# Cookies and tracking on demander.to

**DRAFT. Not legal advice. Review by counsel required.**

Last updated: [Date]. This notice covers demander.to, the website of [Legal entity] ("Demander", "we"). The Demander app is covered by our [privacy policy](privacy-policy.md). If you run the Demander tracking snippet on your own website, the notice for your visitors is a different document: [cookie-notice.md](cookie-notice.md).

How this works in the code: the banner is `apps/site/src/client/consent.ts`, the tracker is `packages/tracker` (strict consent mode, waiting for consent), and the server side is `packages/services/src/tracking.ts`.

## In short

- demander.to measures visits with Demander's own tracker, and only after you click **Accept** in the banner.
- Until you choose, and after you decline, the tracker does not load. Your browser sends it nothing, and nothing of it is stored on your device.
- demander.to sets no cookies and runs no analytics or advertising tools from other companies.
- You can change your choice at any time under **Cookie settings** at the bottom of every page.
- If your browser sends Global Privacy Control (GPC) or Do Not Track (DNT), the tracker keeps no ad click ids, even after you accept. GPC also stops company identification (see below).

## What is stored on your device

| Key | Storage | What | When and how long |
|---|---|---|---|
| `dmdr_consent` | localStorage | Your choice (accept or decline) and when you made it. No identifier. | When you choose. Kept 6 months, then the banner asks again. |
| `dmdr_a` | localStorage | A random visitor id | Only after you accept. Deleted when you decline. |
| `dmdr_s` | sessionStorage | A random id for this visit | Only after you accept. A new one after 30 minutes without activity; gone when you close the tab. |
| `dmdr_l` | sessionStorage | The campaign parameters of the page you arrived on: UTM parameters, and ad click ids such as `gclid` unless your browser sends GPC or DNT | Only after you accept, with the visit id. |
| `demander:snapshot` | sessionStorage | The snapshot you started and the address you entered, so a page reload does not lose it | Only when you start a snapshot. 1 hour, or until you close the tab. |

`dmdr_consent` and `demander:snapshot` are needed for what you asked for (remembering your choice, keeping your snapshot), so we store them without asking. Nothing else is stored before you accept.

## What the tracker records after you accept

- **Pages.** The pages you open on demander.to, with the time, the page you came from and the campaign (UTM) parameters in the address.
- **What you do on them.** The buttons that start a trial, a snapshot or a demo booking; the ad spend you try in the pricing calculator; links to other sites and downloads; how far you scroll; when you start and send a form. The tracker never reads what you type into a form.
- **Your browser's settings.** Language, time zone and window width.
- **Ad click ids** in the address you arrived at, for example `gclid` (Google), `msclkid` (Microsoft) or `li_fat_id` (LinkedIn). When a visit with a click id reaches a step we count as a conversion, we may report that step to the ad platform that showed you the ad, so it can measure the ad. Not kept when your browser sends GPC or DNT.

Accepting counts the page you are on from its start, including the buttons you used on it before you chose. Nothing from earlier pages is sent.

The records do not carry your name or e-mail address. The links from demander.to to sign-up carry campaign parameters (which page and campaign you came from), not your visitor id.

## Company identification

When the tracker sends a visit, our server looks up the company behind your IP address. It uses:

1. IP ranges that our own records already tie to a company;
2. the public registry record of the IP range (RDAP). The IP address is sent to rdap.org and the regional internet registry responsible for it;
3. reverse DNS;
4. [Optional providers: IPinfo, Dealfront or Snitcher], if we connect one. It receives the IP address and returns the company.

The result is a company, never a person. Home and mobile internet providers are recognised as such and give no company. We keep the company and a hash of your IP address made with a secret that changes every day; the full IP address is not stored with the visit. Our servers also log requests for security, as described in the [privacy policy](privacy-policy.md).

This runs only after you accept, and never when your browser sends GPC.

## Legal basis

- **Measuring visits, company identification and ad click ids:** your consent (GDPR Art. 6(1)(a)). Storing and reading the identifiers on your device also needs your consent under the ePrivacy rules (Directive 2002/58/EC, Art. 5(3), as applied in [National law, such as Czech Act 127/2005 Coll., § 89(3)]).
- **Remembering your choice and your snapshot:** strictly necessary for what you asked for, so no consent is needed; we rely on our legitimate interest in showing that we asked (GDPR Art. 6(1)(f) and Art. 7(1)).

## How long we keep it

| Data | Retention |
|---|---|
| Your choice in your browser | 6 months, then the banner asks again |
| Visit records (pages, events, campaign parameters, company, daily IP hash) | [Retention period, for example 13 months] |
| IP ranges tied to a company | Deleted after 180 days without new evidence |

## Who receives it

- Demander runs the tracker and stores the records on its own servers, hosted by Hetzner Online GmbH in the EU [Confirm].
- rdap.org and the regional internet registries receive the IP address for the registry lookup.
- [Optional providers: IPinfo, Dealfront or Snitcher], if we connect one, receive the IP address.
- The ad platform whose ad brought you receives a conversion with its click id, only after you accepted, and never with GPC or DNT.

## Changing your mind

- Click **Cookie settings** at the bottom of any page and choose **Decline**. The tracker stops on the page you are on and in your other open demander.to tabs, also on a page you go back to, deletes `dmdr_a`, `dmdr_s` and `dmdr_l` from your browser, and does not load again.
- Clearing your browser's site data for demander.to also removes your choice; the banner then asks again.
- To have the visits we recorded deleted, write to [Privacy contact e-mail]. The records carry no name, so we may ask for details that let us find them, such as the time of your visit.

Your other rights (access, objection, complaint to a data protection authority) are in section 10 of the [privacy policy](privacy-policy.md).

## Notes for counsel and for whoever runs demander.to

- **One choice for both purposes.** The banner asks once for measuring visits and for company identification with ad click ids. Confirm that one choice is acceptable, or the banner needs a separate choice per purpose.
- **Do Not Track.** With DNT the tracker keeps no ad click ids and sends no marketing consent. Whether the server still identifies the company then depends on the demander.to workspace's setting "Legitimate-interest assessment (LIA) completed" (Governance): with it off, DNT stops identification too; with it on, only GPC does. The notice above promises only the GPC part, so it holds either way.
- **Retention.** Demander does not yet delete visit records on a schedule. Until it does, delete them by hand at the end of the period stated above.
- **Language.** The banner is translated (English, German, Czech, French, Spanish); this notice and the privacy policy are in English only.
- **The site's settings.** Build the site with `SITE_TRACKER_KEY` set to the key of the Demander workspace's site for demander.to (docs/SITE.md, "Consent and the site's tracker"). Without the key there is no tracker and no banner, and this notice describes nothing that runs.

---
Source: https://demander.to/legal/site-cookies/