Where your data lives, what we keep and when we delete it
Written for DPOs and privacy teams. If you’re asked how Observary handles consent records, the answers are on this page.
- Hosted in the EU: Ireland and Frankfurt
- No IP addresses in the consent log
- Deleted on a fixed schedule
Hosted in the EU: Ireland and Frankfurt
Customer data is stored and processed in EU regions. Scans run from Frankfurt, and the database and the dashboard run in Ireland.
- The consent banner script itself is delivered through Cloudflare’s global network, so visitors load it from a server near them.
- This website follows the advice we give: no trackers, no analytics and no fonts loaded from other companies’ servers.
Where each part runs
- DatabaseIreland
- Dashboard and web functionsDublin, Ireland
- Scan workersFrankfurt, Germany
- Banner script deliveryCloudflare’s global network
What the consent log stores
Enough to show what each visitor was asked and what they chose. Not enough to identify them.
Stored with every decision
- The categories accepted
- How the visitor chose: accept all, reject all or custom
- The banner version and the cookie declaration version they could see
- Language, page path and country
- A visitor ID, stored only as a keyed hash
Never stored
- IP addresses
- User agents
- Raw visitor IDs
Each visitor can see their consent ID in their cookie preferences. With it, you can find their records when they ask. The full log exports as CSV.
Retention and deletion
Data is deleted on a fixed schedule, automatically. Nothing is deleted at the moment a subscription stops.
| Data | Kept for |
|---|---|
| Consent log on Starter | 12 months, then deleted |
| Consent log on Pro and up | 36 months, then deleted |
| Findings | 24 months, then deleted |
After cancellation or non-payment
- Day 0Subscription stops
Nothing is deleted. Owners can still export everything.
- Day 60First warning
A warning email: the data will be deleted in 30 days.
- Day 83Last warning
A second email, 7 days before deletion.
- Day 90Data deleted
The organisation’s data is removed.
Moving to a smaller plan never deletes data. Websites over the limit are paused, not removed.
An audit trail you don’t have to keep yourself
What changed, who changed it and what visitors saw at the time.
-
Every declaration version
Each version of your cookie declaration is kept with a diff, and each consent record points at the version that visitor could see. Download any version as PDF or CSV.
-
Classifications with reasons
Manual classifications need a written justification and are kept in an append-only history, with the author. Export them as CSV.
-
Banner changes logged
The banner has drafts and published versions, and every change is logged.
-
Drift history kept
Archiving an alert only hides it for you. The drift timeline itself is never deleted, so it shows that monitoring ran.
-
Three roles
Owners, managers and read-only members. Only owners change roles or manage other owners.
-
Your data, any time
Owners can export every domain’s consent log, report and CSVs whenever they want, including after a subscription stops.
A tool, not legal advice. Observary helps you find and fix consent problems and keeps records of what you did. It doesn’t make a website compliant on its own. Questions from your DPO? Email hello@observary.app.
See what your website does before consent
Your first scan is included once your plan is active.