SmartCookie is a cookie consent banner for websites, made and operated by Webup! S.C. (“we”). This policy covers three separate groups of data, and they are genuinely separate — so each has its own section: data of the people who buy SmartCookie, data of the visitors to their websites, and data we receive from Google APIs when a customer chooses the Google Tag Manager installation route.
The controller of the data described in sections 2 and 4 is Webup! S.C., Staromiejska 6/10d, 40-013 Katowice, Poland, NIP 9542811219, contact [email protected]. For the visitor data described in section 3 we act as a processor on behalf of the website owner who installed SmartCookie — they decide what the banner asks about, and they are the controller of that data.
The seller is a different entity from the controller — Webup! Inc. The conditions of sale are set out in the terms of sale; the data controller remains Webup! S.C.
To sell and run the service we process: your name or organisation name, e-mail address, the address of the website the banner runs on, invoicing data and payment history. The legal basis is performance of the contract (Art. 6(1)(b) GDPR) and, for invoices, our legal obligation (Art. 6(1)(c) GDPR). Invoicing data is kept for the period required by Polish tax law; everything else for as long as the service lasts.
Payments are handled by Stripe Payments Europe Ltd. We never see or store your card number.
When a visitor makes a choice in the banner, one record is written. This is the complete list of what it contains — there is nothing else in it:
| What | Why |
|---|---|
A random consent identifier, kept in the _sc_uid cookie | To tie a later change of mind to the earlier decision. It is generated only once the visitor has made a choice — before that, the cookie does not exist. |
| The domain of the website | To attribute the record to the right website owner. |
| The choice itself: accepted / rejected / saved selection, and the three category switches (preferences, statistics, marketing) | This is the evidence of consent that GDPR requires the website owner to be able to produce. |
| A one-way SHA-256 hash of the IP address | To spot abuse and to count a visitor once. We store the hash, not the address — but we do not call it anonymous: a hash of an IP address is still, in law, data relating to a person. |
| Date and time, and whether this was the first decision on this device | Required for the record to be evidence at all. |
The banner does not record the visitor’s name, e-mail address, the page they were reading, their browser fingerprint or their behaviour on the site. It does not profile anyone and it is not an analytics tool.
Consent records are kept for as long as the website owner uses SmartCookie, because they are that owner’s evidence, and for no longer than 12 months after the service ends. A website owner can ask us to delete the records for their domain at any time.
This section applies only if you chose to install SmartCookie through Google Tag Manager and signed in with your Google account. If you installed the banner with a snippet or the WordPress plugin, we receive no data from Google at all.
What we ask for and why:
| Scope | What we do with it |
|---|---|
tagmanager.manage.accounts | Read the list of your Tag Manager accounts and containers, so you can pick the website this is about. |
tagmanager.edit.containers | Add one tag — the SmartCookie banner — on the Consent Initialization trigger in the container you picked. |
tagmanager.edit.containerversions | Create a container version holding that change, so it stays in your container’s history and can be reverted. |
tagmanager.publish | Publish that version, which is what makes the banner live on your site. |
Limited Use. SmartCookie’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
From your Google account we receive and store: the e-mail address of the account you signed in with, the identifiers and names of the Tag Manager account and container you selected, and an authorisation token that lets us perform the four operations above. We store them in our database on a server located in the European Union, with access limited to the administrators of the service.
We do not read the contents of containers you did not select. We do not modify or delete your other tags, triggers or variables. We do not use this data for advertising, we do not sell it, we do not transfer it to anyone, and we do not use it to train artificial intelligence or machine learning models. No human reads it except where you ask us for support, where it is required to resolve a security incident, or where the law requires it.
How to cut off the access and have the data deleted:
Only the suppliers we need to run the service: our hosting provider (servers in the European Union), Cloudflare, Inc. as the network layer in front of them, Stripe Payments Europe Ltd. for payments, and Google Ireland Ltd. in the scope described in section 4. We do not share data with anyone else, and we do not sell it.
You have the right of access, rectification, erasure, restriction of processing, data portability and objection, and the right to lodge a complaint with the Polish supervisory authority (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa). Write to [email protected] — we answer within 30 days. If you are a visitor to a website that uses SmartCookie and your request concerns the consent record, write to the owner of that website; we will help them handle it.
This website runs SmartCookie — the very banner we sell. Below is the complete list of what this site stores in your browser.
| What | What for, and how long |
|---|---|
sc_lang | The language you chose. Functional — without it, clicking “EN” would not survive a move to another page. One year. |
sc_offer | Just your organisation’s domain, when you arrive from a link in our e-mail — so the price worked out for you does not vanish the moment you click something. It holds no amount and nothing about you personally. 30 days. Opening smartcookie.io/?d= with an empty value clears it on the spot. |
Your choice in the banner and _sc_uid | Created only once you click in the banner — so we do not ask you twice, and so a later change of mind can be tied to the earlier choice. |
From other servers we load three things and only three: typefaces from Google Fonts, the Google Tag Manager container (that is how our own banner gets here) and Stripe at the moment you go to pay. There is no analytics on this site — no Google Analytics, no advertising pixels, no heat maps. A product about consent that quietly loaded third-party scripts would be making our own point for us.
If this policy changes, the date at the top changes with it, and customers are told by e-mail before a change that affects them takes effect.