Privacy Policy

This policy explains which personal data is processed when you visit this website. In short: we host on Cloudflare, we use no third-party analytics or advertising services, and we store your cookie decision with our own consent tool consentdone — the very software demonstrated on this page.

1. Controller

Meikel Korfmacher
Fährstraße 179
40221 Düsseldorf, Germany
Email: meikel@korfmacher.at

2. Hosting (Cloudflare)

This website is delivered via Cloudflare Pages and Cloudflare Workers (Cloudflare Germany GmbH, Rosental 7, 80331 Munich, as the local establishment of Cloudflare, Inc., USA). When you access the pages, Cloudflare processes your IP address as well as date, time, requested URL, referrer and browser identifier (server logs) as technically necessary to deliver the site and to fend off attacks. Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in secure, performant operation). Cloudflare is certified under the EU-US Data Privacy Framework; standard contractual clauses apply in addition. Details: Cloudflare privacy policy.

3. Consent management (consentdone)

We use our own consent tool consentdone to obtain and manage your cookie consent. Your decision is stored locally in your browser (local-storage entry cc_cookie, retention 182 days). This storage is technically required to provide the service (Section 25 (2) no. 2 of the German TDDDG).

To be able to prove given or refused consent (Art. 7 (1) GDPR), the tool transmits a consent record to our consent API (api.c-done.com, running on Cloudflare Workers) when you make your choice: a randomly generated consent ID, the selected categories, banner revision, timestamp, device type (desktop/tablet/mobile) and a SHA-256 hash of your IP address and browser identifier. The IP address itself is not stored. Legal basis: Art. 6 (1) (c) GDPR (obligation to demonstrate consent) and Art. 6 (1) (f) GDPR (legal defence).

You can change or withdraw your choice at any time via the floating cookie button in the bottom left corner; withdrawal takes effect for the future.

4. Demo cookie (only with consent)

This website demonstrates how consentdone works. If you consent to the "Marketing" category, the page sets a harmless demonstration cookie (cd_demo_marketing, retention 30 days). It contains no tracking whatsoever and only serves to show how cookies are set and automatically cleared after withdrawal. Legal basis: Art. 6 (1) (a) GDPR, Section 25 (1) TDDDG. The cookie is removed automatically when you withdraw consent.

Cookie overview

The following overview is generated automatically from our banner configuration and therefore always matches the cookie banner:

5. No third-party analytics or advertising

This website does not embed any third-party analytics, tracking or advertising services. No profiling and no automated decision-making takes place.

6. Contact

If you contact us by email, we process your details to handle the enquiry (Art. 6 (1) (b) or (f) GDPR). The data is deleted as soon as it is no longer required for processing and no statutory retention obligations apply.

7. Platform: privacy for account holders

The following additionally applies if you create a consentdone account and use the platform (app.consentdone.com).

Account and registration

Upon registration we process your name, email address, password (stored exclusively as a cryptographic hash) and the requested domain, plus a technically required session cookie for session management. Legal basis: Art. 6 (1) (b) GDPR. Data is retained until you delete your account — which you can do yourself at any time in the settings, including a prior full data export (data portability).

Transactional emails (Resend)

Registration confirmations, login links and change confirmations are sent via Resend (Resend, Inc., San Francisco, USA). Your email address and the message content are transferred to the USA; the transfer is safeguarded by a data processing agreement including EU standard contractual clauses. Legal basis: Art. 6 (1) (b) GDPR. No marketing emails are sent.

Storage and infrastructure (Cloudflare)

Account data, banner configurations and consent records are stored on Cloudflare infrastructure (Workers, D1), encrypted in transit and at rest — section 2 applies accordingly (data processing agreement, EU-US Data Privacy Framework, standard contractual clauses).

Automatic translation (DeepL)

If you use the automatic translation in the configurator, we transmit only your banner texts (no account, consent-record or visitor data) to DeepL SE, Maarweg 165, 50825 Cologne, Germany (EU processing). Translation happens only upon your manual request; under the DeepL API terms, submitted texts are not used to train models. Legal basis: Art. 6 (1) (b) GDPR.

Payment data

None at present: the platform is a free beta and no payment provider is connected. This policy will be updated before paid plans are introduced.

Roles regarding consent records of your website visitors

For consent records generated by the banner on your website about your visitors' decisions (consent ID, categories, revision, timestamp, device type, browser family, country, SHA-256 hash of IP and user agent — the IP itself is not stored), you as the website operator are the controller under the GDPR. We process this data solely on your instructions as a processor (Art. 28 GDPR); details are set out in the Terms of Use.

8. Your rights

You have the following rights regarding your personal data: access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection to processing based on legitimate interests (Art. 21). You may withdraw given consent at any time with effect for the future (Art. 7 (3)). You also have the right to lodge a complaint with a data protection supervisory authority, e.g. the Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (ldi.nrw.de).

9. Changes to this policy

We will update this privacy policy whenever the processing on this website changes. Last updated: July 28, 2026.