Free whiteglove setup from a ConsentStack Concierge

Privacy Policy

Last updated:

Summary of Key Points

  • ConsentStack LLC is a consent management platform based in Laguna Hills, California.
  • This Privacy Policy covers data we collect as a controller: when you visit our website, use our dashboard or our free tools (such as the compliance scanner), subscribe to our newsletter, join our partner program, or contact us.
  • Data we process on behalf of our customers through the ConsentStack platform (such as consent records about visitors to our customers' websites) is governed by our Data Processing Agreement, not this policy.
  • We do not sell your personal information for money. Some advertising tools on our website count as "sharing" under California law, and you can opt out at any time.
  • We use data to improve our services, including to train AI and machine learning models, only after it has been aggregated and de-identified. We do not train models on data that identifies you.
  • The latest compliance scan report for each website is public at that website's report address.
  • You can manage your cookie preferences at any time with "Your Privacy Choices" in our website footer.
  • You have rights over your personal data. See Section 8 and the Regional Disclosures in Section 11.

1. Introduction and Scope

This Privacy Policy explains how ConsentStack LLC ("ConsentStack," "we," "us," or "our") collects, uses, shares, and protects personal information when you:

  • Visit our website at consentstack.io
  • Use the ConsentStack dashboard, our APIs or our MCP server
  • Use our free tools, such as the compliance scanner, its AI summary and chat, and the AI assistant in our documentation
  • Subscribe to our newsletter, claim an offer, or ask us to call you
  • Join our partner program, or arrive through a partner's referral link
  • Submit a contact form, chat with us, or book a call with us
  • Otherwise interact with us

What this policy does not cover: Data processed through the ConsentStack platform on behalf of our customers, including consent decisions collected by our SDK on customer websites, is handled in our capacity as a data processor (a "service provider" under California law). That processing is governed by our Data Processing Agreement, which forms part of our agreement with each customer. If you visited a website that uses ConsentStack and have a question about your data, please contact that website's owner; if you contact us instead, we will pass your request on to them. This Privacy Policy applies only to data we collect and control directly.

ConsentStack LLC is the data controller for the personal information described in this policy.

ConsentStack LLC

23046 Avenida De La Carlota, Suite #600

Laguna Hills, California 92653, USA

2. Information We Collect

Information You Provide Directly

  • Account registration: Your name, email address, and company or team (workspace) name when you create an account. If you invite someone to a workspace, we store their email address to send the invitation.
  • Billing information: Payment processing is handled by Stripe. We do not store your credit card details. Stripe provides us with subscription status and billing details such as the billing email address. When you start a checkout, we attach your browser's user agent, your IP address, your Google Analytics browser ID (if one is set) and your marketing choice to the Stripe checkout session, so the purchase can be measured as described under "Advertising and Conversion Measurement" below.
  • Terms acceptance: When you accept our Terms of Service, we record which version you accepted, when, how you accepted it (in the dashboard, through a notice in the dashboard, when connecting an AI assistant through our MCP server, or when accepting an invitation), and your browser's user agent.
  • Business Associate Agreement: If you accept our HIPAA Business Associate Agreement for a site, we record the signer's name, title and email address, the legal entity, the agreement version, the time, and the IP address and browser user agent used to accept it.
  • Contact form: Your name, email address, and message.
  • Support and sales conversations: What you tell us by email, in the chat on our website, and when you book a call with us (your name, email address, and anything you add to the booking).
  • Newsletter: Your email address, only if you subscribe, either with the form in our website footer or by ticking the newsletter box when you claim a scan offer.
  • Scan offers: If you claim a discount code from a compliance scan report, your email address, the website that was scanned, and the code we issue you.
  • Call requests: If you ask us to call you from a scan report, your phone number, your first name if you give it, and the website that was scanned.
  • Partner program: If you join our partner program, your acceptance of the Partner Program Terms, your referral links, and your payout settings. Stripe collects the identity, tax and bank details it needs to pay you (see "Information from Third Parties").
  • Site configuration: Domain names, consent banner settings, policy generator answers, and other settings you configure in the dashboard.

Information Collected Automatically

  • Device and browser information: Browser type and version, operating system, screen resolution, and device type.
  • IP address: Used for security, rate limiting, and to determine your approximate location (country and region or state) for regulatory compliance purposes. Where we keep a record of an IP address for usage limits or visit counts (the scanner's AI features, call requests, and the referral and AI-assistant visit records described below), we store only a salted hash of it, not the address itself.
  • Usage data: Pages visited, time spent on pages, referrer URLs, click paths, and when you last used the dashboard.
  • Cookies and similar technologies: See Section 5.
  • Analytics: On our website and dashboard we use Google Tag Manager and Google Analytics, and Microsoft Clarity, which records sessions (clicks, scrolling and what is shown on the page) and builds heatmaps. On the dashboard, our customers' consent records and analytics are hidden from Clarity's recordings. Our Google Tag Manager container also loads Google Ads conversion tracking (see "Advertising and Conversion Measurement" below).
  • Consent interaction data: When you interact with the ConsentStack consent banner on our own website, we collect a pseudonymized visitor identifier (SHA-256 hashed), your consent choices by category, interaction type, time to respond, banner position, the page address (without any query string), browser, operating system and device type, language, your country and region or state (not your city or precise location), and whether your browser sent a Global Privacy Control signal. Our banner also reports which cookies and scripts load on our pages, with the page path and a hashed visitor identifier, so we can keep our own tracker list current.
  • Referral visits: If you arrive through a partner's referral link, we record the visit: the partner's link, the website that sent you, your browser's user agent, and a salted hash of your IP address that changes every day. We also set a cookie that credits the partner if you create a workspace (see Section 5).
  • Visits from AI assistants: If you arrive at our website from an AI assistant (such as ChatGPT, Claude, Perplexity, Copilot, Gemini or Grok), we record the visit: the page, the assistant, the referring site, your browser's user agent, your country, and a salted hash of your IP address that changes every day.

Advertising and Conversion Measurement

  • Advertising pixels: The Meta pixel (on our website and dashboard) and the OpenAI ads pixel (on our website) measure visits and actions, such as completing a scan, claiming an offer, or creating an account, so we can measure and improve our ads. They run only when our consent banner allows marketing (see Section 5).
  • Meta Conversions API: When you create an account or buy a plan, our servers send Meta a hashed (SHA-256) form of your email address, your IP address, your browser's user agent, Meta's browser identifiers (the "_fbp" and "_fbc" cookies) if present, the page address, and for a purchase the plan and amount. We send these events only when our banner shows that marketing is allowed for you.
  • OpenAI Conversions API: When you create an account, our servers send OpenAI a hashed form of your email address, your account ID, and the page address. We send this event only when you allowed marketing on our website before signing up.
  • Google Ads: Our Google Tag Manager container runs Google Ads conversion tracking on our website and dashboard. It records when a visit from a Google ad leads to an action such as running a scan, booking a demo or creating an account. With Google's enhanced conversions, it also sends Google a hashed (SHA-256) form of the email address you enter in a form, so Google can match the action to a Google account. Our consent banner controls these tags through Google Consent Mode: until marketing is allowed, they set no advertising cookies and send no hashed email. Google may still receive limited signals without cookies, which it uses to estimate conversions.
  • Google Analytics server events: When you buy a plan, change plans or cancel, our servers send Google Analytics a subscription event with your account ID, the plan, the price, and the first-visit details saved with your account (see "_cs_ft" in Section 5). The event is linked to your Google Analytics browser ID only if Google Analytics was allowed to set one.

When You Use the Compliance Scanner

  • The website you submit, and what the scan finds: the public technical behavior of that website, such as which trackers and cookies load and when, and whether a consent banner is present. Scans run in a real browser on our servers in the United States and Europe.
  • A browser check: Cloudflare Turnstile checks that a scan was started by a person. Cloudflare processes your IP address and browser information for this check.
  • Where you started the scan: your approximate location (city, region and country), worked out from your IP address. We do not store your IP address with the scan.
  • How you arrived: the page where you first arrived on our website, the website that referred you, and any campaign tags (UTM parameters) and ad click IDs (from Google, Meta or Microsoft) in the link you followed. If you allowed marketing, these come from the first-visit cookie described in Section 5; otherwise, only from your current visit.

The AI summary and chat on scan reports are described in "AI Features" at the end of this policy.

Information from Third Parties

  • Google OAuth: If you sign in with Google, we receive your name, email address, and profile picture from Google.
  • Stripe: We receive payment status information (subscription state, plan details) from Stripe. We do not receive your credit card number. If you are a partner, Stripe tells us whether your Stripe account has finished verification and can receive payouts. Stripe holds your bank and tax details; we do not store them.
  • HubSpot: If you connect your HubSpot account to a site, we receive your HubSpot portal ID and account domain from HubSpot, along with your portal's website domain list and an OAuth token that authorizes us to read that domain list.
  • Referral partners: If you arrive through a partner's referral link, or a partner (such as an agency) creates your workspace, we record which partner referred the workspace.
  • Business contact information: We may collect business contact details (such as a company name, website, and work email address) from public sources and business data providers, to contact businesses that may benefit from ConsentStack. You can ask us to stop contacting you at any time.

3. How We Use Your Information

We use your personal information for the following purposes:

  • Provide and maintain our services: Account management, dashboard access, and consent configuration. Legal basis (GDPR): Contract performance.
  • Process payments: Billing, invoices, and subscription management via Stripe. Legal basis: Contract performance.
  • Communicate with you: Responding to support requests, and sending service notices, usage alerts, and payment notifications. Notices of changes to our Terms of Service go to every account email address and to each workspace's billing email. These are service notices, not marketing. Legal basis: Contract performance and Legitimate interest.
  • Send marketing communications: Our newsletter, and the code and reminders for a scan offer you claim. You can unsubscribe at any time. Legal basis: Consent.
  • Run our free tools: Scanning websites, publishing scan reports, generating AI summaries and answering chat, and calling you back when you ask us to. Legal basis: Legitimate interest, and steps you ask us to take.
  • Run the partner program: Crediting referrals, calculating and paying commissions, and showing partners their referrals. Legal basis: Contract performance.
  • Measure and improve our marketing: Analytics, advertising pixels, server-side conversion events, first-visit attribution, and inviting customers to review us on Trustpilot. Legal basis: Consent where the law requires it, otherwise Legitimate interest.
  • Improve our services: Usage analytics and performance monitoring to understand how our products are used, and aggregated, de-identified data as described below. Legal basis: Legitimate interest.
  • Translate content: Automatically translating consent banner content into multiple languages via DeepL on behalf of dashboard users. Legal basis: Contract performance.
  • Sync connected platforms: Importing your website domains from platforms you connect, such as HubSpot, and keeping them up to date with an automatic daily sync while the connection is active. Legal basis: Contract performance.
  • Determine applicable privacy regulations: Using your approximate geographic location (derived from IP address) to apply the correct consent model for your jurisdiction. Legal basis: Legal obligation and Legitimate interest.
  • Ensure security: Fraud prevention, rate limiting, and abuse detection to protect our services and users. Legal basis: Legitimate interest.
  • Keep records of agreements: Records of your acceptance of our Terms of Service and, where you sign one, our Business Associate Agreement, as evidence of what was agreed. Legal basis: Legitimate interest and Legal obligation.
  • Comply with legal obligations: Maintaining tax records, responding to legal proceedings, and fulfilling regulatory requirements. Legal basis: Legal obligation.

Compliance Scanner, Public Reports and Research. When you use our free compliance scanner, we record the public technical behavior of the website you submit. The latest report for each scanned website is public: anyone who visits that website's report address (consentstack.io/compliance-scanner/ followed by the domain) can see it, and reports are often shared. We ask search engines not to index these reports, except reports on our own websites. We may also publish findings derived from scans in aggregate and de-identified form as research (for example, the share of scanned sites that load trackers before a visitor consents). You should only scan a website you own, are authorized to test, or are evaluating for a legitimate purpose. If you own a website and want its report corrected or removed, contact us at [email protected].

Aggregated and De-identified Data

We may combine data into aggregated, de-identified form, meaning it can no longer reasonably be linked to you, your organization, or any other person. We use that data to improve our services, to publish research and benchmarks, and to train AI and machine learning models. We take reasonable measures to keep it de-identified, we do not try to re-identify it, and we require anyone we share it with to do the same. Data we process for our customers (such as consent records) is only ever used for these purposes in that aggregated, de-identified form.

What We Do Not Do

  • We do not sell your personal information for monetary consideration.
  • We do not train AI or machine learning models on data that identifies you.
  • We do not build advertising profiles from your data.
  • Advertising pixels and server-side conversion events on our website may constitute "sharing" of personal information under California law (CCPA/CPRA). You can opt out of this sharing at any time with "Your Privacy Choices" in our website footer.

4. How We Share Your Information

Service Providers

We share personal information with the following service providers who help us operate our business:

  • Supabase: Database hosting and authentication.
  • Vercel: Website and dashboard hosting, and Vercel AI Gateway, which routes requests to our AI provider.
  • Cloudflare: Content delivery, DNS, security and rate limiting, delivery of our SDK and hosted policies, bot checks (Turnstile), and parts of our service that run on Cloudflare's network, including the compliance scanner.
  • DigitalOcean: Servers that run compliance scans.
  • Stripe: Payment processing and subscription billing, and partner commission payouts (Stripe Connect).
  • Resend: Email delivery (account emails, notifications, invitations, offers, and support replies).
  • Textbelt: Text message alerts to our team when someone asks us to call them. Each alert contains the first name and phone number given, the website, and its scan score.
  • Anthropic: AI model provider for compliance scan summaries and chat, reached through Vercel AI Gateway.
  • Inkeep: The AI assistant in our documentation search.
  • DeepL: Content translation for multi-language consent banners.
  • HubSpot: The chat on our website.
  • Cal.com: Booking demo and setup calls.
  • Trustpilot: Review invitations. We may send Trustpilot a customer's name, email address, and a reference so it can invite them to review us.
  • Sanity: Content management for our marketing site. Sanity serves content only and does not receive user personal data.
  • Google: Google Tag Manager and Google Analytics, for website and dashboard analytics, and Google Ads conversion tracking, for advertising measurement.
  • Microsoft: Microsoft Clarity, for session recordings and heatmaps.
  • Meta: The Meta pixel and the Meta Conversions API, for advertising measurement.
  • OpenAI: The OpenAI ads pixel and the OpenAI Conversions API, for advertising measurement.

Google, Meta and OpenAI use the data they receive from their advertising tools under their own privacy policies.

Referral Partners

If you arrive through a partner's referral link, or a partner (such as an agency) creates your workspace, that partner is credited with your workspace. The partner can see your workspace's name, its plan and whether it has a paid subscription, when it was referred, the commission rate, the email addresses of the workspace owner and the billing contact, and the commission earned on each paid invoice. Partners may use this information only to manage their referrals and support their clients, and must protect it under our Partner Program Terms.

Your Workspace

Members of a workspace can see each other's names, email addresses, and roles. If an agency or another organization owns or manages your workspace, it controls the workspace and its data.

Other Disclosures

  • At your direction: When you connect an integration or an AI assistant (through our MCP server or APIs), we send it the data you ask it to access.
  • Legal requirements: We may disclose your information in response to court orders, subpoenas, or law enforcement requests. We will notify you before disclosing your information unless we are legally prohibited from doing so.
  • Business transfers: In the event of a merger, acquisition, or sale of assets, your personal information may be transferred to the acquiring entity. We will notify you before any such transfer takes effect.
  • With your consent: We may share your information in ways not described above with your explicit consent.

We never sell personal information for monetary consideration and we do not share data with data brokers.

5. Cookies and Tracking Technologies

We use cookies and similar technologies on our website and dashboard. We use ConsentStack's own consent banner, which applies the rules for where you are. Where the law requires your consent first (for example, in the European Economic Area and the United Kingdom), analytics, functional, and marketing tools wait for it. In other places, such as most US states, they may run until you opt out.

Essential cookies are required for our website and dashboard to work:

  • Supabase session cookies keep you signed in to the dashboard. They end when you sign out.
  • The "theme" cookie stores your light, dark, or system display choice for one year.
  • Our consent banner's "cs_consent" cookie and browser storage remember your cookie choices so we don't ask again, and hold a random visitor identifier, which our servers store only in hashed form. On the dashboard, a session cookie mirrors your marketing choice so our servers can respect it.

Referral cookie: If you arrive through a partner's referral link, the "cs_ref" cookie holds that partner's code for 60 days, so the partner is credited if you create a workspace.

Functional: HubSpot's chat and its cookies, which keep a chat conversation going.

Analytics and performance: Google Analytics (through Google Tag Manager) and Microsoft Clarity.

Marketing: The Meta pixel, the OpenAI ads pixel, Google Ads' conversion cookies (such as "_gcl_au"), and our own "_cs_ft" cookie. "_cs_ft" remembers for 90 days how you first arrived (campaign tags, ad click IDs, the referring website, and the landing page) and up to 20 pages you visited. If you create an account, we save these details with your account, and we use them to credit scans you start. We set "_cs_ft" only when marketing is allowed, and delete it if you turn marketing off.

You can see and change your choices at any time with "Your Privacy Choices" in our website footer.

6. Data Retention

We keep personal information only as long as we need it for the purposes described in this policy. Where no fixed period applies, we keep it for as long as it serves the purpose described, and you can ask us to delete it sooner (see Section 8).

  • Account data: Kept while your account exists. When you delete your account, we delete your profile, and any workspace where you are the only member, straight away. We keep a short deletion record (the workspace name, what was deleted, and when) as proof of the deletion.
  • Billing records: Invoices and payment records are kept in our Stripe account, for at least as long as tax and accounting laws require.
  • Terms acceptance records: Kept after your account is deleted, as evidence of what was agreed, for as long as the agreement could be disputed.
  • Business Associate Agreement records: Kept as a permanent legal record, including after the site, workspace, or account is deleted.
  • Site configuration data: Deleted when you delete your site, its workspace, or your account.
  • Platform connections: When you disconnect HubSpot from a site, or uninstall the ConsentStack app from your HubSpot account, the connection's token is invalidated and can no longer access your HubSpot data. The stored connection record is deleted when the team that created it is deleted.
  • Newsletter subscriptions: Kept until you unsubscribe or ask us to remove you.
  • Scan offers: Your email address, your code, and the related scan are kept so we can honor the code and avoid sending duplicates. Codes expire after 30 days. We send the code and up to two reminders over the following 25 days, and cancel the reminders if you use the code.
  • Call requests: Kept so we can follow up and prevent abuse.
  • Compliance scans: Scan results, with the location and arrival details of whoever started the scan, are kept for as long as we need them for the scanner, its reports, and our research. The latest report for each website stays public.
  • Scanner AI chat: Chat messages are deleted automatically after 12 months. See "AI Features" below.
  • Referral and AI-assistant visit records: Kept for as long as we need them for partner reporting and to measure where visits come from. The IP hash in them changes every day, so it cannot link your visits across days.
  • Partner program records: Referral, commission, and payout records are kept for as long as we need them to pay commissions, handle refunds and disputes, and meet tax and accounting obligations.
  • Contact form submissions: Forwarded to our support team via email (Resend). We do not maintain a separate database of contact form submissions. Resend may retain delivery logs in accordance with their own privacy policy.
  • Support chats and call bookings: Kept in HubSpot and Cal.com for as long as we need them to support you.
  • Analytics and advertising data: Retained according to each provider's retention settings (Google Analytics, Google Ads, Microsoft Clarity, Meta, OpenAI).
  • Cookies: As listed in Section 5.
  • Backups: Deleted data can remain in our database provider's backups for a limited time, until those backups are overwritten.

You can ask us to delete any of the records above that relate to you, unless we need to keep them to meet a legal obligation or to establish or defend a legal claim. When data is no longer needed, it is deleted or anonymized.

7. Data Security

We take the security of your personal information seriously and implement industry-standard measures to protect it:

  • Encryption in transit (HTTPS/TLS) and at rest
  • Authentication via secure session tokens with automatic refresh
  • Row-level security policies on database tables
  • Rate limiting at the CDN edge to prevent abuse
  • Payment card data handled entirely by Stripe; we never see or store card numbers
  • OAuth tokens for connected platforms (such as HubSpot) sealed with AES-256-GCM encryption before storage; short-lived access tokens are never stored
  • IP addresses kept for usage limits and visit counts stored only as salted hashes
  • Access to production systems restricted to authorized personnel

No method of transmission or electronic storage is 100% secure. While we cannot guarantee absolute security, we are committed to protecting your data using commercially reasonable measures.

As we grow, we will pursue relevant security certifications and update this section accordingly.

8. Your Privacy Rights

Regardless of where you are located, you can:

  • Access the personal data we hold about you
  • Correct inaccurate personal data
  • Delete your account and associated data (available in the dashboard under account settings), or ask us to delete other records about you
  • Export your data
  • Opt out of marketing emails using the unsubscribe link included in every marketing email, or by emailing us
  • Manage cookie preferences with "Your Privacy Choices" in our website footer

How to Exercise Your Rights

  • Email: [email protected]
  • In-app: Account deletion and data management are available in dashboard settings

We will respond to your request within 30 days (for requests under GDPR) or 45 days (for requests under CCPA/CPRA). If we need additional time, we will notify you.

We may need to verify your identity before processing your request. If you have an account, we will ask you to authenticate via your existing login. If you do not have an account, we may ask for information to match against our records.

Additional rights specific to your jurisdiction are described in Section 11 below.

9. International Data Transfers

ConsentStack is based in the United States. Your personal information is processed and stored in the United States through our service providers, including Supabase, Vercel, Cloudflare, DigitalOcean, and Stripe. Cloudflare's network handles requests in data centers around the world, close to where you are, and our compliance scanner also runs scans from servers in Europe.

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, your data is transferred to the United States. We rely on Standard Contractual Clauses (SCCs) approved by the European Commission as our primary transfer mechanism to ensure adequate protection of your data.

We intend to pursue EU-US Data Privacy Framework (DPF) certification and will update this section when that certification is obtained.

10. Children's Privacy

ConsentStack is a business-to-business service and is not directed at children under the age of 16 (in the EU) or 13 (in the US). We do not knowingly collect personal information from children. If we discover that we have inadvertently collected personal information from a child, we will delete it promptly. Parents or guardians who believe their child may have provided us with personal information can contact us at [email protected].

11. Regional Disclosures

The following sections provide additional information required by specific privacy laws. Please refer to the section that applies to your jurisdiction.

11.1 European Economic Area (EEA) and European Union

Data controller: ConsentStack LLC, 23046 Avenida De La Carlota, Suite #600, Laguna Hills, California 92653, USA.

Legal bases for processing: We process your personal data based on the legal bases described in Section 3 of this policy, including contract performance, legitimate interest, consent, and legal obligation.

Your additional rights under GDPR: In addition to the rights described in Section 8, you have the right to:

  • Restrict processing of your personal data in certain circumstances
  • Data portability: receive your personal data in a structured, commonly used, machine-readable format
  • Object to processing based on legitimate interests
  • Withdraw consent at any time for processing based on consent, without affecting the lawfulness of prior processing
  • Lodge a complaint with your local data protection supervisory authority

EU representative: We are in the process of appointing a formal EU representative under Article 27 of the GDPR and will update this section when complete. For EU/EEA inquiries, contact [email protected].

Data transfers: We rely on Standard Contractual Clauses (SCCs) for transfers of personal data from the EEA to the United States. EU-US Data Privacy Framework certification is planned.

11.2 United Kingdom

Your rights under the UK General Data Protection Regulation (UK GDPR) mirror those described in Section 11.1 for the EEA, adapted to UK law.

UK representative: We are in the process of appointing a formal UK representative and will update this section when complete. For UK inquiries, contact [email protected].

Supervisory authority: You have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

Data transfers: We rely on the UK International Data Transfer Agreement (UK IDTA) and Standard Contractual Clauses for transfers from the UK to the United States.

11.3 Switzerland

We comply with the Swiss Federal Act on Data Protection (FADP). Your rights under Swiss law are similar to those described in Section 11.1 for the EEA. We rely on Standard Contractual Clauses for data transfers from Switzerland to the United States.

For inquiries, contact [email protected].

11.4 United States: California (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) provides you with specific rights regarding your personal information.

Categories of personal information we collect:

  • Identifiers (name, email address, phone number if you ask us to call you, IP address, account ID, and online identifiers such as cookie IDs)
  • Commercial information (subscription and billing records)
  • Internet or electronic network activity (browsing history, usage data, interactions with our website)
  • Geolocation data (approximate location derived from IP address, such as the city, region, and country recorded with a scan)
  • Professional or employment-related information (company name, and job title if you sign a Business Associate Agreement)

We collect this information from you, automatically from your device, and from the third parties described in Section 2. We disclose it for business purposes to the service providers listed in Section 4, and we keep it as described in Section 6.

We do not sell personal information for monetary consideration. Advertising pixels and server-side conversion events on our website may constitute "sharing" of personal information as defined under the CCPA: in the past 12 months, we have shared identifiers and internet activity with Google, Meta and OpenAI for cross-context behavioral advertising. You can opt out of this sharing at any time with "Your Privacy Choices" in our website footer.

Your California rights:

  • Right to know what personal information we collect, use, and disclose
  • Right to delete your personal information
  • Right to correct inaccurate personal information
  • Right to opt out of sharing for cross-context behavioral advertising
  • Right to non-discrimination for exercising your privacy rights

Authorized agents: You may designate an authorized agent to make a request on your behalf. We may require verification that you authorized the agent to act for you.

Response time: We will respond to verifiable requests within 45 days. If we need more time, we will notify you and may take up to 90 days total.

To exercise your rights, contact us at [email protected].

11.5 United States: Other State Privacy Laws

Residents of states with comprehensive privacy laws (including Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Iowa, Indiana, Tennessee, Montana, Oregon, Texas, Delaware, Florida, Nebraska, New Hampshire, New Jersey, Kentucky, Minnesota, Maryland, and Rhode Island) have similar rights to access, correct, delete, and opt out of the processing of their personal data.

To exercise your rights under any of these laws, contact us at [email protected].

11.6 Brazil (LGPD)

If you are located in Brazil, the Lei Geral de Protecao de Dados (LGPD) provides you with specific rights regarding your personal data.

Legal bases for processing: We process your personal data based on contract performance, legitimate interest, consent, and legal obligation, as described in Section 3.

Your rights under the LGPD:

  • Confirmation of the existence of processing
  • Access to your data
  • Correction of incomplete, inaccurate, or outdated data
  • Anonymization, blocking, or deletion of unnecessary or excessive data
  • Data portability
  • Deletion of data processed with your consent
  • Information about public and private entities with which we share your data
  • Information about the possibility of denying consent and the consequences
  • Withdrawal of consent

To exercise your rights, contact us at [email protected].

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal requirements.

  • Material changes: We will notify you via email (if you have an account) and post a prominent notice on our website before the changes take effect.
  • Non-material changes: We will update this page with a new "Last updated" date.

Your continued use of our services after any changes take effect constitutes your acceptance of the updated policy. Previous versions of this policy are available upon request.

13. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us:

ConsentStack LLC

23046 Avenida De La Carlota, Suite #600

Laguna Hills, California 92653, USA

Privacy contact: [email protected]

Data Protection Officer: [email protected]

EU representative: Details to be announced. For EU/EEA inquiries, contact [email protected].

UK representative: Details to be announced. For UK inquiries, contact [email protected].

If you are located in the EEA or UK, you have the right to lodge a complaint with your local data protection supervisory authority.

AI Features

Compliance scanner summary and chat

When someone opens the summary on a compliance scan report, we generate a written summary of the scan results using an AI model. If yours is the visit that generates it, we store a salted hash of your IP address with the summary, to enforce usage limits. If you use the chat on a scan report, we store the messages you send, the replies, the scanned domain, the time of each message, a salted hash of your IP address, and your browser's user agent (which identifies your browser, its version, and your operating system). We use this to check the quality of the feature, to prevent abuse, and to improve the service.

Scan results and chat messages are sent to Anthropic, our AI provider, through Vercel AI Gateway, to produce responses, and are processed under that provider's terms; our provider does not use them to train models. With the scan results we also send a broad region (the United States or Europe) worked out from the approximate location of whoever started the scan, so the summary can focus on the rules most relevant to its likely reader. We do not send the IP address, the city or the country. Chat sessions are not linked to a ConsentStack account. Please do not include personal information in chat messages. We keep chat messages, with each chat's IP hash and user agent, for up to 12 months, and then delete them automatically.

Documentation assistant

The AI assistant in our documentation search sends your questions and the conversation to Inkeep, which answers them from our documentation using AI models. We do not store these conversations in our own systems; Inkeep processes them under its terms. Please do not include personal information in your questions.