Consentl for websites — privacy policy
Version 1.0 · Effective: 2026-10-23
This policy explains how personal data is processed in connection with Consentl for websites: the Consentl dashboard at app.consentl.com, the Consentl service at api.consentl.com that shows the consent banner and receives consent records, privacy requests and withdrawals on our customers' websites, and the plugins and templates we publish for website platforms (website snippet, Google Tag Manager, WordPress and WooCommerce, Shopware, PrestaShop, Magento), and the legal document packs sold from the legal document generator on consentl.com. It applies to our customers and their team members, to people who buy a legal document pack, to people who contact us and, as far as we process their data on a customer's behalf, to visitors of websites that use Consentl.
It does not cover the Consentl app for Shopify, which has its own privacy policy, or visits to consentl.com itself, which are described in our website privacy notice.
1. Who we are
- Provider and controller: STL EMBEDED CREATIONS SRL, Str. Kovari 75, 400217 Cluj-Napoca, Cluj, Romania; trade register no. J2020001305120; fiscal code (CUI) 42512332; not registered for VAT (intra-Community VAT code RO46686340).
- Privacy contact: [email protected].
- Data protection officer: none appointed. Data protection is handled by STL EMBEDED CREATIONS SRL itself; for all privacy matters, write to the address above.
- We are established in the EU, so we have no representative under Art. 27 GDPR. Our competent supervisory authority is the Romanian ANSPDCP (section 9).
2. Our roles
- Controller. We decide how data about our customers (the people and businesses who open a Consentl account), their team members, buyers of a legal document pack and people who contact us is processed: account and sign-in, security, billing, the purchase of legal document packs, service e-mails and support (section 3).
- Processor. When the Consentl service records consent, receives privacy or withdrawal requests, sends e-mails to a website's visitors or scans a website for cookies, we act on behalf of the website owner (our customer), who is the controller (section 4). This processing is governed by our Data Processing Addendum (Schedule 2). If you are a visitor of a website that uses Consentl, please contact that website to exercise your rights; we help the website owner to answer. Under the California Consumer Privacy Act we are the website owner's service provider, and under other US state laws its processor.
- On consentl.com we use Consentl ourselves; for the consent records of our own website we are the controller (website privacy notice).
3. Data we process as controller
| Purpose | Data | Source | Legal basis | Retention |
|---|---|---|---|---|
| Account, sign-in and team | E-mail address, name, password (stored only as a scrypt hash), dashboard language, date of e-mail verification; account name (for a business: the business name); whether you act as a business or as a consumer; role in the account (owner, admin, member); the notice address you set for data protection notices and when it was confirmed; whether the account and each site used a free trial; a requested account deletion and its date | You, at sign-up and in the dashboard | Contract, Art. 6(1)(b) GDPR | Until the account is deleted (section 8). If the e-mail address of a sign-up is never confirmed, the user, an account that belongs only to that user (if it has no site and no subscription) and its acceptance records are deleted automatically 30 days after the sign-up. Accounts that are confirmed but no longer used are not deleted automatically (their banners may still run). |
| Sessions and security | Session (a hash of the session token, browser user agent, IP address shortened to its network part, times of creation, last use and last password confirmation, expiry); single-use tokens for e-mail verification and password reset (stored only as hashes); a signed device cookie that lets a browser that signed in before keep its own sign-in limit; sign-in rate limits by IP address (in memory only) | Your browser | Contract, Art. 6(1)(b); our legitimate interest in protecting accounts against attacks, Art. 6(1)(f) | Sessions: 30 days, or 7 days without use, then deleted; tokens: 3 days (verification) or 1 hour (reset), deleted one day after expiry; rate-limit entries: in memory only, not written to the database |
| Site configuration | Site name, host names, platform, banner and region settings, languages, time zone, the site's contact e-mail address and the date it was confirmed; the answers and published versions of documents you create with the legal document generator (Business plan), which can include names and contact details you enter; on Enterprise, HTTP basic-auth credentials for scanning a protected site (encrypted with AES-256-GCM) | You | Contract, Art. 6(1)(b) | Until you delete the document, the site or the account |
| Billing | Stripe customer and subscription IDs, plan, status, billing interval, start of the subscription, end of the current period, cancellation at period end, whether you act as a business or as a consumer; at Stripe: name, e-mail address, payment method details, billing address and, if you give it, your tax ID | You, through Stripe Checkout and the Stripe customer portal | Contract, Art. 6(1)(b); our legal obligations in accounting and tax, Art. 6(1)(c) | While you have a subscription; invoices and accounting records for the period Romanian accounting law requires, up to 10 years (Law 82/1991 art. 25). To be confirmed: our accountant is confirming the exact period. |
| Purchase of a legal document pack | Order: the answers you give in the questionnaire of the legal document generator on consentl.com, which describe your business and can contain personal data of you and of people you name (for example a contact person, a data protection officer or a representative: names, e-mail and postal addresses, telephone numbers); the document types of the pack; the order token (stored only as a hash), status and times; whether you buy as a business or as a consumer, and the business name; the statements you tick on the checkout page (which statement, its version, a hash of the exact text, language and time; no IP address); IP addresses held in memory to limit the number of orders per address. Payment: at Stripe your e-mail address, name, billing address, payment method details and, if you give it, your VAT ID; with us the Stripe customer, payment and invoice IDs, the invoice or receipt link, the amount, the currency and the date of payment. Pack: the generated documents (which contain your answers), the end of the 12-month update period, the number of regenerations and when the confirmation e-mail was sent. The pack is added to the account of the e-mail address you enter at Stripe; if there is none, we create one (see "Account" above) | You, on consentl.com and on our checkout page; Stripe | Contract, Art. 6(1)(b) GDPR: the order (steps before the contract), the supply of the pack, its updates and regeneration, and the account in which you receive it; legal obligation, Art. 6(1)(c): invoices and accounting; our legitimate interests, Art. 6(1)(f): proving the statements accepted at checkout and protecting the order form against misuse | Unpaid orders and their answers are deleted 1 hour after the order expires: orders expire 24 hours after they are created, or, while a payment method that confirms later is still being confirmed, 14 days after the payment was started. Paid orders: the order record (without the answers, which move to the pack) is deleted 7 days after payment. The answers of a pack are kept so that you can regenerate the documents: during the 12-month update period, and afterwards only while the account has a website on a plan that includes the legal document generator (Business or Enterprise); then they are deleted automatically (checked every 6 hours). The pack and its documents are kept until the account is deleted (section 8); an account created for a purchase is not deleted after 30 days if it is never activated (unlike an unconfirmed sign-up), because it holds a performed contract: ask us if you want it deleted. Acceptance records as in the next row. Invoices and payment records as in "Billing" above. Rate-limit entries: in memory only, not written to the database or to logs |
| Acceptance records and consumer withdrawals | Which version of our Terms, privacy policy and Data Processing Addendum and which express-acceptance statement you accepted, in which language, and when (a hash of the exact text shown; no IP address); your express request that the service starts during the withdrawal period; if you are a consumer and withdraw from a paid subscription: the subscription, plan, date of the contract, time of the withdrawal and the refund | You, at sign-up, at checkout and in the withdrawal function | Contract, Art. 6(1)(b); legal obligation, Art. 6(1)(c); our legitimate interest in proving the contract, Art. 6(1)(f) | For the duration of the contract and 3 years after the account is deleted (the general limitation period, Romanian Civil Code art. 2517), then deleted automatically. When the account is deleted, these records are kept with the account reference and the e-mail address of the person who accepted or withdrew, and nothing else of the account. Records of a sign-up whose e-mail address was never confirmed are deleted with it after 30 days (see "Account" above) |
| Service e-mails | Your e-mail address, the site name and the content of the message: account e-mails (verification, password reset, notice that someone tried to register your address), confirmation of a notice address or a site contact address, new privacy request, new withdrawal, scan report, confirmation of a paid subscription, acknowledgement of a withdrawal from a subscription, confirmation of the purchase of a legal document pack (with the download link, the invoice link and the purchase terms), account deletion (scheduled, cancelled, done), notices of changes to our terms or sub-processors | Account and site data above | Contract, Art. 6(1)(b) | Not kept by us after sending; Brevo keeps delivery logs (section 6) |
| Support | Name, e-mail address and content of the messages you send us | You | Contract, Art. 6(1)(b), or our legitimate interest in answering enquiries, Art. 6(1)(f) | 3 years after the enquiry is closed: we review the mailboxes once a year and delete correspondence closed more than 3 years before, unless a longer period is needed to establish or defend legal claims |
| Legal obligations and legal claims | The data needed for the request or the claim | The categories above | Legal obligation, Art. 6(1)(c); our legitimate interest in establishing, exercising or defending legal claims, Art. 6(1)(f) | As long as the obligation or the limitation period requires (generally 3 years) |
| Operation of the service and security of the public API | Access log of the dashboard and the API (method, path without query string, status, duration; no IP address); request metadata processed by our hosting provider, including IP addresses; IP addresses held in memory for rate limiting | Requests to our servers | Our legitimate interest in a secure and available service, Art. 6(1)(f) | We do not store or export request logs. The access log is written only to the output of the running application; our hosting provider keeps that output (runtime logs) only while the application runs and clears it when we deploy a new version. Build and deployment logs, which contain no visitor or customer data, are kept by DigitalOcean for 90 days. Request data at the edge network (Cloudflare, engaged by DigitalOcean) is kept by the provider under its own terms. To be confirmed: DigitalOcean is confirming the retention period of the edge network. Rate-limit entries: in memory only, never written to the database or to logs; they can remain in memory after the limit window until the table is cleaned up or the server restarts |
| Internal administration and statistics | Account and user e-mail addresses and names, roles, last activity, sites with host names, platform, plan and subscription status, aggregated counts (banner views, decisions, scans, requests); for the operators' own access: an audit log with the operator's account, the page viewed, a shortened IP address and the user agent | The data above | Our legitimate interest in running, supporting and planning the service, Art. 6(1)(f) | Shown live from the data above, not copied; audit log entries: deleted automatically after 2 years |
| Plugin status check | Site key, the site's host name, language | The plugin on your website | Contract, Art. 6(1)(b) | Not stored |
| Plugin updates (WordPress plugin from consentl.com) | Your server's IP address and the plugin version (in the user agent) when your WordPress asks consentl.com for a new version, about twice a day; no site key, site address or visitor data | Your web server | Our legitimate interest in delivering updates you can install, Art. 6(1)(f) | Only in the request data of our website's hosting provider (see the website privacy notice) |
Legitimate interests. Where we rely on Art. 6(1)(f), our interests are keeping accounts and the service secure and available, preventing abuse of the public forms and endpoints, answering enquiries and proving the contract. You can object at any time (section 9).
Is providing the data required? An e-mail address and a password are needed to open an account, and billing data to buy a paid plan. To buy a legal document pack, the answers its documents need, an e-mail address and the payment data are needed. Without them we cannot provide the service. Contacting support is voluntary.
Dashboard cookies. The dashboard uses only strictly necessary cookies: __Host-consentl_s
(sign-in session, 30 days), __Host-consentl_csrf (protection against cross-site request forgery,
1 year), __Host-consentl_d (device cookie for the sign-in limit, 1 year) and __Host-consentl_lang
(the language you chose in the language selector of the sign-in, sign-up or checkout pages, until you
close the browser; set only when you choose a language). It uses no analytics
or advertising tools. Stripe Checkout and the customer portal are pages of Stripe, which sets its own
cookies there under its own policy.
We do not use your account data for advertising, do not sell it and do not make it available to third parties for their own purposes.
4. Data we process on behalf of website owners
The website owner decides whether and how these functions are used and is responsible for informing its visitors (for example in its own privacy and cookie policy). The legal basis is the website owner's; we process the data only on its documented instructions. Full details are in Annex I-B of the Data Processing Addendum.
| Category | Data | Retention |
|---|---|---|
| Consent records (proof of consent) | Pseudonymous consent ID (a random value that is also stored in the visitor's consentl cookie, so a record can be linked to that browser), date and time, action (accept all, reject all, custom, close, opt-out signal, implied), choices per category, region code, country (only when a network provider in front of our servers supplies it; not the case on our current hosting), language, banner configuration revision, website host name, page path (without query string), IP address shortened to its network part (IPv4 /24, IPv6 /48), browser user agent, Global Privacy Control signal |
Deleted automatically when older than the site's retention period: the plan's period (Free and Pro 425 days, Business 730 days, Enterprise 1,825 days), but never less than the consent lifetime the website owner set plus 30 days. After a change to a plan with a shorter period, the previous period applies for 30 more days. All records are deleted when the site is deleted |
| Region lookup | To apply the rules for the visitor's region, the script asks our service for the visitor's country. The service looks the IP address up in a local copy of the DB-IP Lite country database, in memory; nothing is sent to another provider. The answer is the country code (US states are not told apart) | Not stored and not logged; the region the banner applied is part of the consent record above and is kept in the visitor's browser for the session (consentl_r, section 5) |
| Banner views and statistics | Counters per site and day (views and decisions, A/B variant). Nothing is sent before the visitor decides; a view is counted together with the visitor's first decision after the banner was shown, without any identifier | 2 years, then deleted automatically; all counters are deleted when the site is deleted |
| Privacy requests (access, copy, correction, deletion, opt-out of sale/sharing) | Request type, e-mail address, optional name and message, language, region and applicable law, status, deadline, hash of the e-mail verification token, dates, the website owner's notes | Requests whose e-mail address was never confirmed: deleted 30 days after submission. Every other request, whatever its status: deleted automatically 3 years after its last change, or when the site is deleted; we delete individual requests earlier on the website owner's written instruction |
| EU withdrawal requests (Directive (EU) 2023/2673) | Order reference, e-mail address, name, the items concerned, language, status, time of the acknowledgement e-mail, the website owner's notes | Deleted automatically 3 years after the last change, or when the site is deleted |
| E-mails to visitors | E-mail address and content of verification, confirmation and acknowledgement e-mails, sent through Brevo. Replies go to the website's confirmed contact address where one is set, otherwise to our mailbox (section 6) | Not kept by us after sending; delivery logs at Brevo |
| Cookie scans | Names, domains, categories and lifetimes of cookies and storage items, third-party hosts and hard-coded tags, observed when our scanner visits the website as an anonymous visitor from Frankfurt (EU) | The latest scan of a site is kept until the site is deleted; earlier scans are deleted automatically 400 days after they ran; cookie entries until the website owner deletes them or the site is deleted |
We do not use visitors' data for our own purposes, do not combine it across websites and do not sell or share it.
5. What the Consentl script stores on visitors' devices
On a website that uses Consentl, the script stores a few items in the visitor's browser. They belong in the website's cookie declaration; the built-in cookie database lists them.
| Name | Type | Purpose | Lifetime |
|---|---|---|---|
consentl |
cookie | Stores the visitor's cookie choices and the consent ID | as set by the website owner (default 180 days, at most 395) |
consentl_r |
session storage | Remembers the region for the consent banner during the visit | browser session |
consentl_ab |
session storage | Keeps the visitor in the same banner variant on the following pages of the visit while the website owner runs an A/B test of the banner (only when a test runs; written only after the visitor's choice) | browser session |
consentl_age |
cookie | Remembers that the visitor confirmed their age (only if the website uses the age check) | as set by the website owner (default 30 days) |
consentl_a11y |
local storage | Remembers display settings the visitor chose in the accessibility menu (only if used) | until the visitor resets them |
__cf_bm |
cookie of api.consentl.com, set by the network of our hosting provider (Cloudflare, engaged by DigitalOcean) |
Distinguishes people from automated traffic to protect the service; we do not read or use it | 30 minutes |
The script also sends requests to api.consentl.com: it loads the banner, asks for the visitor's
country (section 4, "Region lookup"), sends nothing else before the visitor makes a choice, then sends
the consent record (with it, without any identifier, a note that the banner was shown), and loads the
cookie list when the visitor opens it. Our analysis of what happens before consent is available to website owners on request.
6. Recipients and sub-processors
We use the following service providers. The current list, with the transfer safeguards and the change log, is on our sub-processor list; website owners are told by e-mail 30 days before a new sub-processor is added.
| Recipient | Role | Purpose | Location |
|---|---|---|---|
| DigitalOcean, LLC (New York, USA) | Processor | Hosting, databases and backups, scanner, logs | Frankfurt, Germany; remote access from third countries under its DPA |
| Cloudflare, Inc. (USA), engaged by DigitalOcean | Processor (sub-processor of DigitalOcean) | TLS termination, content delivery, DDoS and bot protection for requests to our servers (including the __cf_bm cookie, section 5) |
Global edge network |
| Brevo SAS (Paris, France) | Processor | Sending e-mails | European Union |
| Proton AG (Geneva, Switzerland) | Processor | E-mail hosting of our [email protected] and [email protected] mailboxes: support and privacy correspondence, replies to our e-mails and requests that website owners forward to us | Switzerland |
| Stripe Payments Europe, Limited (Dublin, Ireland) | Processor for payment processing on our behalf, and independent controller for fraud prevention and its legal duties | Payments of subscriptions and of legal document packs, invoices, refunds, payment-page and billing-portal e-mails | EU; Stripe may transfer data to Stripe, Inc. (USA) under its own safeguards |
| The website owner | Controller | Receives the consent records, requests and withdrawals of its visitors (section 4) | — |
| Authorities | Independent controllers | Where we are legally required to disclose data (for example to tax authorities for invoices) | — |
7. International transfers
Our servers and databases are in the EU (Frankfurt). Some providers are US companies, and requests pass through the edge location nearest to the visitor, which can be outside the EU. Where personal data is transferred to, or can be accessed from, a country without an adequacy decision, the transfer is covered by the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) in the provider's data processing agreement and, where the recipient is certified, also by the EU-US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795). For the UK, the UK Addendum or the UK Extension to the Data Privacy Framework applies; for Switzerland, the Swiss-US Data Privacy Framework or the Standard Contractual Clauses with the adaptations recognised by the Swiss FDPIC. Switzerland (Proton) has an EU adequacy decision. You can ask us for a copy of the safeguards.
8. Retention and deletion
Retention periods are listed in sections 3 and 4.
- Deleting a site deletes its configuration, consent records, statistics, privacy requests, withdrawals, cookie list, scans and generated documents at once. Export what you need first (the consent log can be exported as CSV).
- Ending a paid plan moves the site to the Free plan; its data stays available.
- Downloading your data: "Download my data (JSON)" on the Account page gives you a JSON file with your user and account data, the acceptance records, the withdrawals from subscriptions, the legal document packs with their answers, and every site with its settings, cookie list, privacy requests, withdrawals and consent log (never passwords, tokens or scan credentials).
- Deleting your account: the account owner can delete the account on the Account page, after cancelling paid plans, or ask us at [email protected]. The account stays available for 30 days (to export data or cancel the deletion; banners keep working), then we delete the account, all its sites with their data, its legal document packs with their documents and answers, and the users who belong to no other account. The acceptance records and withdrawals from subscriptions are kept for 3 more years (section 3). Invoices and payment records stay at Stripe as accounting law requires.
- Deleted data disappears from the database backups within 7 days (the backup retention of our managed database). Runtime logs are cleared at the next deployment (section 3).
- Billing records that accounting law requires us to keep are kept for that period (section 3).
9. Your rights
Under the GDPR and the UK GDPR you have the right to:
- access your personal data and receive a copy (Art. 15);
- have inaccurate data corrected (Art. 16); you can correct most account data in the dashboard;
- have your data erased (Art. 17);
- restrict processing (Art. 18);
- receive the data you gave us on the basis of a contract in a machine-readable format and have it transmitted to another controller (Art. 20); "Download my data (JSON)" on the Account page does this for your account;
- object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests (Art. 21);
- lodge a complaint with a supervisory authority, in particular in the EU country where you live, work or where the alleged infringement took place (Art. 77). Our competent authority is the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28-30, 010336 București, Romania — www.dataprotection.ro (external site).
The dashboard does not rely on consent, so there is no consent to withdraw there.
To exercise your rights, write to [email protected] from the address of your account. We answer within one month; this can be extended by two further months for complex requests, in which case we tell you why. Residents of other jurisdictions (for example US states, Brazil, Canada) can use the same address for the rights their laws give them.
Visitors of a website that uses Consentl should contact that website first (section 2). If you write to us, we forward your request to the website owner and help it to answer.
10. Automated decision-making
We do not make decisions based solely on automated processing that produce legal or similarly significant effects (Art. 22 GDPR). Stripe screens payments for fraud and may decline a payment; see Stripe's privacy policy. If a payment is declined, you can ask us or Stripe for a review by a person.
11. Children
The dashboard is meant for adults and is not directed at children; we do not knowingly open accounts for persons under 18. Visitors of our customers' websites may include minors; the website owner decides how to handle them (for example with an age check).
12. For website owners subject to US state privacy laws
As your service provider (CCPA) or processor (other US state laws), Consentl collects for you: identifiers (pseudonymous consent ID, shortened IP address), internet activity (page path, browser user agent, Global Privacy Control signal), geolocation at country level (derived from the IP address without storing it) and, for privacy requests and withdrawals, contact details and order references. We use them only to record consent and handle requests for you, keep them for the periods in section 4, and do not sell or share them or use sensitive personal information.
13. Security
Passwords are hashed with scrypt; session, verification and reset tokens are stored only as hashes; sessions expire after 7 days without use; every dashboard form is protected against cross-site request forgery; sensitive actions need a recent password confirmation; the dashboard and the public API run on separate hosts; scan credentials are encrypted with AES-256-GCM; visitor IP addresses are shortened before storage; the service uses dedicated database users with limited rights; all traffic is encrypted (TLS) and the databases and backups are encrypted at rest. Details are in Annex II of the Data Processing Addendum.
14. Changes and language
When this policy changes, we publish a new version with its effective date above, and tell account owners and admins about material changes by e-mail before they take effect. This policy is written in English, and we publish translations of it on our website; if you need it in another official EU language, write to us. If a translation differs from the English version, the English version prevails, except where the mandatory consumer law of your country requires otherwise. If you are a consumer, the version in an official language of your country of habitual residence, where we publish one, is equally authentic with the English version; if the two versions differ, the meaning more favourable to you applies. Nothing in this clause limits the information you are entitled to receive in your language.
Source: docs/legal/SAAS-PRIVACY.md in the Consentl repository.