Legal
Privacy Policy
Last updated: 22 Sep 2026
1. Who We Are
Pritect Beacon is operated by White Label Consultancy AS, a company registered in Norway (organisation number 923 308 547). We are the data controller for personal data collected through this website and the Beacon platform itself. For consent records collected on our customers' websites we act as a processor on behalf of each customer, under our Data Processing Agreement. That includes the country lookup we perform on a visitor's IP address and the scans we run of each customer's website. Consent records from the cookie banner on this website are our own, and for those we are the controller.
Contact: privacy@pritect.ai
2. Data We Collect
We collect the following categories of personal data:
- Account data: Name, email address, organisation name, and billing information provided during registration.
- Usage data: Log data, IP addresses, browser type, pages visited, and feature interactions within the dashboard.
- Consent records: When you deploy Pritect Beacon on your site, we store consent decisions on your behalf: a pseudonymised session ID, a keyed HMAC of the visitor's IP address (never the address itself), country, regulation applied, categories accepted or rejected, user agent, page URL and timestamp. This data is pseudonymised, not anonymised: it can still relate to an identifiable visitor.
- Communication data: Emails and support messages you send us.
3. Legal Basis for Processing
We process your personal data on the following legal bases:
- Contract: To provide and manage the Service you have subscribed to.
- Legitimate interests: To improve the Service, prevent fraud, and ensure security.
- Legal obligation: To comply with applicable laws and regulations.
- Consent: For optional communications such as newsletters (where applicable).
4. How We Use Your Data
We use your data to:
- Provide, operate, and maintain the Pritect Beacon Service
- Process payments and send billing communications
- Respond to support requests and inquiries
- Send product updates and security notices
- Comply with legal obligations
- Detect and prevent fraudulent or abusive activity
5. Data Sharing
We do not sell your personal data. We share data only with the sub-processors needed to deliver the Service. This register is the complete list, and it is the same list our Data Processing Agreement uses:
| Sub-processor | Purpose | Personal data | Location | Transfer mechanism |
|---|---|---|---|---|
| Supabase Inc. | Database, authentication, file storage and edge functions | Account data, consent records (pseudonymised session ID, keyed HMAC of the IP address, country, user agent, page URL, decisions), data subject requests | EU (Ireland, eu-west-1); provider headquartered in the USA | EU Standard Contractual Clauses |
| Vercel Inc. | Hosting of the Beacon website, dashboard and API routes | Account data and request metadata (IP address, user agent) of dashboard users and website visitors | USA, with a global edge network | EU Standard Contractual Clauses |
| Fly.io, Inc. | Cookie scanner: loads the customer's website in a headless browser | URLs of the customer's pages and the cookies, storage and scripts observed on them. No visitor data | Germany (Frankfurt, EU) | EU Standard Contractual Clauses |
| Functional Software, Inc. (Sentry) | Error monitoring for the Beacon website and dashboard | Error reports with browser, page URL and request metadata of dashboard users | USA | EU Standard Contractual Clauses |
| Kloudend, Inc. (ipapi.co) | Country lookup for jurisdiction detection, used only when the CDN supplies no country header | The visitor's IP address, for that single request. Nothing is stored | USA | Under review; not yet covered by a signed agreement |
| Mistral AI SAS | AI classification of detected cookies and trackers, and remediation guidance | Cookie, script and tracker names and domains found by scans, and the scanned domain name. No visitor data | France (EU) | Not applicable (EEA) |
| Stripe, Inc. | Payment processing and invoicing | Billing contact and payment details of customers. No consent data | USA | EU Standard Contractual Clauses |
| Resend, Inc. | Transactional email delivery | Email addresses and message content of dashboard users and of people who submit a data subject request | USA | EU Standard Contractual Clauses |
We give customers at least 30 days' notice before engaging a new sub-processor.
6. Data Retention
We retain account data for as long as your account is active. After account closure, billing and accounting records are kept for as long as the Norwegian Bookkeeping Act requires, and other account data for up to 2 years. Consent records are retained for 5 years from the date of collection, so that the website owner can demonstrate that consent was given (Article 7(1) GDPR) for as long as that consent may be questioned by a supervisory authority or the visitor, and are then deleted automatically. A website visitor who wants their consent records erased earlier can ask the website owner, who can erase them through Beacon's data subject request tools. You may request deletion of your own account data at any time (see Your Rights below).
7. Your Rights
Under GDPR and applicable privacy laws, you have the right to:
- Access the personal data we hold about you
- Correct inaccurate data
- Request erasure of your data
- Restrict or object to processing
- Data portability
- Withdraw consent at any time (where processing is based on consent)
- Lodge a complaint with your national data protection authority
To exercise these rights, contact privacy@pritect.ai. We will respond within 30 days.
8. Cookies
This website uses strictly necessary cookies to maintain your session and authentication state. We do not use analytics or advertising cookies on the Pritect Beacon marketing site without your consent.
9. International Transfers
Several of our sub-processors are established in, or process data in, the United States. The register in section 5 states where each one processes data and which transfer mechanism applies. Where personal data is transferred outside the European Economic Area (EEA), we rely on the Standard Contractual Clauses approved by the European Commission, as listed for each sub-processor: Module 2 (controller to processor) for personal data we control, such as account data, and Module 3 (processor to processor) for consent records we process on behalf of our customers.
10. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated to you via email or a prominent notice in the dashboard. Continued use of the Service after changes constitutes acceptance of the updated policy.
11. Contact
For privacy-related enquiries, contact our privacy team at privacy@pritect.ai. Our registered address is Oslo, Norway.