Consentl privacy policy
Last updated: 2026-10-21
This policy explains how personal data is processed in connection with Consentl, a Shopify app for cookie consent and privacy requests. It applies to merchants who install the app and their staff, to people who contact us, and, as far as we process their data on a merchant’s behalf, to visitors and customers of stores that use the app.
1. Who we are
- Provider and controller: STL Embeded Creations — STL EMBEDED CREATIONS SRL
- Address: Str. Kovari 75, 400217 Cluj-Napoca, Cluj, Romania
- Trade register no.: J2020001305120; fiscal code (CUI): 42512332; VAT: Not registered for VAT (CUI 42512332); intra-Community VAT code RO46686340
- Privacy contact: [email protected]
- Data protection officer: TODO(owner): DPO contact, or confirm "no DPO appointed (not required under Art. 37 GDPR)"
- Representative in the EU (Art. 27 GDPR): Not required: the provider is established in the EU (Romania).
2. Our roles
- Controller. We decide how data about merchants, their staff and people who contact us is processed (section 3).
- Processor. When the app records consent, receives privacy or withdrawal requests or sends e-mails to shoppers, we act on behalf of the merchant, who is the controller (section 4). This processing is governed by our Data Processing Addendum (TODO(owner): published URL of docs/legal/DPA.md (e.g. https://consentl.com/legal/dpa)). If you are a visitor or customer of a store, please contact the store to exercise your rights; we help the merchant answer. Under the California Consumer Privacy Act we act as the merchant’s service provider.
- Shopify provides the platform. It is not our sub-processor: it processes data under its own privacy policy, and it bills merchants for the app as an independent controller.
3. Data we process as controller
| Purpose | Data | Source | Legal basis | Retention |
|---|---|---|---|---|
| Providing the app to the merchant (installation, settings, plan features) | Shop domain, shop name, shop contact e-mail, country, time zone, published languages, storefront domains, current plan, app installation ID, app settings, public shop key | Shopify Admin API at installation and on shop updates; the merchant in the app | Performance of the contract with the merchant, Art. 6(1)(b) GDPR | While the app is installed; deleted when Shopify sends the shop/redact notification (48 hours after uninstall) |
| Authenticating the merchant's staff in the Shopify admin | Shop-level (offline) Shopify access and refresh tokens; the staff member's Shopify user ID contained in the App Bridge session token (verified on each request, not stored); the admin language chosen in Shopify | Shopify (OAuth token exchange, App Bridge) | Contract with the merchant, Art. 6(1)(b); for staff members, our and the merchant's legitimate interest in secure access, Art. 6(1)(f) | Tokens: until they expire or the app is uninstalled (deleted immediately at uninstall). User IDs: not stored |
| Billing and plan management | Name of the active subscription plan | Shopify App Pricing | Contract, Art. 6(1)(b). Shopify charges the merchant as an independent controller under its own terms | While the app is installed (plan name only) |
| Service e-mails to the merchant (new privacy request, new withdrawal, scan report) | Shop contact e-mail, shop name, the content of the notification | Shop data above | Contract, Art. 6(1)(b) | Not kept by us after sending; delivery logs at Brevo (see Sub-processors) |
| Scanning password-protected stores (Enterprise) | Storefront password entered by the merchant, encrypted with AES-256-GCM | The merchant | Contract, Art. 6(1)(b) | Until the merchant removes it or the shop is deleted (shop/redact) |
| Support | Name, e-mail address and content of messages you send us | You | Contract, Art. 6(1)(b), or legitimate interest in answering enquiries, Art. 6(1)(f) | Up to 3 years after the enquiry is closed, unless a longer period is needed to establish or defend legal claims |
| Security, abuse prevention and operation of the service | Application logs (shop domain, error messages, job results); request metadata processed by our hosting platform, including IP addresses; visitor IP addresses held in memory for up to 60 seconds for rate limiting (never written to the database) | Requests to our servers | Legitimate interest in a secure and available service, Art. 6(1)(f) | Rate-limit counters: 60 seconds. Platform and application logs: as set by our hosting provider (TODO(owner): confirm the DigitalOcean App Platform log retention). Database backups: up to 7 days (TODO(owner): confirm the backup retention of the managed database) |
Legitimate interests. Where we rely on Art. 6(1)(f), our interests are keeping the service secure and available, preventing abuse of public endpoints, giving merchants’ staff secure access and answering enquiries. You can object to this processing at any time (section 8).
Is providing the data required? Shop data and access tokens are needed to provide the app; without them the app cannot be installed. Contacting support is voluntary.
4. Data we process on behalf of merchants
The merchant decides whether and how these functions are used and is responsible for informing visitors (for example in the store’s own privacy and cookie policy). The legal basis is the merchant’s; we process the data only on the merchant’s documented instructions. Full details are in Annex I of the Data Processing Addendum (TODO(owner): published URL of docs/legal/DPA.md (e.g. https://consentl.com/legal/dpa)).
| Category | Data | Retention |
|---|---|---|
| Consent records (proof of consent) | Random consent ID, date and time, action (accept all, reject all, custom, close, opt-out signal, implied), choices per category, region code, country (only when a network provider in front of our servers supplies it), language, banner configuration revision, identifier (hash) of the banner texts and settings shown, A/B test variant, page path, shortened IP address (IPv4 /24, IPv6 /48), browser user agent, Global Privacy Control signal | Deleted automatically (job every 6 hours) when older than the shop's retention period: the plan's period (Free: 425 days; Pro: 425 days; Business: 730 days (2 years); Enterprise: 1,825 days (5 years)), but never less than the consent lifetime set by the merchant plus 30 days (at most 425 days), so the proof exists as long as a consent is used. If a merchant moves to a plan with a shorter period, the previous period still applies for 30 days and the app asks the merchant to export the records first. The banner texts and settings that were shown are kept as long as a record refers to them. All records are deleted at shop/redact |
| Banner views and aggregated statistics | Counters per shop and day (views and decisions, A/B variant). A view is sent from the visitor's browser when the banner is shown; the IP address is used only for rate limiting and is not stored | Daily and A/B counters: 2 years |
| Region lookup and cookie declaration requests | Requests from the visitor's browser to /api/geo (country only, when Shopify does not provide the region) and /api/cookies (the shop's cookie list). We do not store these requests | Not stored (see the security row above for platform logs) |
| Privacy requests (access, copy, correction, deletion, objection, restriction, withdrawal of consent, opt-out of sale/sharing, appeal) | Request type, e-mail address, optional name and message, authorised-agent flag, language, applicable law and region class, status, deadline, extension or rejection reason, hash of the e-mail verification token, hash of the e-mail address, dates, Shopify customer ID of the logged-in customer who sent it, the merchant's notes. For an opt-out of sale/sharing, and for a Global Privacy Control signal of a logged-in customer, the e-mail address is passed to Shopify so the opt-out is also recorded on the Shopify customer | Requests whose e-mail address was never confirmed: deleted 30 days after submission. Other requests: kept so the merchant can document how they were handled; the merchant can delete a closed request after 2 years, and closed requests are deleted automatically 3 years after closing. When Shopify sends customers/redact, unconfirmed requests are deleted and handled ones are minimised: name, e-mail address, message, notes and customer ID are removed; type, dates, status, law and a hash of the e-mail address are kept as evidence that the request was handled. The data Shopify sends with customers/data_request is kept 90 days for the merchant (a record with counts only remains for 3 years). Everything is deleted at shop/redact |
| EU withdrawal requests (Directive (EU) 2023/2673) | Order number, e-mail address, name, the items concerned, language, status, time of the acknowledgement e-mail, the merchant's notes | Closed withdrawals (rejected or refunded): the merchant can delete them after 2 years; deleted automatically 3 years after the last change. At customers/redact, name, e-mail address and notes are removed; order reference, items, status and dates are kept as evidence for refund disputes. Everything is deleted at shop/redact |
| E-mails to shoppers | E-mail address and content of verification, confirmation and withdrawal acknowledgement e-mails, sent through Brevo | Not kept by us after sending; delivery logs at Brevo |
| Customer and order data (optional, only if the merchant enables one-click privacy actions) | The requester's Shopify customer profile and orders, read through the Shopify Admin API when the merchant exports them; erasure requests forwarded to Shopify | Not stored by us |
| Cookie scans | Names, domains, categories and lifetimes of cookies and storage items, and third-party hosts, observed when our scanner visits the storefront as an anonymous visitor from Frankfurt (EU) | Until the merchant deletes them or shop/redact |
The storefront script also stores a few items in the visitor’s browser (the consentl cookie with the visitor’s choice, the detected region for the current session, and, if used, age-confirmation and accessibility preferences). They belong in the store’s cookie declaration as strictly necessary; the analysis is documented for merchants. We do not use the visitor’s data for our own purposes, do not combine it across stores, and do not sell or share it.
5. Recipients and sub-processors
We use the following sub-processors. The current list and its change log are published at our sub-processor page (TODO(owner): published URL of docs/legal/SUBPROCESSORS.md (e.g. https://consentl.com/legal/subprocessors)); merchants are notified by e-mail before a new sub-processor is added.
| Sub-processor | Purpose | Location of processing | Transfer safeguard |
|---|---|---|---|
| DigitalOcean, LLC (New York, USA) | Hosting (App Platform), managed PostgreSQL database and backups, scanner worker, logs | Frankfurt, Germany (region fra1) | Data stored in the EU. Possible access from the USA covered by DigitalOcean's data processing agreement with the EU Standard Contractual Clauses and, where certified, the EU-US Data Privacy Framework (TODO(owner): confirm certification) |
| Cloudflare, Inc. (San Francisco, USA), engaged by DigitalOcean for the App Platform edge | TLS termination, content delivery, DDoS protection, country detection for requests to our servers | Global edge network (the data centre nearest to the visitor) | EU-US Data Privacy Framework and Standard Contractual Clauses (TODO(owner): confirm that App Platform routes through Cloudflare and that Cloudflare is listed as a DigitalOcean sub-processor) |
| Sendinblue SAS (Brevo), Paris, France | Sending transactional e-mails | European Union | No transfer by us (EU provider). Brevo's own sub-processors are listed by Brevo |
We may also disclose data to authorities where we are legally required to do so. We do not use advertising or analytics tools in the app.
6. International transfers
Our database and servers are in the EU (Frankfurt). Some providers are US companies, and edge processing happens in the data centre nearest to the visitor. Where personal data is transferred to, or can be accessed from, a country without an EU adequacy decision, the transfer is covered by the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) or by the EU-US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795) for certified recipients. For the UK, the UK International Data Transfer Addendum or the UK Extension to the Data Privacy Framework applies. You can ask us for a copy of the safeguards at [email protected].
7. Retention
Retention periods are listed in sections 3 and 4. When the app is uninstalled, the access token is deleted immediately and all other shop data, including consent records, privacy requests and withdrawals, is deleted when Shopify sends the shop/redact notification, 48 hours later. Merchants who need to keep proof of consent or request records for longer should export them (CSV) before uninstalling.
8. Your rights
Under the GDPR and the UK GDPR you have the right to:
- access your personal data and receive a copy (Art. 15);
- have inaccurate data corrected (Art. 16);
- have your data erased (Art. 17);
- restrict processing (Art. 18);
- receive data you provided in a machine-readable format and have it transmitted to another controller (Art. 20);
- object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests (Art. 21);
- lodge a complaint with a supervisory authority, in particular in the EU country where you live, work or where the alleged infringement took place (Art. 77). Our competent authority is: Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28-30, 010336 București, Romania — www.dataprotection.ro.
To exercise these rights, write to [email protected]. We answer within one month; this can be extended by two further months for complex requests, in which case we tell you why. We may ask you to confirm your identity. Residents of other jurisdictions (for example US states, Brazil, Canada) can use the same address for the rights their laws give them. Visitors and customers of a store should contact the store first (section 2).
9. Automated decision-making
We do not make decisions based solely on automated processing that produce legal or similarly significant effects (Art. 22 GDPR). The storefront script selects which consent banner to show from the visitor’s region; this follows the merchant’s settings and has no such effect.
10. Security
Encryption in transit (TLS) and at rest (managed database and backups), storefront passwords encrypted with AES-256-GCM, shortened IP addresses in consent records, verification of every Shopify webhook signature, e-mail verification for privacy requests, access to production systems limited to the provider, and hosting in the EU. Details are in Annex II of the Data Processing Addendum (TODO(owner): published URL of docs/legal/DPA.md (e.g. https://consentl.com/legal/dpa)).
11. Children
The app is a business tool for merchants and is not directed at children.
12. Changes
We update this page and the date above when this policy changes. Material changes are announced to merchants in the app or by e-mail before they take effect.
13. Language
This policy is published in English. If you need it in another official EU language, write to [email protected] and we will provide a translation. If a translation differs from the English text, the English text prevails, to the extent permitted by law.
Related documents: Data Processing Addendum (TODO(owner): published URL of docs/legal/DPA.md (e.g. https://consentl.com/legal/dpa)) · Sub-processors (TODO(owner): published URL of docs/legal/SUBPROCESSORS.md (e.g. https://consentl.com/legal/subprocessors)) · Terms of service (TODO(owner): published URL of docs/legal/TERMS.md (e.g. https://consentl.com/legal/terms))