Privacy Policy

Last updated: July 2026.

This Privacy Policy explains how Consentfolio ("Consentfolio", "we", "us") handles personal data. It covers two different situations, which this policy treats separately because they carry different legal roles:

1. Data about you, if you are a Consentfolio customer, prospective customer, or someone visiting our own marketing site — here, Consentfolio is the controller.
2. Data about your website visitors, collected through the Consentfolio consent banner on your behalf — here, Consentfolio is the processor, and you (our customer) are the controller. That relationship is governed separately by our Data Processing Addendum ("DPA"), which this policy incorporates by reference.

If you are a website visitor who has interacted with a Consentfolio banner on someone else's site, the relevant part of this policy is the Website-visitor consent records section below — the site you visited, not Consentfolio, is who you should generally contact first about your own data.

1. Who we are

Consentfolio is operated by Tudor N. Rusmanica, a sole trader established in the United Kingdom, trading as Consentfolio ("Consentfolio", "we", "us"). We help website owners obtain, record, and demonstrate cookie and tracking consent from their own visitors, and we run our own marketing/account site at consentfolio.com (or such other domain as we use from time to time). You can contact us about this policy at [email protected].

2. Scope of this policy: two roles

• As controller, we determine why and how we process data about our customers (account holders, billing contacts, support requesters) and about visitors to our own marketing site. This section of the policy is written from that perspective.
• As processor, we process website-visitor consent data strictly on the instructions of our customers, under the terms of our DPA. If you are a Consentfolio customer, the DPA — not this policy — is the primary document governing how we handle your visitors' consent records. This policy summarizes that processing for transparency, but the DPA controls.

3. Data we collect about our customers, and why

When you sign up for and use Consentfolio, we collect and process:

We do not sell your personal data.

4. Legal bases for processing (UK GDPR)

We rely on the following legal bases, depending on the activity:

• Performance of a contract — to create your account, provide the Consentfolio service, and process billing.
• Legitimate interests — to secure our systems, respond to support requests, improve the service, and communicate with you about material changes; we consider these interests balanced against your rights and only rely on this basis where appropriate.
• Consent — for optional analytics cookies on our own site (see Cookies on our site), and anywhere else we ask for it directly.
• Legal obligation — where we must retain or disclose data to comply with the law (for example, certain billing and tax records).

5. Sub-processors

We use a small number of third parties to help deliver the service. The current, authoritative list — including what each one does and where it processes data — is maintained at subprocessors.md. In summary:

• DigitalOcean — hosting and compute, London (LON1) data center, UK data residency.
• Cloudflare — DNS, CDN, and TLS termination at the network edge.
• Stripe — payment processing.
• Resend — transactional email (account and billing notifications).
• Microsoft 365 — internal business email for the Consentfolio team only.

6. Website-visitor consent records

If you are a visitor to one of our customers' websites and you interact with a Consentfolio consent banner, Consentfolio processes a record of that interaction as a processor, on the instructions of that website (our customer, who is the controller for that data). Full detail is in our DPA and retention page; in summary:

• Records are deliberately minimised. They do not include your IP address, user-agent/browser fingerprint, or the page URL you were on.
• What they do include: the consent choices you made (per category), the configuration version those choices relate to, a client-generated visitor UUID and event UUID, the origin host the request came from, and timestamps.
• Retention: your consent is treated as valid for 12 months; the underlying receipt is kept for the life of the consent plus 1 year after it is superseded or expires (about two years in total), after which it is permanently and automatically deleted. See retention.md for full detail.
• Because we are a processor for this data, requests about it should generally go to the website you visited (the controller) first. If you are unable to reach the controller, you may contact us at [email protected] and we will assist where we reasonably can, consistent with our obligations under the DPA.

7. International transfers

We minimise international transfers by hosting on DigitalOcean's London (LON1) data center, which provides UK data residency for both customer account data and website-visitor consent records. Cloudflare provides network-edge services (DNS/CDN/TLS/DDoS protection), which may involve routing traffic through Cloudflare's global edge network as part of normal internet routing. Where a sub-processor processes data outside the UK, we rely on appropriate safeguards such as the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses.

8. Cookies on our site

We use our own Consentfolio banner on our own marketing and account site (we "dogfood" our product). We use:

• Essential cookies — required for login, session management, and core site functionality. These are set regardless of your cookie choice, as they are necessary for the site to work.
• Optional analytics cookies — set only if you consent via our banner. You can change your choice at any time through the banner's preferences.

9. Data-subject rights

Subject to applicable law, you have the right to:

• Access the personal data we hold about you.
• Rectification of inaccurate or incomplete data.
• Erasure of your data in certain circumstances.
• Restriction of processing in certain circumstances.
• Portability of data you have provided to us, in a structured, commonly used format.
• Object to processing based on legitimate interests.

How to exercise these rights: email [email protected]. We will respond within the timeframes required by applicable law.

Complaints: if you are not satisfied with how we handle your data or your request, you have the right to complain to the UK's supervisory authority, the Information Commissioner's Office (ICO), at ico.org.uk.

10. Security

We apply technical and organisational measures appropriate to the limited, minimised data we process, including encryption of data in transit (TLS), encrypted storage, access controls on production systems following the principle of least privilege, and routine monitoring of the systems that serve the banner and receive consent receipts. We do not claim any formal certification.

11. Retention summary

• Customer account data: retained for as long as your account is active, and for up to 6 years after your account closes, where required for legal, accounting, and tax purposes, after which it is deleted.
• Billing data: retained by Stripe per its own retention practices; we retain the limited billing metadata Stripe provides us for as long as needed for accounting and tax purposes.
• Website-visitor consent records: consent validity of 12 months; receipts kept for the life of the consent plus 1 year (about two years in total), then automatically and permanently deleted. See retention.md.
• Support correspondence: retained for as long as reasonably needed to resolve your query and for a limited period afterward for quality and reference purposes.

12. Children

Consentfolio is a business-to-business service. It is not directed at, and is not intended for use by, individuals under the age of 16. We do not knowingly collect personal data from children.

13. Changes to this policy

We may update this policy from time to time. If we make material changes, we will take reasonable steps to notify customers (for example, by email or an in-app notice). The "last updated" date at the top of this document will reflect the most recent revision.

14. Contact

• All queries (data protection & general): [email protected]

We have not appointed a Data Protection Officer; we are not required to given the scale and minimised nature of our processing. For any data-protection question, contact [email protected].