Privacy policy
Last updated: October 2026 (draft for legal review)
ikuad processes very little data, and writes down exactly what it does with it. This policy covers ikuad.com and its accounts.
What we collect
Your account: name, email, a hashed password, the account country and language. Usage: banner view counts and record counts — aggregate numbers, no individuals. Consent records: as documented — your site, the banner version, category answers, time, country and a random id. No IP address in any record.
Cookies on this site
Before your consent: nothing at all — no third-party fonts, no measurement. After your consent from our banner: your choices in our own first-party cookie, and whatever analytics you consented to, when any exists. You can reopen the choice from the bottom of every page.
Legal basis
Contract performance to run your account; consent for everything optional on your site and ours; legitimate interest for security and de-identified operations logs; legal obligation to keep records for their statutory term.
Location and cross-border
The service runs in the European Union (Amsterdam) with storage in France (OVH Gravelines). Visitor data of our customers' sites holds no IP address and no direct identifier; transfers rest on the appropriate basis under the Saudi PDPL for customers subject to it, and under GDPR for those subject to that.
Retention
Consent records: five years from their date (extendable at your request, never shortenable). Free scan reports: 30 days. Operations logs: 13 months. Your account: while active, then 30 days before deletion.
Your rights
Access, rectification, erasure and objection to optional processing — from your dashboard or by writing privacy{'@'}ikuad.com. Deleting your account does not touch your site's consent archive: it stays anonymised proof until its term ends, which is the very purpose it was collected for.
Sharing
We sell nothing and share no data for advertising. Processors, narrowly: hosting (Railway, Europe), storage (OVH), edge and protection (Cloudflare), and a merchant-of-record for direct checkout — all under restricted processing agreements.