This Terms of Service Agreement, together with the documents it incorporates under Section 23.1 (the "Agreement"), is a legally binding contract between ConsentStack LLC, a California limited liability company ("ConsentStack," "we," "us," or "our"), with its principal place of business at 23046 Avenida De La Carlota, Suite #600, Laguna Hills, California 92653, and the Customer described in Section 1.1 ("Customer," "you," or "your") that accesses or uses the ConsentStack platform and services. If you use only the Free Tools, Section 22.1 explains which parts of this Agreement apply to you.
BY CLICKING "I AGREE," CREATING A LOGIN OR AN ACCOUNT, ACCEPTING AN INVITATION TO AN ACCOUNT, AUTHORIZING AN APPLICATION TO ACCESS THE SERVICES, EXECUTING AN ORDER FORM, OR ACCESSING OR USING THE SERVICES, YOU ACKNOWLEDGE THAT YOU HAVE READ, UNDERSTOOD, AND AGREE TO BE BOUND BY THIS AGREEMENT. IF YOU ARE ACCEPTING ON BEHALF OF AN ORGANIZATION, YOU REPRESENT AND WARRANT THAT YOU HAVE THE AUTHORITY TO BIND IT TO THIS AGREEMENT. IF YOU DO NOT AGREE TO THESE TERMS, DO NOT ACCESS OR USE THE SERVICES.
1. Agreement to Terms
1.1 Acceptance
This Agreement becomes effective on the earliest of the following (the "Effective Date"): (a) the date you click "I Agree" or use a similar acceptance mechanism, including when you sign up, accept an invitation to an Account, or authorize an MCP client or other application to access the Services; (b) the date you create a Login or an Account; (c) the date you execute an Order Form referencing this Agreement; or (d) the date you first access or use the Services. Accepting this Agreement electronically has the same effect as signing it by hand.
A person who uses the Services for or on behalf of an organization accepts this Agreement for that organization and binds it. For each Account, the Customer is the organization named in the Account's billing details or, if none is named, the organization that the Account's owner acts for (or the owner personally, if the owner does not act for an organization). Everyone invited to an Account uses the Services as an Authorized User of that Account's Customer. A person may belong to Accounts of different Customers, and each Customer is responsible for that person's use of its own Account. An agency that holds client Sites in its own Account is the Customer for that Account (Section 17).
1.2 Eligibility
You must be at least eighteen (18) years of age or the age of majority in your jurisdiction, whichever is greater, to use the Services. The Services are intended for business use only and are not directed at consumers.
1.3 Changes to this Agreement
ConsentStack may change this Agreement, including any document that forms part of it under Section 23.1. We will give at least thirty (30) days' notice before a change takes effect, by email to the email address of every Login and the billing email address of every Account, and by a notice in the Dashboard. For a material change, we will also ask you to accept the changed terms: until the effective date, the Dashboard notice lets you accept them early, and from the effective date you must accept them before you can keep using the Dashboard or any AI agent or other application connected through the MCP server. Consent banners on Customer's websites keep running whether or not anyone has accepted. If you do not agree to a change, you may stop using the Services, cancel a paid Plan, or delete your Sites or Account under Section 15 before the change takes effect; otherwise, using the Services after the effective date, including continuing to run the SDK on your websites, means you accept the change. Where a document that forms part of this Agreement gives you more notice or other rights for changes to that document, such as a right to object or to terminate, that document's rule also applies. A change that only adds new features or Free Tools, or that we must make to comply with law, may take effect sooner, and changes to the terms that apply to the Free Tools take effect when we post them.
1.4 Definitions
In this Agreement:
"Account" means a workspace in the Dashboard, together with its Sites, settings, billing details and Authorized Users.
"Authorized User" means an individual who belongs to an Account, whether as its owner or because they were invited to it. The ConsentStack Concierge (Section 19) is not an Authorized User.
"Login" means an individual's ConsentStack sign-in and profile (shown in the Dashboard's profile settings as your "account"). One Login can belong to many Accounts.
"Site" means a website configuration in an Account, with its own site key, settings, domains and Plan. Fees and limits apply per Site.
"Plan" means the plan that applies to a Site, such as the Basic, Pro or Business Plan, with the features and limits described on the pricing page, in the Dashboard or in an Order Form.
"End User" means a visitor to a website on which the SDK is deployed for a Site.
"MAU" (monthly active users, shown on the pricing page as unique monthly visitors) means the number of unique visitors to a Site in a Monthly Period. A visitor is counted once per Monthly Period when the SDK loads the Site's configuration in the visitor's browser, whether or not the visitor sees the banner or makes a consent decision. Loads from localhost are not counted.
"Monthly Period" means, for a Site on the Basic Plan, each monthly period counted from the date the Site was created; for a Site on a monthly paid Plan, each billing period; and for a Site on an annual paid Plan, each monthly window that starts on the renewal day of the month.
"Order Form" means an order, quote or other ordering document that ConsentStack and Customer both accept and that references this Agreement.
"Documentation" means the guides and developer documentation ConsentStack publishes at consentstack.io/docs, as updated from time to time.
"Generated Documents" means the policies and other documents the policy generator creates for a Site (Section 21).
The Services, Subscription Services, Free Tools, Open-Source Components, Dashboard and SDK are defined in Section 2.1; Customer Data, Account Data, Consent Data and ConsentStack Data in Section 9; Confidential Information in Section 11.1; the Concierge in Section 19.1; and the DPA, HIPAA BAA, Compliance Guarantee and Partner Program Terms in Section 23.1.
2. The Services
2.1 Description
ConsentStack provides a cloud-based consent management platform. The "Services" consist of the following three parts.
(a) Subscription Services. The services available to Accounts (the "Subscription Services"), which consist of: (i) the web-based dashboard for configuring consent experiences, managing Sites, domains and Authorized Users, and viewing analytics (the "Dashboard"); (ii) the JavaScript software development kit for deployment on Customer's websites, and the scripts ConsentStack hosts for it (the "SDK"); (iii) ConsentStack's endpoints that deliver Site configurations and receive consent records and tracker-detection data; (iv) categorization of trackers using the ConsentStack tracker catalog; (v) consent logs, consent analytics and exports; (vi) compliance scans of Customer's Sites; (vii) the ConsentStack MCP server and ConsentStack's APIs (Section 18); (viii) platform integrations (Section 10); (ix) the policy generator, hosted policies and the policy.js embed script (Section 21); (x) Concierge setup (Section 19); and (xi) the HIPAA BAA add-on (Section 20). The Subscription Services available to a Site, and their limits, depend on its Plan.
(b) Free Tools. The tools ConsentStack makes available on its website to anyone, with or without an Account (the "Free Tools"), including the public compliance scanner and its reports, AI-generated summaries and chat on scan reports, the cookie checker and other checkers, the vendor directory, and ConsentStack's research data and reports. Section 22 applies to them.
(c) Open-Source Components. Software ConsentStack publishes under an open-source license (the "Open-Source Components"), currently the @consentstack/react package, which is published under the MIT License. Section 8.7 applies to them.
2.2 Business-to-Business Designation
The Services are directed exclusively at business-to-business customers. By using the Services, you represent that you are acting in a business capacity and not as a consumer.
2.3 Not Legal Advice
THE SERVICES, DOCUMENTATION, GENERATED DOCUMENTS, AI-GENERATED CONTENT, AND ANY COMMUNICATIONS FROM CONSENTSTACK (INCLUDING FROM THE CONCIERGE) DO NOT CONSTITUTE LEGAL ADVICE AND ARE NOT INTENDED TO BE RELIED UPON AS LEGAL ADVICE. CONSENTSTACK PROVIDES CONSENT MANAGEMENT TOOLS TO FACILITATE COMPLIANCE BUT, EXCEPT AS SET OUT IN THE COMPLIANCE GUARANTEE, DOES NOT GUARANTEE COMPLIANCE WITH ANY LAW, REGULATION, OR STANDARD. EXCEPT AS SECTION 4.2 PROVIDES FOR SITES COVERED BY THE COMPLIANCE GUARANTEE, CUSTOMER IS SOLELY RESPONSIBLE FOR: (A) DETERMINING APPLICABLE LEGAL REQUIREMENTS IN ITS JURISDICTION(S); (B) ENSURING CORRECT AND COMPLIANT IMPLEMENTATION OF THE SDK; (C) APPROPRIATE CATEGORIZATION OF COOKIES, TRACKERS, AND SCRIPTS; AND (D) SEEKING INDEPENDENT LEGAL COUNSEL FOR COMPLIANCE QUESTIONS.
2.4 Compliance Outcomes and the Compliance Guarantee
Except as set out in the Compliance Guarantee, ConsentStack does not warrant that use of the Services will result in compliance with the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), the ePrivacy Directive, or any other privacy law, regulation, or standard. Compliance depends on many factors outside of ConsentStack's control, including Customer's implementation, configuration, and applicable legal requirements. The Compliance Guarantee is a commitment about how the consent setup of an eligible Site behaves. It applies only to Sites on paid Plans that meet its conditions, provides the remedies it describes, and does not cover the rest of Customer's privacy program.
3. Accounts and Authorized Users
3.1 Account Information
To use the Subscription Services, you must create a Login and belong to an Account, and provide accurate, complete, and current registration information. You agree to update your registration information promptly to keep it accurate and current. ConsentStack may suspend or terminate Logins or Accounts that contain inaccurate or misleading information.
3.2 Account Security
You are responsible for maintaining the confidentiality of your Login credentials and of any tokens or API keys issued to you, and for all activities that occur under your Login or Account. You agree to immediately notify ConsentStack of any unauthorized use of your Login or Account or any other breach of security.
3.3 One Login Per Person
Each Login is for one individual. Do not share a Login or its credentials with anyone; invite each person who needs access to an Account as an Authorized User instead. One person may belong to any number of Accounts. Plan limits on the number of members apply per Account.
4. Customer Responsibilities
4.1 Legal Compliance
Customer shall comply with all applicable laws, regulations, and industry standards in the jurisdictions in which Customer operates, including all applicable data protection and privacy laws. Customer shall conspicuously post and maintain a legally sufficient privacy notice on all websites and properties where data is collected via the Services.
4.2 Implementation
Customer is solely responsible for: (a) correct implementation and deployment of the SDK on Customer's websites; (b) accurate categorization of cookies, trackers, and scripts into appropriate consent categories; (c) verification that cookies categorized as "strictly necessary" or "essential" are truly required for the basic functioning of Customer's website; (d) ensuring that all domains registered with the Services are accurately entered and publicly accessible; (e) proper configuration of consent rules, regional settings, and consent models appropriate for Customer's jurisdictions; and (f) any custom JavaScript or other custom code Customer adds to the banner, the Site's configuration or its websites. For a Site covered by the Compliance Guarantee, the configuration completed and maintained by the Concierge and the categorization of trackers in the ConsentStack tracker catalog are covered by the Compliance Guarantee on its terms, and items (b), (c) and (e) apply only to choices Customer makes outside them, such as tracker definitions that override the catalog or scripts Customer chooses to allow.
4.3 Operational Obligations
Customer shall: (a) maintain appropriate access controls for Authorized Users and promptly revoke access when no longer authorized; (b) ensure Customer has all necessary rights, consents, and permissions to collect data from End Users through the Services; (c) promptly remove all ConsentStack SDK code and references from a website when it stops using the Services on that website, including when a Site is deleted or this Agreement terminates (Section 15.4); and (d) independently verify that ConsentStack's default configurations are appropriate for Customer's compliance requirements and not rely on such defaults as legal guidance.
5. Prohibited Uses
5.1 General Restrictions
Customer shall not: (a) make the Services available to any unauthorized third party, except as Section 17 allows; (b) resell, sublicense, rent, or lease the Services, except as Section 17 allows; (c) modify, copy, or create derivative works of the Services, except for Generated Documents as Section 8.6 allows and Open-Source Components as their licenses allow; (d) reverse engineer, decompile, disassemble, or otherwise attempt to derive the source code of the Services, except to the extent expressly permitted by applicable law or by the license of an Open-Source Component; (e) use the Services to build or train a competing product or service, or publish benchmarks or comparative tests of the Services, without ConsentStack's prior written permission (scanning Customer's own websites, websites Customer is authorized to test, and public websites Customer is evaluating for a legitimate business purpose is allowed, as Section 22.2 describes); (f) introduce viruses, worms, Trojan horses, or other malicious code into the Services; (g) interfere with or disrupt the integrity or performance of the Services or their underlying infrastructure; (h) access or use the Services by automated means other than the SDK, the MCP server and the APIs described in the Documentation, used as Section 18 allows; or (i) use the Services in violation of applicable export control or sanctions laws and regulations.
5.2 CMP-Specific Restrictions
Customer shall not: (a) use the Services to intentionally circumvent or defeat the purpose of consent collection, including but not limited to configuring consent banners designed to manipulate, coerce, or trick End Users into providing consent; (b) deploy the SDK on domains not registered to one of Customer's Sites; (c) submit false, misleading, or fabricated consent data to the ConsentStack logging endpoints; or (d) use the Services to facilitate the collection of personal data from children under the age of sixteen (16) without implementing appropriate parental or guardian consent mechanisms as required by applicable law.
6. Fees and Payment
6.1 Plans and Fees
The Services are offered under the Basic, Pro and Business Plans described on the pricing page, and under any other Plan ConsentStack offers to an Account in the Dashboard or in an Order Form. Some Plans are offered only to certain Accounts, and some are offered with monthly billing only. Fees are charged per Site, not per Account, and are billed monthly or annually as Customer selects, where the Plan offers both. Custom limits or pricing apply only under an Order Form.
6.2 Payment Terms
All fees are due in advance of each billing period. Payment shall be made by credit card or other payment method accepted by ConsentStack and processed through our third-party payment processor, Stripe. All fees are quoted and payable in United States Dollars (USD). Late payments shall accrue interest at the rate of one and one-half percent (1.5%) per month or the maximum rate permitted by applicable law, whichever is lower. If a payment fails, ConsentStack will notify Customer and may retry it. If it remains unpaid, ConsentStack may end the paid Plan, which moves the Site to the Basic Plan (Section 15.4), in addition to its rights under Section 15.2.
6.3 Renewal, Cancellation and Price Changes
Paid Plans renew automatically for successive billing periods of the same length until cancelled. Customer may cancel a paid Plan at any time on the Dashboard's billing page. Cancellation takes effect at the end of the current billing period: until then the Site keeps its paid Plan, limits and retention, and Customer may resume the Plan from the billing page. When the period ends, the Site moves to the Basic Plan (Section 15.4). ConsentStack will give at least thirty (30) days' notice of any change to the price of Customer's Plan or add-ons, and a new price takes effect at the first renewal after the notice period ends. This notice requirement does not apply to Plan changes Customer makes, to automatic Plan changes under Section 6.6, or to the return to the regular price when a promotion ends (Section 6.8).
6.4 Taxes
All fees are exclusive of applicable taxes. Customer is responsible for all sales, use, value-added, goods and services, and similar taxes, except for taxes based on ConsentStack's net income. If ConsentStack is required to collect such taxes, they will be added to Customer's invoice.
6.5 Add-Ons
The following add-ons are available at the rates on the pricing page or shown in the Dashboard at purchase: (a) extra domains, for Sites on paid Plans; (b) visitor packs that raise a Site's MAU limit, for Sites on the Business Plan; and (c) the HIPAA BAA add-on, for Sites on the Pro Lite, Pro and Pro+ Plans (Section 20). Add-ons renew with the Plan they belong to and are billed on the same interval. When Customer adds or increases an add-on, the prorated amount for the rest of the current billing period is charged right away. When Customer removes or reduces an add-on, the prorated amount is credited to the Account's balance for future invoices and is not refunded (Section 6.7).
6.6 Automatic Plan Changes at the Visitor Limit
When a Site on a monthly Pro Lite Plan reaches its MAU limit, it moves to the Pro Plan, and when a Site on a monthly Pro or Pro+ Plan reaches its MAU limit, it moves to the Business Plan. The Plan and its limits change right away, so the banner keeps running, and the new Plan's price applies from the Site's next renewal. If a Site with the HIPAA BAA add-on moves to the Business Plan, the add-on ends because the Business Plan includes the HIPAA BAA. ConsentStack emails Customer when a Site reaches about eighty percent (80%) of its MAU limit and again when the move happens. Sites on annual Plans are not moved automatically; ConsentStack will contact Customer instead. When a Site on the Business Plan exceeds its MAU limit, the banner keeps running, and ConsentStack may require Customer to buy visitor packs or agree to custom terms. No grace period applies.
6.7 Refunds, Credits and Downgrades
Fees are non-refundable, and annual prepayments are not refunded on cancellation, except for: (a) the refund described in the Compliance Guarantee; (b) the refund the DPA provides when Customer terminates because it objects to a new Sub-processor; (c) the refund under Section 14.2; and (d) any refund ConsentStack chooses to give in a particular case. Credits, including prorated credits for downgrades and add-on reductions, are applied to the Account's balance for future invoices and are never paid out in cash. A change between paid Plans takes effect immediately: a move to a higher-priced Plan is charged for the rest of the current billing period on a prorated basis, and a move to a lower-priced Plan earns a prorated credit. Cancelling a paid Plan follows Section 6.3. When a Site moves to a Plan with lower limits, features beyond the new Plan's limits are reduced or removed, and its consent-log retention shortens after the thirty (30) day hold described in Section 9.5. If a Site leaves the Plan or add-on that includes the HIPAA BAA, the HIPAA BAA ends for that Site (Section 20.4).
6.8 Promotions
A promotion code or offer applies only to the Plans, Sites and invoices it states. When it ends, the Plan renews at its then-current price. Unless the offer says otherwise, a code may be redeemed once, cannot be combined with other offers, has no cash value, and may expire or be withdrawn before it is redeemed. ConsentStack may reverse a promotion obtained in breach of its terms.
7. Basic Plan
7.1 Scope
The Basic Plan is provided at no cost, subject to the limits published on the pricing page, which currently are one thousand (1,000) MAU and one (1) domain for each Site, and two (2) members (including the owner) for an Account while none of its Sites is on a paid Plan. Sites on the Basic Plan do not include consent analytics or access to consent logs, and their consent logs are kept for the current Monthly Period only (Section 9.5).
7.2 Reduced Protections
For Sites on the Basic Plan: (a) ConsentStack's intellectual property indemnification obligations under Section 14.1 do not apply; (b) ConsentStack provides no service level commitments or uptime guarantees; and (c) support is provided by email and chat as available, with no response times or other service levels.
7.3 Changes and Inactive Accounts
ConsentStack may change the features, limits, or availability of the Basic Plan at any time. ConsentStack may delete a Site on the Basic Plan, or an Account with no Sites on paid Plans, that has been inactive for ninety (90) consecutive days, after giving at least thirty (30) days' notice. A Site or Account is inactive when, for that whole period, the SDK has not loaded its configuration on any website and none of its Authorized Users has signed in to the Dashboard. ConsentStack shall have no liability for ending or materially changing the Basic Plan.
7.4 Visitor Limit
When a Site on the Basic Plan reaches its MAU limit, ConsentStack stops running on that Site: the SDK shows no banner and blocks nothing until the next Monthly Period starts or Customer moves the Site to a paid Plan. While that lasts, third-party scripts on Customer's websites may run without consent controls, and Customer is solely responsible for them. ConsentStack emails Customer as a Site approaches its limit and when it reaches it. The limit is not enforced while a Site is in test mode.
7.5 Branding
Sites on the Basic Plan show ConsentStack branding: a "Powered by ConsentStack" link on the consent banner and in the preferences window, and a ConsentStack attribution link on hosted policies and policy embeds (Section 21.5). This branding may not be removed, obscured, or modified without moving the Site to a paid Plan. On paid Plans the branding shows unless Customer turns it off for the Site in the Dashboard.
8. Intellectual Property
8.1 ConsentStack Ownership
ConsentStack retains all right, title, and interest in and to the Services, including the Dashboard, SDK, edge functions, APIs, the MCP server, the tracker catalog, the policy generator and its templates, the Free Tools, the Documentation, and all related intellectual property rights. This includes all improvements, modifications, derivative works, and enhancements to the Services, whether or not incorporating Customer feedback. Except for the licenses in Sections 8.3, 8.6 and 8.7, nothing in this Agreement transfers ownership of, or grants any right in, any ConsentStack intellectual property to Customer.
8.2 Customer Ownership
Customer retains all right, title, and interest in and to Customer Data (as defined in Section 9), including its answers and own wording in the policy generator, and Customer's websites, applications, and content.
8.3 License Grants
Customer grants ConsentStack a non-exclusive, worldwide license to host, process, display, publish (where Customer publishes it, such as a hosted policy), and transmit Customer Data solely as necessary to provide the Services and as Section 9.3 allows. This license ends when this Agreement terminates, except for Customer Data that ConsentStack keeps under Section 9.5 or Section 15.5, for as long as it keeps it. ConsentStack grants Customer a non-exclusive, non-transferable, non-sublicensable license during the Term to access and use the Subscription Services in accordance with this Agreement and each Site's Plan, including a license to deploy the SDK on the domains registered to Customer's Sites for the purpose of consent collection.
8.4 Feedback
Any suggestions, ideas, enhancement requests, recommendations, or other feedback provided by Customer regarding the Services ("Feedback") may be used by ConsentStack perpetually and irrevocably for any business purpose, without accounting, attribution, or compensation to Customer. Customer hereby assigns to ConsentStack all right, title, and interest in and to such Feedback.
8.5 Marketing Rights
ConsentStack may identify Customer as a user of the Services, including by Customer's name and logo, in marketing materials and on ConsentStack's website, subject to any trademark usage guidelines Customer provides. Customer may revoke this permission at any time by written notice to ConsentStack.
8.6 Generated Documents
ConsentStack grants Customer a non-exclusive, worldwide, royalty-free, perpetual license to use, copy, modify, publish and display the text of the Generated Documents for Customer's Sites, for Customer's own websites and business or, for an agency, for the client whose Site it is. This license continues after the Site moves to another Plan, after the Site is deleted, and after this Agreement ends. ConsentStack keeps ownership of its templates and the policy generator, and may use the same or similar wording for other customers. Hosting of Generated Documents is described in Section 21.6.
8.7 Open-Source Components
Open-Source Components are licensed under their own open-source licenses (the @consentstack/react package under the MIT License), and those licenses, not this Agreement, govern Customer's use, copying, modification and distribution of their code. Nothing in this Agreement limits the rights those licenses grant. Use of the Subscription Services through an Open-Source Component remains subject to this Agreement.
9. Customer Data
9.1 Customer Data and Account Data
"Customer Data" means data that Customer or its Authorized Users provide to, upload to, or create in the Subscription Services, and data the Subscription Services collect for Customer's Sites, including: Site configurations and consent banner settings; domain registrations; tracker and script categorization rules; policy generator answers, the business profile and Generated Documents; credentials for connected third-party accounts (such as HubSpot); results of compliance scans of Customer's Sites; records of HIPAA BAA acceptance; and Consent Data (Section 9.2). Customer Data does not include Account Data or ConsentStack Data.
"Account Data" means information about Customer and its Authorized Users that ConsentStack uses to run Logins, Accounts and the business relationship, such as names, email addresses, sign-in records, billing details, records of acceptance of this Agreement, support communications, and information about how Authorized Users use the Dashboard. ConsentStack is the controller of Account Data and handles it as the Privacy Policy describes.
9.2 Consent Data
"Consent Data" means data the SDK and ConsentStack's endpoints collect from End Users' browsers on Customer's websites. Consent records consist of: (a) a pseudonymous visitor identifier that the SDK generates and stores in the End User's browser, which ConsentStack's servers hash (one way) before storing it; (b) the consent decision for each category, the event type and action, how the decision was signaled (for example through the banner, the preferences window, a Global Privacy Control signal, or a consent recorded by Customer's previous consent tool), whether a Global Privacy Control signal was detected, and any trigger label Customer configures; (c) the address of the page where the event happened, without its query string or fragment, and the domain; (d) the browser and operating system (derived from the browser's user agent, which is not stored) and the device type; (e) the End User's country and state or region, the regulation and consent model applied, and the language; (f) the configuration and SDK versions and related settings, and banner interaction and timing metrics; and (g) when the SDK carries over a consent recorded by Customer's previous consent tool, the evidence that tool kept for it, which for Cookiebot includes Cookiebot's consent identifier as Cookiebot stored it. ConsentStack does not store End Users' IP addresses, names, email addresses, or precise location (such as city, postal code or coordinates).
To count MAU (Section 1.4), the SDK sends the visitor identifier with each request for the Site's configuration, including before any consent decision, and ConsentStack stores a hashed form of it once per Site per Monthly Period.
To detect and categorize trackers, the SDK also reports the names of the cookies and browser storage items it observes, the addresses of scripts and other requests, the pages where they were observed (without query strings or fragments), and hashed visitor identifiers ("tracker-detection data"). Tracker-detection data is Consent Data.
Consent Data is processed on Customer's behalf and treated as Customer Data for purposes of ownership and data protection obligations under this Agreement.
9.3 ConsentStack Data
"ConsentStack Data" means aggregated and de-identified data that ConsentStack derives from Customer Data, Consent Data, Account Data and the operation of the Services, and that cannot reasonably be used to identify Customer, any End User, or any other individual or household. It includes: (a) statistics and insights such as consent rates, industry benchmarks and research findings; (b) system performance metrics, uptime statistics, and infrastructure telemetry; (c) usage patterns and product analytics; and (d) information about third-party trackers and vendors and how they behave across websites, which may be added to the ConsentStack tracker catalog. ConsentStack may collect, use, and disclose ConsentStack Data for any lawful business purpose, including improving the Services, industry benchmarking, research, and developing and training machine learning and artificial intelligence models. ConsentStack will: (i) take reasonable measures to ensure that ConsentStack Data cannot be associated with an individual or household; (ii) maintain and use ConsentStack Data only in de-identified form and not attempt to re-identify it, except to test whether its de-identification processes work, and this Section is ConsentStack's public commitment to do so; and (iii) contractually require anyone to whom it discloses ConsentStack Data to meet the same requirements. ConsentStack does not use identifiable Consent Data, or other personal data it processes for Customer, to train machine learning or artificial intelligence models. ConsentStack Data is and remains the sole property of ConsentStack. Customer may not restrict ConsentStack's use of general knowledge, techniques, or learnings acquired in the course of providing the Services, provided that such use does not reveal Customer's Confidential Information.
9.4 Data Processing
The Data Processing Agreement (the "DPA") forms part of this Agreement without a separate signature and governs ConsentStack's processing of personal data in Customer Data, including Consent Data. For that data, ConsentStack is a processor (and a service provider under the CCPA) acting on Customer's behalf, and Customer is the controller or acts for the controller. ConsentStack is a controller (and a business under the CCPA) for Account Data and for personal data collected through ConsentStack's own websites, the Free Tools, support and contact channels, and lead and newsletter forms, as the Privacy Policy describes.
9.5 Data Retention and Deletion
Consent logs are kept for each Site according to its Plan: for the current Monthly Period on the Basic Plan; thirty (30) days on the Pro Lite and Pro Plans; one hundred eighty (180) days on the Pro+ Plan; three hundred sixty-five (365) days on the Business Plan; or as an Order Form states. Older records are deleted on a rolling basis. When a Site's retention would become shorter, because its paid Plan ends or it moves to a Plan with shorter retention, ConsentStack keeps applying the previous retention period for thirty (30) more days. During that hold Customer can export the Site's consent logs from the Dashboard, even on the Basic Plan; after it, the new Plan's retention applies. Tracker-detection data is kept while the Site exists, except that records of individual cookies and browser storage items are kept for ninety (90) days. On Plans that include consent logs, Customer's owners and admins can delete an individual End User's consent records from the Dashboard at any time; on any Plan, Customer can ask ConsentStack to do so under the DPA. Deleting a Site, deleting an Account, or deleting a Login (which also deletes any Account in which that person is the only member) deletes the related Customer Data immediately and removes the Site's hosted configuration and hosted policies, except for: (a) records of acceptance of this Agreement and of any HIPAA BAA, which ConsentStack keeps as evidence of the agreement; (b) copies in backups, which are deleted as the DPA describes; and (c) records ConsentStack must keep by law.
10. Third-Party Integrations
10.1 Scope
The SDK works with third-party platforms in the End User's browser, through each platform's own consent interface, including: Google Consent Mode v2; the Meta Pixel; the TikTok Pixel; Microsoft Advertising UET; Microsoft Clarity; the Pinterest Tag; the LinkedIn Insight Tag (which the SDK controls by blocking it until consent); HubSpot, including replacing HubSpot's own cookie banner; the Shopify Customer Privacy API; Wistia; and carrying over consents recorded by Customer's previous consent tool, such as Cookiebot. These integrations run by default when a platform is present on Customer's website, and as Customer configures them. ConsentStack does not send Consent Data to these platforms from its own servers. The Services also connect to website platforms that Customer authorizes, such as through the ConsentStack app for HubSpot, which imports a HubSpot account's website domains.
10.2 No Guarantee of Availability
ConsentStack does not guarantee the continued availability, accuracy, or compatibility of any third-party integration. Third-party platforms may modify their APIs, protocols, or requirements at any time, which may affect integration functionality. ConsentStack will use commercially reasonable efforts to maintain integrations but shall not be liable for disruptions caused by third-party changes.
10.3 Customer Responsibility
Customer is solely responsible for compliance with the terms of service, policies, and requirements of each third-party platform Customer uses in connection with the Services. Customer is responsible for maintaining any required accounts, API keys, or credentials with third-party platforms. Customer grants ConsentStack permission to transmit consent signals and data to third-party platforms as configured by Customer. Where Customer connects a third-party account to the Services through an authorization flow (such as HubSpot), Customer authorizes ConsentStack to store the resulting credential securely and to access the connected account's data as described in the Documentation until Customer disconnects the integration or uninstalls the app. Customer must promptly remove or disable integrations if required by applicable law or third-party platform terms.
10.4 Disclaimer
ConsentStack is not responsible for the acts, omissions, data practices, or policies of any third-party platform. ConsentStack makes no representation or warranty regarding the accuracy or completeness of consent signals delivered to third-party platforms.
10.5 Right to Disable
ConsentStack may disable or restrict any third-party integration if ConsentStack reasonably believes that the integration violates applicable law, infringes third-party rights, or poses a security risk to the Services.
11. Confidentiality
11.1 Definition
"Confidential Information" means all non-public information disclosed by one party (the "Disclosing Party") to the other party (the "Receiving Party"), whether orally, in writing, or electronically, that is designated as confidential or that a reasonable person would understand to be confidential given the nature of the information and the circumstances of disclosure. Confidential Information includes the terms and conditions of this Agreement (including pricing), Customer Data, ConsentStack's proprietary technology and trade secrets, business plans, and security architecture. Generated Documents that Customer has published, and scan reports available on ConsentStack's public website, are not Confidential Information.
11.2 Exclusions
Confidential Information does not include information that: (a) is or becomes publicly available without breach by the Receiving Party; (b) is independently developed by the Receiving Party without use of or reference to the Disclosing Party's Confidential Information; (c) is rightfully received from a third party without restriction on disclosure; or (d) was previously known to the Receiving Party without obligation of confidence.
11.3 Obligations
The Receiving Party shall: (a) protect the Disclosing Party's Confidential Information with at least the same degree of care it uses for its own confidential information, and in no event less than reasonable care; (b) not disclose Confidential Information except to employees, contractors, and agents who need to know and who are bound by confidentiality obligations at least as protective as those herein; and (c) not use Confidential Information for any purpose other than as necessary to exercise its rights or perform its obligations under this Agreement.
11.4 Compelled Disclosure
If the Receiving Party is compelled by law, regulation, or legal process to disclose Confidential Information, it may do so provided it gives the Disclosing Party reasonable prior written notice (to the extent legally permitted) and cooperates with the Disclosing Party's reasonable efforts to obtain protective treatment for the disclosed information.
11.5 Injunctive Relief
Both parties acknowledge that a breach of confidentiality obligations may cause irreparable harm for which monetary damages would be inadequate. Accordingly, the Disclosing Party shall be entitled to seek injunctive or equitable relief in any court of competent jurisdiction without the requirement of posting a bond or proving actual damages.
11.6 Duration
Confidentiality obligations under this Section 11 shall survive termination of this Agreement for a period of five (5) years, except with respect to trade secrets, which shall remain protected for as long as they qualify as trade secrets under applicable law.
12. Warranties and Disclaimers
12.1 ConsentStack Warranties
ConsentStack warrants that: (a) the Subscription Services will perform materially in accordance with the Documentation during the Term; (b) ConsentStack will provide the Subscription Services in a professional and workmanlike manner consistent with generally accepted industry standards; and (c) ConsentStack has the authority to enter into this Agreement and grant the rights and licenses herein. ConsentStack also provides the Compliance Guarantee for the Sites it covers, on its terms.
12.2 Customer Warranties
Customer warrants that: (a) Customer has the authority to enter into this Agreement and to bind the organization on whose behalf it is accepted; (b) Customer owns, or has the authority of the owner of, every domain registered to its Sites (Section 17.2); and (c) Customer's use of the Services will comply with all applicable laws and this Agreement.
12.3 Disclaimer
EXCEPT AS EXPRESSLY SET FORTH IN SECTION 12.1 AND IN THE COMPLIANCE GUARANTEE, THE SERVICES (INCLUDING THE FREE TOOLS, GENERATED DOCUMENTS, AND AI-GENERATED CONTENT) ARE PROVIDED "AS IS" AND "AS AVAILABLE." CONSENTSTACK DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT. CONSENTSTACK DOES NOT WARRANT THAT THE SERVICES WILL BE UNINTERRUPTED, ERROR-FREE, OR SECURE, THAT DEFECTS WILL BE CORRECTED, OR THAT THE SERVICES OR THE SERVERS THAT MAKE THEM AVAILABLE ARE FREE OF VIRUSES OR OTHER HARMFUL COMPONENTS.
12.4 CMP-Specific Disclaimers
WITHOUT LIMITING THE FOREGOING, AND EXCEPT AS SET OUT IN THE COMPLIANCE GUARANTEE FOR THE SITES IT COVERS, CONSENTSTACK DOES NOT WARRANT THAT: (A) THE SERVICES WILL ENSURE COMPLIANCE WITH ANY LAW, REGULATION, OR STANDARD, INCLUDING BUT NOT LIMITED TO GDPR, CCPA, THE EPRIVACY DIRECTIVE, OR ANY OTHER PRIVACY LAW; (B) COOKIE OR TRACKER DETECTION, CATEGORIZATION, OR SCAN RESULTS WILL BE COMPLETE OR ACCURATE; (C) CONSENT SIGNALS DELIVERED TO THIRD-PARTY PLATFORMS WILL BE RECEIVED OR PROCESSED CORRECTLY BY THOSE PLATFORMS; (D) GEO-DETECTION OF END-USER LOCATIONS WILL BE ACCURATE IN ALL CASES; OR (E) GENERATED DOCUMENTS OR AI-GENERATED CONTENT WILL BE ACCURATE, COMPLETE, OR SUFFICIENT FOR ANY LEGAL REQUIREMENT.
13. Limitation of Liability
13.1 Exclusion of Consequential Damages
TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT SHALL EITHER PARTY BE LIABLE TO THE OTHER PARTY FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, INCLUDING BUT NOT LIMITED TO LOSS OF PROFITS, REVENUE, DATA, BUSINESS OPPORTUNITIES, OR GOODWILL, REGARDLESS OF THE CAUSE OF ACTION OR THEORY OF LIABILITY, EVEN IF SUCH PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
13.2 Exclusion of Regulatory Fines
THIS EXCLUSION EXPRESSLY INCLUDES ANY REGULATORY FINES, PENALTIES, OR SANCTIONS IMPOSED ON CUSTOMER BY ANY GOVERNMENTAL OR REGULATORY AUTHORITY ARISING FROM CUSTOMER'S FAILURE TO COMPLY WITH APPLICABLE PRIVACY LAWS, REGARDLESS OF WHETHER CUSTOMER'S USE OF THE SERVICES CONTRIBUTED TO SUCH NON-COMPLIANCE.
13.3 Liability Cap
EXCEPT FOR THE CARVE-OUTS SET FORTH IN SECTION 13.4, CONSENTSTACK'S AGGREGATE LIABILITY ARISING OUT OF OR RELATING TO THIS AGREEMENT AND THE SERVICES (INCLUDING THE FREE TOOLS) SHALL NOT EXCEED THE GREATER OF: (A) THE TOTAL FEES PAID BY CUSTOMER TO CONSENTSTACK IN THE TWELVE (12) MONTHS IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO THE CLAIM; AND (B) ONE HUNDRED UNITED STATES DOLLARS ($100).
13.4 Carve-Outs
The limitations set forth in Sections 13.1 through 13.3 shall not apply to: (a) either party's gross negligence or willful misconduct; (b) either party's breach of its confidentiality obligations under Section 11; (c) Customer's payment obligations under Section 6; or (d) either party's indemnification obligations arising from infringement of third-party intellectual property rights under Section 14.
14. Indemnification
14.1 ConsentStack Indemnification
ConsentStack shall defend, indemnify, and hold harmless Customer from and against any third-party claim alleging that the Subscription Services, as provided by ConsentStack, infringe or misappropriate any third-party patent, copyright, trademark, or trade secret (an "IP Claim"). This obligation does not extend to claims arising from: (a) modifications made by Customer; (b) combination of the Services with products, services, or technologies not provided or contemplated by ConsentStack; (c) Customer's failure to use the most current version of the SDK when made available by ConsentStack; (d) Customer's use of the Services in violation of this Agreement; or (e) content Customer supplies, including Customer Data, policy generator answers, Customer's own wording, and custom code. This Section 14.1 does not apply to Sites on the Basic Plan, to the Free Tools, or to Open-Source Components.
14.2 IP Remediation
If the Subscription Services are found to infringe or if ConsentStack reasonably believes they may infringe, ConsentStack may at its option: (a) procure the right for Customer to continue using the Subscription Services; (b) modify the Subscription Services to make them non-infringing without material degradation of functionality; or (c) if neither (a) nor (b) is commercially practicable, terminate this Agreement or the affected Subscription Services and refund to Customer any prepaid fees for the unused portion of the current billing period of each affected paid Plan.
14.3 Customer Indemnification
Customer shall defend, indemnify, and hold harmless ConsentStack from and against any third-party claim arising from: (a) Customer Data or data collected from Customer's End Users; (b) Customer's implementation or use of the Services in violation of applicable law; (c) Customer's breach of this Agreement; (d) Customer's use of third-party integrations in connection with the Services; or (e) any claim by a client or website owner whose Site Customer manages in its Account (Section 17).
14.4 Indemnification Procedure
The indemnified party shall: (a) provide prompt written notice of the claim to the indemnifying party (provided that failure to provide prompt notice shall not relieve the indemnifying party of its obligations except to the extent materially prejudiced by such failure); (b) grant the indemnifying party sole control of the defense and settlement of the claim; and (c) provide reasonable cooperation to the indemnifying party at the indemnifying party's expense. The indemnifying party shall not enter into any settlement that imposes liability or obligations on the indemnified party without the indemnified party's prior written consent.
15. Term and Termination
15.1 Term
This Agreement begins on the Effective Date and continues until terminated in accordance with this Section 15 (the "Term"). Each paid Plan renews as set forth in Section 6.3.
15.2 Termination for Cause
Either party may terminate this Agreement upon written notice if the other party materially breaches this Agreement and fails to cure such breach within thirty (30) days of receiving written notice thereof. For non-payment, the cure period shall be five (5) business days. Either party may terminate this Agreement immediately upon written notice if the other party becomes subject to insolvency proceedings, makes an assignment for the benefit of creditors, or ceases to operate in the ordinary course of business.
15.3 Cancellation and Termination for Convenience
Customer may cancel a paid Plan at any time; cancellation takes effect at the end of the current billing period as Section 6.3 describes, and no refund is issued for that period. Customer may pause a Site, or delete a Site, an Account or its Login, at any time in the Dashboard; deletion takes effect immediately, cannot be undone, and does not entitle Customer to a refund. ConsentStack may terminate this Agreement for an Account without cause on thirty (30) days' prior written notice if none of the Account's Sites is on a paid Plan, and on ninety (90) days' prior written notice otherwise.
15.4 Effect on the SDK
Ending a paid Plan, whether by cancellation, non-payment or a change Customer makes, moves the Site to the Basic Plan. That does not terminate this Agreement, and the Site keeps running under the Basic Plan's limits, including Section 7.4. To stop the Services on a website, Customer must pause or delete the Site in the Dashboard and remove the SDK code from the website. Once a Site is paused or deleted, or this Agreement terminates, ConsentStack stops serving the Site's configuration, and deleting a Site, an Account or a Login also removes the Site's hosted configuration and policy files. Scripts and configurations already cached by browsers or by ConsentStack's network may keep running for a short time (up to about six minutes), after which the SDK fails gracefully: consent banners will not render, and script blocking will cease. ConsentStack does not guarantee the behavior of pinned SDK versions (such as consent.vX.js files) or of copies of the SDK that Customer hosts itself, which may keep running, or stop working, at any time. Customer acknowledges that if Customer leaves the SDK code on its websites, third-party scripts on those websites will execute without consent controls. Customer is solely responsible for removing all ConsentStack SDK code and references from its websites.
15.5 Data After a Plan Ends or Termination
When a paid Plan ends or a Site moves to a Plan with shorter retention, the thirty (30) day hold in Section 9.5 applies. When Customer deletes a Site, an Account or a Login, the related Customer Data is deleted immediately as Section 9.5 describes, so Customer should export anything it needs first. If this Agreement or an Account terminates in any other way, Customer may export Customer Data via the Dashboard or documented APIs for thirty (30) days after termination, after which ConsentStack will delete it. In each case, ConsentStack keeps records of acceptance of this Agreement and of any HIPAA BAA as evidence of the agreement, may keep other data as required by law or for legitimate business purposes such as billing records and dispute resolution, and deletes copies in backups as the DPA describes.
15.6 Termination for Customer Breach
If this Agreement is terminated by ConsentStack for Customer's material breach under Section 15.2, Customer shall remain liable for all fees due for the remainder of the current billing period of each paid Plan.
15.7 Survival
The following Sections shall survive any termination or expiration of this Agreement: 5 (Prohibited Uses); 6 (Fees and Payment), for fees accrued before termination; 8 (Intellectual Property), including the license to Generated Documents in Section 8.6, but not the licenses that Section 8.3 says end; 9 (Customer Data), solely with respect to data retention, deletion and ConsentStack Data; 11 (Confidentiality); 12 (Warranties and Disclaimers); 13 (Limitation of Liability); 14 (Indemnification); 15.4 through 15.7; 16 (Governing Law and Dispute Resolution); 21.6 (Hosting and Customer's License); 22 (Free Tools, Scanner and AI); and 23 (General Provisions).
16. Governing Law and Dispute Resolution
16.1 Governing Law
This Agreement shall be governed by and construed in accordance with the laws of the State of California, without regard to its conflict of laws principles.
16.2 Informal Resolution
Before initiating any formal proceeding, the parties shall attempt in good faith to resolve any dispute arising out of or relating to this Agreement through informal negotiation. The party raising the dispute shall provide written notice describing the nature of the dispute and proposed resolution. The parties shall negotiate in good faith for a period of one hundred twenty (120) days following such notice before commencing formal proceedings.
16.3 Binding Arbitration
If a dispute is not resolved through informal negotiation under Section 16.2, the dispute shall be resolved by final and binding arbitration administered by the American Arbitration Association ("AAA") under its Commercial Arbitration Rules then in effect. The arbitration shall be conducted by a single arbitrator in Orange County, California. The arbitrator's decision shall be final and binding, and judgment on the award may be entered in any court of competent jurisdiction. Each party shall bear its own costs and attorney's fees, unless the arbitrator determines that a party's claim or defense was frivolous, in which case the arbitrator may award reasonable attorney's fees to the prevailing party.
16.4 Small Claims Exception
Notwithstanding Section 16.3, either party may bring a claim in small claims court in Orange County, California, if the claim falls within that court's jurisdictional limits.
16.5 Class Action Waiver
CUSTOMER AGREES THAT ANY DISPUTE RESOLUTION PROCEEDINGS UNDER THIS AGREEMENT WILL BE CONDUCTED ONLY ON AN INDIVIDUAL BASIS AND NOT IN A CLASS, CONSOLIDATED, OR REPRESENTATIVE ACTION. THE ARBITRATOR MAY NOT CONSOLIDATE MORE THAN ONE PERSON'S CLAIMS AND MAY NOT OTHERWISE PRESIDE OVER ANY FORM OF A REPRESENTATIVE OR CLASS PROCEEDING.
16.6 Injunctive Relief Exception
Notwithstanding the foregoing, either party may seek injunctive or equitable relief in any court of competent jurisdiction to protect its intellectual property rights or Confidential Information without first engaging in the informal resolution or arbitration procedures set forth above.
17. Agencies and Service Providers
17.1 Managing Sites for Clients
An agency, consultant or other service provider (an "Agency") may use the Services to manage websites for its clients. An Agency may hold client Sites in its own Account, invite its clients to that Account as Authorized Users, and include ConsentStack's fees in what it charges its clients.
17.2 Authority and Responsibility
The Agency is the Customer for each Account it holds. Before it adds a client's website to the Services, deploys the SDK on it, or generates or publishes policies for it, the Agency must have the website owner's authority to do so and to have Consent Data collected and processed under this Agreement and the DPA. The Agency is responsible for having the agreements with its clients that applicable data protection laws require, and for its clients' use of the Services as if that use were its own. Fees for client Sites are the Agency's obligation whether or not its clients pay it.
17.3 No White-Label Resale
An Agency may not white-label, rebrand, or resell the Services as its own product or under another name, present itself as ConsentStack, or remove or obscure ConsentStack branding except as the Site's Plan allows (Section 7.5).
17.4 HIPAA BAA for Client Sites
An Agency that accepts the HIPAA BAA for a client's Site must be authorized by the client to do so and must name the correct legal entity when accepting it (Section 20).
17.5 Partner Program
If an Agency joins ConsentStack's partner program, the Partner Program Terms govern its commissions, referral benefits and conduct as a partner. Joining the partner program does not change the Agency's obligations under the rest of this Agreement.
18. APIs, MCP and AI Agents
18.1 Responsibility for Actions
ConsentStack offers programmatic access to the Subscription Services through the ConsentStack MCP server, which lets AI agents and other applications act in an Account, and through the APIs described in the Documentation. Customer is responsible for every action taken with its Authorized Users' Logins, sessions, tokens or API keys, and for every action taken by an AI agent or other application that an Authorized User connects, as if the Authorized User had taken it in the Dashboard. That includes publishing Site configurations, adding custom code, setting tracker categories, and publishing, updating or unpublishing policies. AI agents can make mistakes, and Customer should review the changes an agent proposes before approving them.
18.2 Credentials and Keys
Customer must keep tokens and API keys secure, must not place them in public code or share them outside Customer's organization, and must revoke them, or stop the connected application from using them, when they are no longer needed or may have been exposed. Customer must promptly notify ConsentStack of any unauthorized use. ConsentStack may suspend or revoke a token or key that it reasonably believes is compromised or misused.
18.3 Usage Limits
Programmatic access is subject to the rate limits, quotas and other limits described in the Documentation or applied by the Services to protect them. Customer must not attempt to circumvent those limits, including by spreading requests across multiple Logins, keys or Accounts.
18.4 Partner API Keys
ConsentStack may issue API keys to partners and other organizations for specific uses, such as running compliance scans. Those keys are provided on the terms ConsentStack issues with them, in addition to this Agreement, and ConsentStack may limit or revoke them at any time.
19. Concierge Setup and Staff Access
19.1 The Concierge
The ConsentStack Concierge (the "Concierge") is a setup and maintenance service included with the paid Plans that list it on the pricing page, and offered on other Plans at ConsentStack's discretion. At Customer's request in the Dashboard, ConsentStack adds the Concierge to the Account as a member with administrator-level access (shown as "ConsentStack Concierge"), which lets ConsentStack staff configure the Sites Customer names. The Concierge cannot delete the Account. The Compliance Guarantee requires that the Concierge set up a Site and keep its access while the Site is covered.
19.2 What the Concierge Does
Customer authorizes the Concierge to view, change and publish the configuration of those Sites, including the banner's appearance, tracker categories and regional settings, to advise on installation, and to keep the configuration current as Customer's websites and applicable regulations change. The Concierge works from the information Customer and its websites provide.
19.3 Customer Review
Customer remains responsible for reviewing what the Concierge publishes, for telling ConsentStack about changes to its websites, and for the decisions that are Customer's to make, such as which trackers or scripts to allow outside ConsentStack's blocking. For Sites covered by the Compliance Guarantee, the Concierge's configuration is covered as Section 4.2 and the Compliance Guarantee describe.
19.4 Removing the Concierge
Customer may remove the Concierge from the Account at any time on the Account's members page. Removing it ends the Concierge's access, and Compliance Guarantee coverage ends as the Compliance Guarantee describes.
19.5 Staff Access
Apart from the Concierge, ConsentStack staff access Customer Data only as needed to provide support Customer requests, to operate and maintain the Services (for example, to categorize trackers in the ConsentStack tracker catalog), to keep the Services secure and investigate abuse, and to comply with law, and only under the confidentiality obligations in Section 11 and the DPA.
20. HIPAA
20.1 HIPAA BAA Required
Customer must not use the Services in connection with protected health information ("PHI," as defined under the Health Insurance Portability and Accountability Act of 1996 and its regulations), or deploy the SDK on a website for which Customer or its client is a covered entity or business associate under those laws, unless the HIPAA BAA is in effect for that Site.
20.2 Availability
The Business Plan includes the HIPAA BAA. Sites on the Pro Lite, Pro and Pro+ Plans can add it as an add-on (Section 6.5). It is not available for Sites on the Basic Plan. The HIPAA BAA is accepted for each Site in the Dashboard by a person authorized to bind the legal entity named at acceptance.
20.3 No PHI in the Services
Even when the HIPAA BAA is in effect, Customer must not submit PHI to ConsentStack, including in Dashboard fields, policy generator answers, custom code, the addresses (including paths) of pages on which the SDK runs, or support messages, except as the HIPAA BAA allows.
20.4 End of the HIPAA BAA
The HIPAA BAA for a Site ends when the Site no longer has a Plan or add-on that includes it, when the Site is deleted, or when this Agreement terminates, as the HIPAA BAA describes. Customer must stop any use of the Services that requires the HIPAA BAA before it ends.
21. Policy Generator
21.1 The Policy Generator
On every Plan, including the Basic Plan, the policy generator creates a Privacy Policy, Cookie Policy, Terms of Service, Disclaimer and Accessibility Statement for a Site from Customer's answers and business profile and, for the Privacy Policy and Cookie Policy, from the trackers detected on the Site and ConsentStack's catalog information about them. ConsentStack hosts published Generated Documents and serves them to Customer's websites through hosted pages, embeds and the policy.js script.
21.2 Publishing and Automatic Updates
Customer authorizes ConsentStack to generate, host and publish the Generated Documents Customer chooses to publish, and to update a published Generated Document automatically when the facts it is built from change: for example, when a vendor is added or removed in a category the document already discloses, when cookie or catalog details change, when the links between Customer's published policies change, or when ConsentStack updates its templates. A change that affects Customer's legal position, such as disclosing a new category of data use, adding a vendor that sells data, or a template change that needs new answers, is not published automatically; ConsentStack asks Customer to review it first. Customer can unpublish a Generated Document at any time.
21.3 Customer Responsibilities
Customer is responsible for the accuracy and completeness of its answers, its business profile and its own wording (including custom sections and replaced wording), for reviewing each Generated Document before publishing it and after it is updated, and for making sure each published document matches Customer's actual practices. A Generated Document reflects what Customer tells ConsentStack and what the Services detect; trackers the Services do not detect, and practices outside the Services, are not reflected unless Customer adds them.
21.4 No Legal Advice and No Warranty
GENERATED DOCUMENTS ARE NOT LEGAL ADVICE, AND CONSENTSTACK MAKES NO WARRANTY THAT ANY GENERATED DOCUMENT IS ACCURATE, COMPLETE, OR SUFFICIENT FOR ANY LAW OR FOR CUSTOMER'S BUSINESS. CUSTOMER SHOULD HAVE QUALIFIED COUNSEL REVIEW ITS POLICIES WHERE APPROPRIATE. The Accessibility Statement makes no claim that a website conforms to any accessibility standard unless Customer states one in its answers, and it never presents an accessibility widget as what makes a website accessible.
21.5 Attribution and Version History
Hosted Generated Documents and policy embeds carry a ConsentStack attribution link. It always appears for Sites on the Basic Plan, and on paid Plans unless Customer turns ConsentStack branding off for the Site. ConsentStack keeps each published version of a Generated Document and, while the document is published, lists its versions publicly at the document's hosted address, with their dates and the reason for each change.
21.6 Hosting and Customer's License
ConsentStack hosts a published Generated Document, whatever the Site's Plan, until Customer unpublishes it, the Site is deleted, or this Agreement terminates. When hosting ends, pages that embed the document stop showing it. Customer's license to use the text continues as Section 8.6 describes.
22. Free Tools, Scanner and AI
22.1 Who This Section Applies To
This Section 22 applies to everyone who uses the Free Tools, whether or not they have an Account. If you use the Free Tools without an Account, you are the "Customer" for that use, and Sections 1, 5.1, 8.1, 8.4, 12.3, 12.4, 13, 14.3, 14.4, 16, 22 and 23 apply to you. The Privacy Policy describes how ConsentStack handles information you submit through the Free Tools.
22.2 Permitted Scanning
You may scan only websites that you own, that you are authorized to test, or that you are evaluating for a legitimate business purpose (for example, the website of a client, prospective client or business partner). The scanner loads public pages the way a visitor's browser would, from more than one region, and records the trackers, cookies, network requests and consent banner behavior it observes. You must not use the scanner to harass or harm a website owner, to test a website's security, or in breach of terms of a website that apply to you.
22.3 Scan Results and Reports
Scan results are automated and show what the scanner observed at one point in time. Websites change, and results can be incomplete or wrong. Each scan report is published on ConsentStack's website at an address based on the scanned domain, and the latest report for a domain (and in some cases an earlier one) can be viewed by anyone with that address, including people who scan the same domain later. Reports about websites other than ConsentStack's own are marked so that search engines do not index them. ConsentStack may use scan results to improve the Services and may publish findings from them in aggregated and de-identified form as research.
22.4 AI-Generated Content
Scan reports may include summaries and chat responses generated by AI. They are provided for information only, may contain errors or omissions, and are not legal advice. You are responsible for confirming your own compliance obligations, with qualified counsel where appropriate. You agree not to use the chat to submit unlawful content or personal information, to attempt to extract our system instructions, or to interfere with the feature.
22.5 Corrections and Takedown Requests
If you own or are responsible for a scanned website and believe a report about it is inaccurate, or want it removed, contact [email protected] with the report's address. ConsentStack will review the request and may rescan the website, correct or remove the report, or keep it as it is.
22.6 No Bulk or Automated Use
You may not use the Free Tools in bulk or by automated means, including through scripts or bots or by circumventing the scanner's human verification, except with an API key ConsentStack issues for that purpose (Section 18.4). You may not scrape or bulk-copy content from the Free Tools, including the vendor directory.
22.7 Changes and Availability
The Free Tools are provided free of charge and may be changed, limited, or withdrawn at any time, including the AI summaries and chat. Using the scanner or another Free Tool does not subscribe you to ConsentStack's newsletter; ConsentStack sends its newsletter only to people who choose to receive it.
23. General Provisions
23.1 Entire Agreement
This Agreement consists of: (a) these Terms of Service; (b) the Data Processing Agreement (the "DPA"), including the Standard Contractual Clauses it incorporates and the Sub-processor List; (c) for each Site for which it has been accepted, the HIPAA Business Associate Agreement (the "HIPAA BAA"); (d) for each Site it covers, the Compliance Guarantee (the "Compliance Guarantee"); (e) for members of ConsentStack's partner program, the Partner Program Terms (the "Partner Program Terms"); and (f) any Order Forms. This Agreement constitutes the entire agreement between the parties with respect to its subject matter and supersedes all prior or contemporaneous agreements, representations, and understandings, whether written or oral. The Privacy Policy explains how ConsentStack handles personal data as a controller; it is provided for information and is not part of this Agreement.
23.2 Order of Precedence
In the event of a conflict among the documents constituting this Agreement, the following order of precedence shall apply (from highest to lowest): (a) the Standard Contractual Clauses, for the data transfers they govern; (b) the HIPAA BAA, for protected health information; (c) the DPA, for personal data; (d) Order Forms; (e) the Compliance Guarantee, for its subject, and the Partner Program Terms, for the partner program; and (f) these Terms of Service.
23.3 Severability
If any provision of this Agreement is held to be invalid, illegal, or unenforceable, the remaining provisions shall remain in full force and effect. The invalid provision shall be modified to the minimum extent necessary to make it valid, legal, and enforceable while preserving the parties' original intent.
23.4 Waiver
The failure of either party to enforce any provision of this Agreement shall not constitute a waiver of that party's right to enforce that provision or any other provision in the future.
23.5 Assignment
Neither party may assign this Agreement without the prior written consent of the other party, except that either party may assign this Agreement without consent in connection with a merger, acquisition, corporate reorganization, or sale of all or substantially all of its assets, provided that the assignee agrees in writing to be bound by this Agreement. Any purported assignment in violation of this Section shall be void.
23.6 Force Majeure
Neither party shall be liable for any delay or failure to perform its obligations (other than payment obligations) caused by events beyond its reasonable control, including but not limited to acts of God, natural disasters, war, terrorism, pandemics, government orders or restrictions, labor disputes, internet or telecommunications failures, or third-party service outages. The affected party shall provide prompt written notice and shall use commercially reasonable efforts to mitigate the impact of the force majeure event.
23.7 Independent Contractors
The parties are independent contractors. Nothing in this Agreement creates a partnership, joint venture, agency, or employment relationship between the parties.
23.8 No Third-Party Beneficiaries
This Agreement is for the sole benefit of the parties and their permitted successors and assigns. Nothing in this Agreement confers upon any third party any right, benefit, or remedy.
23.9 Notices
All notices under this Agreement must be in writing and shall be deemed given when: (a) delivered by email with confirmation of receipt to the email address associated with the recipient's Login or Account (or, for ConsentStack, to [email protected]); (b) delivered by nationally recognized overnight courier; or (c) sent by certified or registered mail, return receipt requested. ConsentStack may also provide notices through the Dashboard, and may send service, billing and security messages about Customer's Accounts by email and in the Dashboard.
23.10 Export Compliance
Customer shall not use or export the Services in violation of applicable United States export control laws and regulations, including the Export Administration Regulations (EAR) and sanctions programs administered by the Office of Foreign Assets Control (OFAC).
23.11 Government Use
If Customer is a United States government entity, the Services are provided as "commercial computer software" and "commercial computer software documentation" as defined in FAR 12.212 and DFARS 227.7202. Use, duplication, or disclosure by the U.S. government is subject to the restrictions set forth in this Agreement.
23.12 Contact Information
ConsentStack LLC 23046 Avenida De La Carlota, Suite #600 Laguna Hills, California 92653 Email: [email protected]