority. The relevant authority for Bulgaria is:

Commission for Personal Data Protection (CPDP)
2 Prof. Tsvetan Lazarov Blvd.
1592 Sofia, Bulgaria
Website: www.cpdp.bg

If you are located in another EU member state, you may also lodge a complaint with your local supervisory authority.

11.9. Exercising Your Rights

To exercise any of your rights, please contact us at support@kukie.io. We will respond to your request within 30 days. If your request is complex, we may extend this period by a further 60 days, in which case we will inform you of the extension and the reasons for it.

We may need to verify your identity before processing your request. There is no fee for exercising your rights, unless your request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse to act on the request.

12. Children

Our Services are not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If you believe that a child has provided us with personal data, please contact us at support@kukie.io and we will take steps to delete such data promptly.

13. Third-Party Links

Our website and Services may contain links to third-party websites. We are not responsible for the privacy practices or content of those websites. We encourage you to review the privacy policies of any third-party sites you visit.

14. Marketing Communications

We may send you marketing communications about our products and services where you have opted in to receive them or where permitted by applicable law. You can opt out of marketing communications at any time by clicking the “unsubscribe” link in any marketing email or by contacting us at support@kukie.io.

Opting out of marketing communications does not affect transactional emails related to your account and subscription (such as billing notifications, security alerts, and service updates).

15. Data Processing on Your Behalf

When you use the Kukie.io platform to collect consent from your website visitors, we act as a data processor on your behalf. In this capacity:

You are the data controller for end-user consent data
We process end-user data strictly in accordance with your instructions and the functionality of the Services
The terms of this processing are set out in our Data Processing Agreement, which forms part of our Terms of Service and lists the sub-processors that handle end-user data

Where consent logging is enabled for a site, each end-user consent record includes: the consent choices made (the categories accepted and, on sites that ask for consent per service, the services accepted) and, where applicable, the resulting Google Consent Mode state; the site and the page URL on which consent was given; the banner version; a timestamp; the visitor's country code; keyed cryptographic hashes (HMAC-SHA256) of the visitor's IP address and browser user agent, where those values are available; and a browser-generated visitor identifier. The visitor identifier is a random value created by the consent banner and stored in the visitor's browser; it is kept in the consent log in plain text, because it is the key that links a returning visitor's consent history. Raw IP addresses and user agents are not stored in consent logs; only their keyed hashes are retained.

Where you turn on Advanced Analytics for a site, the consent banner also sends us a short request on each page load saying what the banner did there (for example, whether it was shown or a stored choice was restored), and the request that records a choice also says where it was made, which button was used, the consent model and the banner language. The page-load request carries no cookie, no page address and no visitor identifier. We use the visitor's IP address to find the country and region (and, briefly, for rate limiting), and the browser user agent only to tell the device type and the browser family, and then discard both. We keep only daily counts for the site, each by a single attribute, for the site's consent retention period, and nothing is added to the consent record. Nothing is sent or counted for a visitor who opts out through a control you offer, or whose browser sends a Global Privacy Control or Do Not Track signal, except in regions where you apply the opt-out model. We use these counts only to show them to you, never for our own purposes. You decide whether to turn the feature on, and whether your visitors' consent is needed for it where you operate. See Annex I, item 6 of the Data Processing Agreement.

Where a member of your organisation connects an AI app through the AI Connector, the app can look up a single consent record by its consent identifier on your behalf. It receives only the choice made, the categories and services accepted, the date and time, the visitor’s country code and the banner version, never the visitor identifier, the hashes or the page address. Other figures about your visitors reach the app only as totals. See Annex I, item 7 of the Data Processing Agreement.

Where you turn on a site’s privacy request form, people who send a request through it give us their name, email address, the type of request, the region they live in and any details they choose to add, for you. We send each of them one email to confirm their address, show the confirmed request only to the owners and admins of your organisation, and never answer it ourselves. Their IP address protects the form from abuse and is not stored with the request. Unconfirmed requests are deleted after 24 hours, and closed ones 24 months after you close them. See Annex I, item 8 of the Data Processing Agreement.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. Material changes will be communicated to registered users by email at least 30 days before they take effect. The updated Privacy Policy will also be published on our website with the revised “Last updated” date.

Your continued use of the Services after any changes constitutes acceptance of the updated Privacy Policy.

17. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data processing practices, please contact us:

Pixadoro Ltd.
Blvd. Cherni Vrah 47, 1407, Sofia, Bulgaria
Company number: 206777328
VAT: BG206777328
Email: support@kukie.io
Website: kukie.io