Consentl privacy policy
Last updated: 2026-10-29
This policy explains how personal data is processed in connection with Consentl, a Shopify app for cookie consent and privacy requests. It applies to merchants who install the app and their staff, to people who contact us, and, as far as we process their data on a merchant’s behalf, to visitors and customers of stores that use the app. Consentl for websites (our dashboard and service for other websites) has its own privacy policy.
1. Who we are
- Provider and controller: STL Embeded Creations — STL EMBEDED CREATIONS SRL
- Address: Str. Kovari 75, 400217 Cluj-Napoca, Cluj, Romania
- Trade register no.: J2020001305120; fiscal code (CUI): 42512332; VAT: Not registered for VAT (CUI 42512332); intra-Community VAT code RO46686340
- Privacy contact: [email protected]
- Data protection officer: None appointed. For all privacy matters, write to [email protected].
- Representative in the EU (Art. 27 GDPR): Not required: the provider is established in the EU (Romania).
2. Our roles
- Controller. We decide how data about merchants, their staff and people who contact us is processed (section 3).
- Processor. When the app records consent, receives privacy or withdrawal requests or sends e-mails to shoppers, we act on behalf of the merchant, who is the controller (section 4). This processing is governed by our Data Processing Addendum. If you are a visitor or customer of a store, please contact the store to exercise your rights; we help the merchant answer. Under the California Consumer Privacy Act we act as the merchant’s service provider, and under the other US state privacy laws as its processor.
- Shopify provides the platform. It is not our sub-processor: it processes data under its own privacy policy and bills merchants for the app. On the merchant’s instruction we also pass data to Shopify (section 5).
3. Data we process as controller
| Purpose | Data | Source | Legal basis | Retention |
|---|---|---|---|---|
| Providing the app to the merchant (installation, settings, plan features) | Shop domain, shop name, shop contact e-mail, country, time zone, published languages, storefront domains, current plan, app installation ID, app settings, public shop key | Shopify Admin API at installation and on shop updates; the merchant in the app | Performance of the contract with the merchant, Art. 6(1)(b) GDPR | While the app is installed; deleted when Shopify sends the shop/redact notification (48 hours after uninstall) |
| Authenticating the merchant's staff in the Shopify admin | Shop-level (offline) Shopify access and refresh tokens; the staff member's Shopify user ID contained in the App Bridge session token (verified on each request, not stored); the admin language chosen in Shopify | Shopify (OAuth token exchange, App Bridge) | Contract with the merchant, Art. 6(1)(b); for staff members, our and the merchant's legitimate interest in secure access, Art. 6(1)(f) | Tokens: until they expire or the app is uninstalled (deleted immediately at uninstall). User IDs: not stored |
| Billing and plan management | Name of the active subscription plan | Shopify App Pricing | Contract, Art. 6(1)(b). Shopify charges the merchant under its own terms | While the app is installed (plan name only) |
| Acceptance of our terms | Which version of the Terms of Service and the Data Processing Addendum was accepted, when, and by which staff member (Shopify user ID and e-mail address); no IP address | The merchant's staff member, in the app | Contract, Art. 6(1)(b); our legitimate interest in proving the contract, Art. 6(1)(f) | While the app is installed and then until the limitation period ends (generally 3 years, Romanian Civil Code art. 2517) |
| Service e-mails to the merchant | Shop contact e-mail, shop name and the content of the notification: new privacy request, new withdrawal, data request received from Shopify, failed withdrawal acknowledgement, scan report, the warning sent at uninstall before the shop's data is deleted, and notices of changes to our terms and sub-processors | Shop data above | Contract, Art. 6(1)(b) | Not kept by us after sending; delivery logs at Brevo (see section 5) |
| Internal administration and statistics | Shop domain, name and contact e-mail, storefront domains, plan, installation and uninstallation dates, whether the banner is published, aggregated counts (banner views, decisions, scans, requests); no data of shoppers or visitors | Shop data above, read through a read-only database role | Legitimate interest in running, supporting and planning the service, Art. 6(1)(f) | Shown live from the shop data, not copied; deleted with it |
| Scanning password-protected stores (Enterprise) | Storefront password entered by the merchant, encrypted with AES-256-GCM | The merchant | Contract, Art. 6(1)(b) | Until the merchant removes it or the shop is deleted (shop/redact) |
| Support | Name, e-mail address and content of messages you send us | You | Contract, Art. 6(1)(b), or legitimate interest in answering enquiries, Art. 6(1)(f) | Up to 3 years after the enquiry is closed, unless a longer period is needed to establish or defend legal claims |
| Legal obligations and legal claims | The data needed for the request or the claim (from the categories above) | The categories above | Legal obligation, Art. 6(1)(c) (for example requests of authorities); our legitimate interest in establishing, exercising or defending legal claims, Art. 6(1)(f) | As long as the obligation or the limitation period requires (generally 3 years, Romanian Civil Code art. 2517) |
| Security, abuse prevention and operation of the service | Application logs (shop domain, error messages, job results); a request log (method, address requested, status, duration; no IP address); request metadata processed by our hosting platform, including IP addresses; IP addresses held in the server's memory for rate limiting (never written to the database or to our logs) | Requests to our servers | Legitimate interest in a secure and available service, Art. 6(1)(f) | Rate-limit entries: in memory only; the limit window is 60 seconds, but an entry can remain in memory until the table is cleaned up or the server restarts. Logs: we do not store or export them; DigitalOcean keeps the runtime logs only while the application runs and clears them when a new version is deployed, and keeps build and deployment logs, which contain no shopper data, for 90 days. Request data at the edge network (Cloudflare, engaged by DigitalOcean) is kept by that provider under its own terms. Database backups: 7 days, rolling |
Legitimate interests. Where we rely on Art. 6(1)(f), our interests are keeping the service secure and available, preventing abuse of public endpoints, giving merchants’ staff secure access, answering enquiries and proving our contracts. You can object to this processing at any time (section 8).
Is providing the data required? Shop data and access tokens are needed to provide the app; without them the app cannot be installed. Contacting support is voluntary.
4. Data we process on behalf of merchants
The merchant decides whether and how these functions are used and is responsible for informing visitors (for example in the store’s own privacy and cookie policy). The legal basis is the merchant’s; we process the data only on the merchant’s documented instructions. Full details are in Annex I of the Data Processing Addendum.
| Category | Data | Retention |
|---|---|---|
| Consent records (proof of consent) | Pseudonymous consent ID (a random value that is also stored in the visitor's consentl cookie, so a record can be linked to that browser), date and time, action (accept all, reject all, custom, close, opt-out signal, implied), choices per category, region code, country (only when a network provider in front of our servers supplies it; not the case on our current hosting), language, banner configuration revision, identifier (hash) of the banner texts and settings shown, A/B test variant, page path (without query string), shortened IP address (IPv4 /24, IPv6 /48), browser user agent, Global Privacy Control signal | Deleted automatically (job every 6 hours) when older than the shop's retention period: the plan's period (Free: 425 days; Pro: 425 days; Business: 730 days (2 years); Enterprise: 1,825 days (5 years)), but never less than the consent lifetime set by the merchant plus 30 days (at most 425 days), so the proof exists as long as a consent is used. If a merchant moves to a plan with a shorter period, the previous period still applies for 30 days and the app asks the merchant to export the records first. The banner texts and settings that were shown are kept as long as a record refers to them. All records are deleted at shop/redact |
| Banner views and aggregated statistics | Counters per shop and day (views and decisions, A/B variant). Nothing is sent before the visitor decides; a view is counted together with the visitor's first decision after the banner was shown, without any identifier; the IP address is used only for rate limiting and is not stored | Daily and A/B counters: 2 years |
| Region lookup and cookie declaration requests | Requests from the visitor's browser to /api/geo (only when Shopify does not provide the region; on our current hosting it returns no country, and the banner then applies the store's rule for unknown regions) and /api/cookies (the shop's cookie list). We do not store these requests | Not stored (see the security row in section 3 for platform logs) |
| Privacy requests (access, copy, correction, deletion, objection, restriction, withdrawal of consent, opt-out of sale/sharing, appeal) | Request type, e-mail address, optional name and message, authorised-agent flag, language, applicable law and region class, status, deadline, extension or rejection reason, hash of the e-mail verification token, hash of the e-mail address, dates, Shopify customer ID of the logged-in customer who sent it, the merchant's notes. For an opt-out of sale/sharing the e-mail address is passed to Shopify so the opt-out is also recorded on the Shopify customer | Requests whose e-mail address was never confirmed: deleted 30 days after submission. Closed requests (completed or rejected): kept 2 years by default so the merchant can document how they were handled, then deletable by the merchant, and deleted automatically 3 years after closing. Requests that are never closed are not deleted automatically yet (a limit of 3 years after the last change is planned). When Shopify sends customers/redact, unconfirmed requests are deleted and handled ones are minimised: name, e-mail address, message, notes and customer ID are removed; type, dates, status, law and a hash of the e-mail address are kept as evidence that the request was handled. The data Shopify sends with customers/data_request is kept 90 days for the merchant; after that only a record with the date, the Shopify customer ID and counts remains, for 3 years. Everything is deleted at shop/redact |
| Global Privacy Control of logged-in customers | When a logged-in customer's browser sends a Global Privacy Control signal, a small script on the storefront sends the customer's e-mail address once to our server (through Shopify's app proxy, which adds the customer ID signed by Shopify) and remembers in the browser's local storage that it did so. We pass the opt-out to Shopify for that customer | Not stored by us beyond the request; the local storage item stays in the browser until it is cleared |
| EU withdrawal requests (Directive (EU) 2023/2673) | Order number, Shopify order ID and whether the order matched the e-mail address (looked up in Shopify when the merchant allows it), e-mail address, name, the items concerned, language, status, delivery attempts and time of the acknowledgement e-mail, the merchant's notes | Closed withdrawals (rejected or refunded): kept 2 years by default, then deletable by the merchant, and deleted automatically 3 years after the last change. Withdrawals that are never closed are not deleted automatically yet (the same limit is planned). At customers/redact, name, e-mail address and notes are removed; order reference, items, status and dates are kept as evidence for refund disputes. Everything is deleted at shop/redact |
| E-mails to shoppers | E-mail address and content of verification, confirmation and withdrawal acknowledgement e-mails, sent through Brevo. Replies go to the store's e-mail address where it is set as reply address, otherwise to our consentl.com mailbox | Not kept by us after sending; delivery logs at Brevo. Replies that reach our mailbox are kept only as long as needed to pass them to the merchant |
| Customer and order data (optional, only if the merchant enables one-click privacy actions) | The requester's Shopify customer profile and orders, read through the Shopify Admin API when the merchant exports them; erasure requests forwarded to Shopify | Not copied by us, except the Shopify customer and order IDs stored with the request or withdrawal |
| Cookie scans | Names, domains, categories and lifetimes of cookies and storage items, and third-party hosts, observed when our scanner visits the storefront as an anonymous visitor from Frankfurt (EU) | Until the merchant deletes them or shop/redact |
The storefront script also stores a few items in the visitor’s browser. They belong in the store’s cookie declaration; our analysis of what happens before consent is available to merchants on request.
| Name | Type | Purpose | Lifetime |
|---|---|---|---|
| consentl | Cookie | Stores the visitor's cookie choices and the consent ID; set only when the visitor makes a choice | As set by the merchant (default 180 days, at most 395) |
| consentl_r | Session storage | Remembers the region for the consent banner during the visit | Browser session |
| consentl_ab | Session storage | Keeps the visitor in one variant while the merchant runs an A/B test of the banner (only when a test runs). The script is being changed to keep it in memory instead | Browser session |
| consentl_age | Cookie | Remembers that the visitor confirmed their age (only if the store uses the age check) | As set by the merchant (default 30 days) |
| consentl_a11y | Local storage | Remembers display settings the visitor chose in the accessibility menu (only if used) | Until the visitor resets them |
| consentl_gpc_<customer ID> | Local storage | Remembers that a logged-in customer's Global Privacy Control signal was passed on once (see section 4) | Until the browser storage is cleared |
We do not use the visitor’s data for our own purposes, do not combine it across stores, and do not sell or share it.
For merchants subject to US state privacy laws. As your service provider or processor, Consentl collects: identifiers (pseudonymous consent ID, shortened IP address), internet activity (page path, browser user agent, Global Privacy Control signal), geolocation at region level, and, for privacy requests and withdrawals, contact details and order references. We use them only to record consent and handle requests for you, keep them for the periods in this section, and do not sell or share them or use sensitive personal information.
5. Recipients and sub-processors
We use the following sub-processors. The current list and its change log are published at our sub-processor page; merchants are notified by e-mail 30 days before a new sub-processor is added.
| Sub-processor | Purpose | Location of processing | Transfer safeguard |
|---|---|---|---|
| DigitalOcean, LLC (New York, USA) | Hosting (App Platform), managed PostgreSQL database and backups, scanner worker, logs | Frankfurt, Germany (region fra1); remote access from third countries under its data processing agreement | Data stored in the EU. Remote access covered by the EU Standard Contractual Clauses and the UK Addendum in DigitalOcean's data processing agreement |
| Cloudflare, Inc. (San Francisco, USA), engaged by DigitalOcean for the App Platform edge | TLS termination, content delivery and DDoS protection for requests to our servers | Global edge network (the data centre nearest to the visitor) | The Standard Contractual Clauses that DigitalOcean concludes with Cloudflare under DigitalOcean's data processing agreement |
| Brevo SAS (formerly Sendinblue SAS), Paris, France | Sending transactional e-mails (without open or click tracking) | European Union | No transfer by us (EU provider). Brevo's own sub-processors are listed by Brevo |
| Proton AG (Geneva, Switzerland) | E-mail hosting of our [email protected] and [email protected] mailboxes: support and privacy correspondence, replies to our e-mails, and requests that merchants forward to us (which may include shoppers' requests) | Switzerland | EU adequacy decision for Switzerland (2000/518/EC) |
Shopify (Shopify International Limited, Dublin, Ireland) receives data from us on the merchant’s instruction: when a shopper opts out of the sale or sharing of personal information, or sends a Global Privacy Control signal while logged in, we pass the e-mail address to Shopify so that Shopify records the opt-out on the customer; when the merchant uses the one-click privacy actions, we forward erasure requests to Shopify; and we store the published banner configuration in the shop.
We may also disclose data to authorities where we are legally required to do so. We do not use advertising or analytics tools in the app.
6. International transfers
Our database and servers are in the EU (Frankfurt). Some providers are US companies, and requests pass through the edge location nearest to the visitor, which can be outside the EU. Where personal data is transferred to, or can be accessed from, a country without an EU adequacy decision, the transfer is covered by the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) or, for certified recipients, by the EU-US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795). For the UK, the UK International Data Transfer Addendum or the UK Extension to the Data Privacy Framework applies. For Switzerland, the Swiss-US Data Privacy Framework or the Standard Contractual Clauses with the adaptations recognised by the Swiss FDPIC apply. Switzerland itself (our mailbox provider) has an EU adequacy decision. You can ask us for a copy of the safeguards at [email protected].
7. Retention
Retention periods are listed in sections 3 and 4. When the app is uninstalled, the access token is deleted immediately and all other shop data, including consent records, privacy requests and withdrawals, is deleted when Shopify sends the shop/redact notification, 48 hours later. Merchants who need to keep proof of consent or request records for longer should export them (CSV) before uninstalling; a merchant can move to the Free plan and keep the app installed for as long as it needs to export. Deleted data disappears from database backups within the backup retention period.
8. Your rights
Under the GDPR and the UK GDPR you have the right to:
- access your personal data and receive a copy (Art. 15);
- have inaccurate data corrected (Art. 16);
- have your data erased (Art. 17);
- restrict processing (Art. 18);
- receive the data you gave us on the basis of a contract in a machine-readable format and have it transmitted to another controller (Art. 20);
- object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests (Art. 21);
- lodge a complaint with a supervisory authority, in particular in the EU country where you live, work or where the alleged infringement took place (Art. 77). Our competent authority is: Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28-30, 010336 București, Romania — www.dataprotection.ro.
To exercise these rights, write to [email protected]. We answer within one month; this can be extended by two further months for complex requests, in which case we tell you why. We may ask you to confirm your identity. Residents of other jurisdictions (for example US states, Brazil, Canada) can use the same address for the rights their laws give them. Visitors and customers of a store should contact the store first (section 2); a consent record can only be found with the consent ID stored in the visitor’s consentl cookie.
9. Automated decision-making
We do not make decisions based solely on automated processing that produce legal or similarly significant effects (Art. 22 GDPR). The storefront script selects which consent banner to show from the visitor’s region; this follows the merchant’s settings and has no such effect.
10. Security
Encryption in transit (TLS) and at rest (managed database and backups), storefront passwords encrypted with AES-256-GCM, shortened IP addresses in consent records, verification of every Shopify webhook signature, e-mail verification for privacy requests, access to production systems limited to named persons of the provider, and hosting in the EU. Details are in Annex II of the Data Processing Addendum.
11. Children
The app is a business tool for merchants and is not directed at children. Visitors of the stores that use the app may include minors; the merchant decides how to handle them (for example with the age check).
12. Changes
We update this page and the date above when this policy changes. Material changes are announced to merchants in the app or by e-mail before they take effect.
13. Language
This policy is published in English. If you need it in another official EU language, write to [email protected] and we will provide a translation. If versions differ, the English version applies to our contracts with merchants. Nothing in this clause limits the information you are entitled to receive in your language.
Related documents: Data Processing Addendum · Sub-processors · Terms of service