Privacy Policy

For the website, accounts, billing relationship, support, and our own business operations, the controller is:

We have not appointed a data protection officer because the statutory appointment criteria currently do not apply. Privacy requests go directly to the privacy contact listed below.

This Policy applies when you visit 1consent.app or our CMP validation site at tcf-validation.1consent.app, join the waitlist, create or use an account, subscribe, contact us, or otherwise interact directly with 1Consent. 1Consent is the controller for its own websites, including the consent choices and records generated on the validation site.

A customer's own privacy and cookie notice governs its use of the CMP. If your request concerns a consent choice made on a customer's site, contact that customer first; we assist the customer with verified requests.

The categories depend on how you interact with us. We collect data from you, your organization, your browser or device, the customer that deployed our CMP, and the service providers identified below.

Where the GDPR or UK GDPR applies, we rely on the following legal bases:

• Article 6(1)(b): create and administer accounts, deliver the service, provide support, process subscriptions, and take requested steps under a contract.
• Article 6(1)(b): respond to product inquiries, waitlist requests, and steps requested before entering a contract.
• Article 6(1)(c): keep tax and commercial records, respond to lawful requests, and meet other legal duties.
• Article 6(1)(f): protect the website, service, customers, and others; prevent fraud and abuse; investigate incidents; and establish or defend legal claims.
• Article 6(1)(f): maintain, debug, measure, and improve the service using proportionate operational data and aggregated statistics.
• Article 6(1)(a): optional website analytics and any other processing for which we specifically request consent. Consent can be withdrawn at any time for the future.
• Article 6 does not give 1Consent a separate purpose for customer end-user data processed as processor. The customer determines and discloses its legal basis.

For legitimate interests, we consider necessity, reasonable expectations, data minimization, safeguards, and the impact on individuals. You may object as described below.

Use Cookie Settings in the footer to revisit each optional service. Withdrawing consent for PostHog or Google Analytics 4 stops future collection by that service. It does not affect processing already performed lawfully.

The customer chooses the applicable framework, purposes, vendors, wording, and deployment rules. 1Consent supplies and operates the configured CMP as processor.

• The CMP must load before you make a choice. Delivering its code and configuration involves network data such as your IP address, request URL, browser headers and language. Cloudflare supplies an approximate country or region signal so the published location rules can select the applicable framework. Delivery, security and diagnostics processing is separate from the consent receipt table; the table's exclusion of IP addresses and user-agent strings does not mean these data are never processed by the delivery infrastructure.
• For an IAB Transparency and Consent Framework (TCF) configuration, a TC String encodes choices concerning purposes, vendors, legitimate interests and special features. Integrated vendors can read these signals through the TCF API to apply the visitor's choices. The CMP's vendor details explain the configured vendors, their purposes and their own privacy information. A consent signal is not itself a record of browsing activity or permission for 1Consent to use the data for advertising.
• A raw consent receipt contains a pseudonymous consent ID, event ID, action, received time, encoded consent string and hash, framework identifiers, and version evidence. Raw receipts are kept on a rolling 24-calendar-month basis unless earlier deletion is required.
• The consent receipt table does not store the visitor's IP address or user-agent string. Identifiers are still treated as pseudonymous personal data, not as anonymous data.
• Page-impression counts used for service usage and billing run independently of optional Analytics consent. The measurement payload contains no visitor or session identifier, and this counting does not use browser storage. Sending the request still involves network processing; this is separate from the optional session measurement described below.
• CMP analytics are stored as tenant/app-level hourly or daily rollups. They are not keyed by consent ID, but small groups can still be personal data where singling out remains reasonably possible, so we protect them accordingly.
• If a customer enables session measurement and its visitor grants the Analytics purpose, a first-party session identifier measures visits. It expires in the browser after 30 minutes of inactivity; the server deduplication marker expires 60 minutes after the last accepted session request. Daily sampling counts last 14 days before being reduced to plan-level analytics.
• To prevent delayed or retried events from restoring erased records, we retain deletion-blocking hashes derived from identifiers using separate labels for their different uses. Subject-level hashes remain until the customer's tenant-wide erasure; tenant-level hashes currently have no scheduled expiry. These safeguards are distinct from event-ID tombstones, which follow the 24-calendar-month receipt cutoff. Hashing does not make these records anonymous; we treat them as pseudonymous data.

Requests about this data should be sent to the customer that deployed the CMP. We provide deletion and assistance workflows to that customer, including deletion of subject-linked raw receipts and tenant data.

Changing or withdrawing consent updates the choices applied for future processing; it does not automatically erase historical consent evidence. For access or erasure of a customer's consent records, contact that customer and identify the website and, if available, your consent ID. Do not send extra identity documents or sensitive information unless needed for a verified request. For choices made on our own websites, contact 1Consent directly.

AI features run only when an authorized account user asks for them, for example to generate or refine a theme or translate authored CMP content.

• Depending on the feature, inputs can include the user's instruction, current theme tokens, a screenshot or uploaded image, or the authored text selected for translation.
• Requests pass through Cloudflare AI Gateway to OpenAI. Cloudflare handles gateway metadata and OpenAI processes the prompt and output to generate the requested result.
• 1Consent disables prompt and response payload storage in Cloudflare AI Gateway; limited request metadata remains. OpenAI states that API inputs and outputs are not used to train models by default and may be retained for up to 30 days for abuse monitoring unless a shorter retention control applies.
• Generated results can be saved automatically and applied to the account's configuration as part of the requested feature. They are not legal advice. An authorized user should review generated content and settings before publishing them.

Do not submit special-category data, secrets, or third-party personal data that is not needed for the requested AI feature.

We disclose data only as needed for the purposes above, under contracts and access controls appropriate to the provider's role:

• Cloudflare — delivery and security infrastructure, Workers, queues, storage, email, Turnstile and AI Gateway. Depending on the service, data includes network requests and location signals, CMP configuration and consent events, hosted assets, email addresses and messages, verification data, and AI requests in transit and gateway metadata. Provider privacy information (Cloudflare)
• Vercel — website, dashboard and API hosting, deployment, logs and file/blob hosting. Data includes requests, account and configuration data handled by hosted applications, uploaded assets and technical logs. Provider privacy information (Vercel)
• Clerk — authentication, sessions, account identity, organization access and waitlist management. Data includes names, email addresses, authentication and session identifiers, organization membership, access status and related security data. Provider privacy information (Clerk)
• Neon — managed PostgreSQL databases. Data includes platform accounts and configuration, customer content, pseudonymous consent records, CMP statistics and deletion-blocking records. Provider privacy information (Neon)
• Stripe and Link — merchant of record, checkout, billing, taxes, fraud prevention, disputes and transaction support. Data includes customer and billing details, payment information submitted at checkout, subscription and transaction identifiers, tax information and support correspondence; 1Consent does not receive full card numbers. Provider privacy information (Stripe / Link)
• Google Cloud — isolated scanner execution and processing of customer-requested site scans. Data includes target URLs, detected cookies and requests, page screenshots, scan results and related technical artifacts, which can incidentally contain personal data from scanned pages. Provider privacy information (Google Cloud)
• Google Ireland Limited — optional, consent-based Google Analytics 4 measurement for the public website. Data includes analytics identifiers, page views and interactions, browser/device characteristics, approximate location, referrers and campaign information. Provider privacy information (Google Analytics)
• Trigger.dev — orchestration and execution of background workflows. Data includes task inputs and results, scan and configuration references, workflow status and technical diagnostics needed to carry out the requested work. Provider privacy information (Trigger.dev)
• Upstash — short-lived Redis storage for session deduplication and service coordination. Data includes pseudonymous session deduplication keys, counters and coordination records. Provider privacy information (Upstash)
• Sentry — error monitoring and sampled performance diagnostics. Data can include request URLs, headers, IP addresses, stack traces and technical context, as described in the diagnostics section. Provider privacy information (Sentry)
• PostHog US Cloud — optional, consent-based analytics for the public website. Data includes the current URL and query string, a pseudonymous browser identifier, page-view events and browser/device data. Provider privacy information (PostHog)
• OpenAI — generation for AI features requested by an authorized user. Data includes submitted instructions, selected texts, theme information, screenshots or uploaded images where used, and generated outputs. Provider privacy information (OpenAI)
• Professional advisers, auditors, insurers, authorities, courts or transaction counterparties — account, transaction, communication or relevant evidence data only where reasonably necessary and legally permitted for the particular matter.

PostHog website analytics uses US Cloud, and Sentry diagnostics uses an EU ingest endpoint. These descriptions identify a service or receiving endpoint, not a promise that all storage, support or onward processing stays in that region. Other providers may process data through global infrastructure; the international-transfer section applies.

We do not sell personal data, share it for cross-context behavioral advertising, or allow providers to use customer end-user data for their own advertising.

We prefer EEA processing where available, but our provider chain includes processing in the EEA, United Kingdom, United States, and other locations from which global infrastructure is operated. A global edge request may be processed near the visitor.

• European Commission adequacy decisions, including the EU-US Data Privacy Framework for certified recipients where available.
• The European Commission's 2021 Standard Contractual Clauses and, where relevant, the UK transfer addendum.
• Encryption in transit and at rest, access controls, minimization, pseudonymization, transfer assessments, and contractual review of government-access requests.

Contact us to request more information or a copy of the relevant transfer safeguard, with protected confidential terms redacted where necessary.

We retain personal data only as long as needed for the stated purpose, then delete it or anonymize it so individuals are no longer identifiable. Aggregation alone is not necessarily anonymization; statistics that remain personal data continue to be protected as such. These are the current operational periods and criteria:

• Website and application security logs and diagnostics: normally no more than 90 days, unless an incident requires a protected copy for investigation or claims.
• Contact and support correspondence: normally 12 months after the matter closes, longer only where the relationship or a legal claim requires it.
• Waitlist data: until access is granted, declined, or withdrawn, and in any event reviewed after 24 months of inactivity.
• Account, configuration, assets, scans, and audit data: for the contract term, the 30-day retrieval period described in the Terms, and then deletion from active systems, subject to legal duties and backup cycles.
• Invoices, transaction evidence, and tax or commercial records: 10, 8, or 6 years depending on the record under current German tax and commercial law.
• Raw pseudonymous consent receipts and related event-ID tombstones: rolling 24 calendar months. Verified subject erasure removes subject-linked raw receipts earlier where required.
• Daily CMP analytics: 7 days on Free, 90 days on Starter, and 548 days (18 months) on Pro. Hourly analytics last 7 days.
• First-party session identifier: 30 minutes of inactivity in the browser; deduplication marker: 60 minutes after the last accepted session request; daily session sampling counts: 14 days.
• Cloudflare does not store AI prompt or response payloads for our requests. OpenAI API payloads can be retained for up to 30 days unless a shorter control applies.
• Evidence needed for legal claims: for the applicable limitation period, generally three years from the end of the relevant year, and longer only where a statutory maximum or active proceeding applies.

Deletion from backups follows protected provider rotation cycles and can take up to 180 days. Backup copies are isolated from ordinary use and restored only for continuity or security recovery.

Subject to the conditions and exceptions in applicable law, you may ask us to:

• confirm processing and provide access to your personal data;
• correct inaccurate or complete incomplete data;
• delete personal data;
• restrict processing;
• provide data you supplied in a portable format where Article 20 applies;
• object to processing based on legitimate interests;
• withdraw consent at any time for future processing; and
• complain to a competent data protection authority.

Send a request to the privacy email below. We may verify your identity and authority, and will respond within the period required by law. There is normally no charge. Authorized agents may act where applicable law permits and their authority can be verified.

Our lead local authority for private-sector processing is the Bavarian State Office for Data Protection Supervision (BayLDA)

Account identity, organization details, essential configuration, and transaction information are required to enter or perform the service contract. Without them, we may be unable to create an account, deliver the service, or provide a paid plan.

Website analytics, optional profile fields, AI features, and the content of a voluntary inquiry are optional. Refusing optional analytics does not reduce website or service functionality.

1Consent does not make decisions based solely on automated processing that produce legal or similarly significant effects about account users or website visitors. AI output is advisory and requires user action. Stripe/Link may independently use automated fraud and risk systems under its own privacy information.

This section supplements the rest of this Policy for residents of US states with applicable privacy laws. Some rights apply only if 1Consent meets that law's coverage thresholds.

• Categories collected in the preceding 12 months: identifiers and contact information; internet, device, and network activity; commercial and subscription information; approximate geolocation; professional or employment-related organization information; customer content; and inferences limited to security, service configuration, or product use.
• Sources and business purposes are described in Sections 3 and 4 above.
• Recipient categories are infrastructure, authentication, database, payments, workflow, diagnostics, analytics, AI, security, and professional-service providers described in Section 8.
• We do not sell personal information, share it for cross-context behavioral advertising, use sensitive personal information to infer characteristics, or offer financial incentives for personal information.
• Where applicable, you may request access, correction, deletion, portability, a list of relevant third parties, or opt out of sale, targeted advertising, or certain profiling. We will not discriminate against you for exercising a right.
• If we deny a request and your state grants an appeal right, reply to our decision within 45 days with 'Privacy appeal' in the subject line.

We do not currently interpret a browser's Do Not Track setting as a separate instruction because no uniform standard applies. We honor Global Privacy Control where legally required. On this website, our Basic Consent Mode configuration keeps each optional analytics service off unless you affirmatively allow that service in our CMP.

1Consent is a business service and is not directed to children. We do not knowingly collect personal data from children through our direct account relationship. Customers must assess any child-specific duties for their own sites and must not enable unlawful processing through the service.

We use technical and organizational measures appropriate to the risk, including encryption in transit and at rest where supported, tenant separation, role-based access, authentication controls, secrets management, logging, backups, vulnerability management, data minimization, and incident procedures.

No internet service is completely secure. Please report a suspected security issue promptly and do not send secrets through the contact form.

We may update this Policy when the service, providers, or law changes. We will change the effective date and provide a prominent notice or direct account notice when a change materially affects your rights or our use of personal data. Earlier versions can be requested from us.

Use the following privacy contact for questions, rights requests, transfer-safeguard requests, or concerns. If the matter involves a customer's CMP, identify the customer site and avoid sending unnecessary sensitive data.