Legal
Privacy Policy
What ConsentChecks collects, why, who sees it and how long we keep it.
Last updated 2026-11-01 — draft pending legal review
1. Who we are
ConsentChecks is a consent management service operated by [LEGAL ENTITY NAME], [REGISTERED ADDRESS] ("ConsentChecks", "we", "us"). You can reach us at [email protected].
We play two different roles, and this policy keeps them separate:
- Processor. For the visitors of our customers' websites, our customer decides why and how their data is used and we process it on their behalf.
- Controller. For our customers' account details, sign-ups, and this marketing site, we decide why and how data is used.
2. Data we process on behalf of customers (we are the processor)
When a website uses the ConsentChecks banner, we process the following about each visitor who interacts with it, in order to show the right banner and keep a record of the visitor's choices:
| Data | Purpose |
|---|---|
| A random visitor identifier (stored in the visitor's browser) | Link a visitor's consent records together and recognise a returning visitor. |
| Consent choices: action taken, categories granted or denied, policy version, timestamp | Apply the visitor's choice and provide the customer with an auditable consent log. |
| Country and region derived from the request | Choose the correct banner behavior (for example opt-in or opt-out) and report on consent by location. |
| Optional: city, when the customer enables it for a site | More specific geographic reporting. |
| Optional: a salted SHA-256 hash of the visitor's IP address, when the customer enables it for a site | Evidence that a visitor from a given network consented at a given time. |
| Optional: approximate coordinates at city level, when the customer enables geo detail for a site | Map and city-level reporting in the consent log detail view. Not a precise location. |
| Device information (browser, operating system, device type) | Part of the consent evidence record. |
| Page view counts per site per month | Plan usage reporting. Counts only, no visitor identity. |
We do not store raw IP addresses. The IP hash, where enabled, is pseudonymous personal data, not anonymous: the hash itself cannot be turned back into an address without the secret salt, but whoever holds the secret salt can test a known IP address against the stored hashes. That is its purpose, as evidence in a consent dispute. We keep the salt as a server secret, and we never use the hash to apply one visitor's consent to another or to look anyone up on our own initiative. The visitor's consent choice is also stored in a first-party cookie and browser storage on the customer's own website so the banner can remember it.
Customers are responsible for the lawful basis, notices and visitor rights requests for their own websites. If you are a visitor and want to exercise your rights, please contact the website operator first; we will help them respond. A data processing agreement is available on request.
3. Data we hold as controller
- Sign-ups. The name, company, email address and password you enter when you create an account at app.consentchecks.com. We use them to create and verify your account (we email a confirmation link) and to reply to you. Your password is stored only as a salted hash.
- Customer accounts. Name, email address, company, login credentials (passwords are stored hashed), role, plan and billing status, and the configuration you create in the service.
- Billing. Payments are handled by Stripe. We store Stripe customer and subscription identifiers and subscription status; we do not store card numbers.
- Support. Emails you send to [email protected] and our replies.
- Operational logs. Standard server logs needed to keep the service secure and running. The application's own request logs are configured not to record client IP addresses.
Our lawful bases are performance of a contract (providing the service you asked for), our legitimate interests (securing and improving the service, answering requests) and, where required, legal obligation.
4. This website
This marketing site sets no cookies, uses no analytics and loads no third-party trackers, fonts or scripts, and its web server keeps no access logs. The only data that leaves your browser is what you enter when you sign up, which happens on a page on our application server at app.consentchecks.com and not part of this site.
5. Subprocessors and recipients
| Provider | Role |
|---|---|
| DigitalOcean | Infrastructure hosting |
| Cloudflare | Network, DNS, caching and security |
| Stripe | Payment processing and subscription billing |
| Mailgun | Transactional email delivery |
| Google (Tag Manager API) | Read-only audit of a customer's Tag Manager container, only where the customer grants access |
We do not sell personal data. We will update this list when it changes.
6. International transfers
Our providers may process data outside your country, including in the United States. Where required we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.
7. Retention
- Consent logs are retained for the audit lifetime of the customer's account ([RETENTION PERIOD, to be confirmed with counsel]), because their purpose is to evidence past consent. Deleting a site in the dashboard does not by itself erase its historical logs; ask us in writing at [email protected] and we will delete them.
- Accounts that are never verified (you did not click the confirmation link) are deleted automatically after 7 days.
- Account data is kept while the account is open. On written request we delete it, except where we must keep it for legal, tax and accounting obligations.
8. Your rights
Depending on where you live, you may have the right to access, correct, delete, restrict or object to the processing of your personal data, to data portability, and to withdraw consent. Under GDPR you can also complain to your local supervisory authority. Under the CCPA/CPRA, California residents have the right to know, delete, correct, and opt out of the sale or sharing of personal information; we do not sell or share personal information. We will not discriminate against you for exercising your rights.
To exercise a right over data we hold as controller, email [email protected]. For data collected on a customer's website, contact that website operator.
9. Security
We use encryption in transit, hashed credentials, per-customer data isolation and access controls. No system is perfectly secure; if a breach affects your data we will notify you as the law requires.
10. Changes
We will post updates here and change the date above. For material changes we will notify customers by email.
11. Contact
Questions about this policy: [email protected]. Postal address: [REGISTERED ADDRESS].