1. The service

ConsentPixel — Privacy · Verified provides a consent management platform ("Service") including: a JavaScript pixel for blocking and managing third-party trackers, a consent banner builder, a site scanner and risk scoring engine, a compliance document generator, a trust badge system, an alert engine, and an agency portal. The Service is provided via consentpixel.com and the client portal.

The Service is designed for businesses and professionals. You must be at least 18 years old and have authority to enter into this agreement on behalf of any organisation you represent.

2. Account registration

• You must provide accurate information when creating an account.
• You are responsible for maintaining the security of your account credentials.
• You must notify us immediately at support@consentpixel.com if you suspect unauthorised access to your account.
• One account may manage multiple domains under your organisation. Agency plans allow managing client domains under one account.
• You may not share account credentials or create accounts on behalf of others without their knowledge.

3. Permitted use

You may use ConsentPixel — Privacy · Verified to manage privacy compliance for websites you own, operate, or are authorised to manage. Specifically permitted:

• Installing the ConsentPixel pixel on your own website(s)
• Installing the pixel on client websites if you are an authorised agency or contractor for those clients
• Generating privacy documents for your own or clients' websites
• Reselling the service under your own brand (Agency plan required)

4. Prohibited use

You must not:

• Use the Service to gain unauthorised access to third-party websites, systems, or data
• Install the pixel on websites you do not own or are not authorised to manage
• Use scan results to build competitive intelligence products, data broking services, or surveillance tools
• Attempt to reverse-engineer, decompile, or extract the source code of the Service
• Use the Service in any way that violates applicable law
• Resell, sublicense, or white-label the Service without an Agency plan
• Use automated tools to scrape or extract data from the portal beyond normal use
• Misrepresent scan results or compliance assessments to your clients or regulators

5. Compliance responsibility

6. Billing and payment

• Billing cycle — monthly or annual, as selected at signup. Annual plans are billed in full upfront.
• Payment method — credit or debit card via Stripe. We do not accept invoiced payment on Starter or Agency Lite plans.
• Failed payments — if a payment fails, we will retry 3 times over 7 days and notify you by email. After 7 days of failed payment, your account will be suspended (not deleted). Data is retained for 30 days before deletion.
• Price changes — we will give at least 30 days' notice of any price increase. Your rate is locked for the current billing period.
• No automatic upgrades — we will never upgrade your plan or increase your charges without your explicit approval. If your domain count approaches your plan limit, we notify you and you decide whether to upgrade.
• Taxes — prices shown exclude applicable taxes. Tax is calculated at checkout based on your billing address.

7. Cancellation and refunds

• Cancel any time — you can cancel at any time from your portal billing settings. No cancellation fees.
• Monthly plans — cancellation takes effect at the end of the current billing period. No partial-month refunds.
• Annual plans — if you cancel within 14 days of the annual renewal date, we offer a full refund. After 14 days, no refund is available for the remaining period, but you can continue using the service until the annual period ends.
• 14-day free trial — no charge during the trial period. You can cancel at any time during the trial without charge.
• Data on cancellation — your data is retained for 60 days after cancellation to allow export. You can request immediate deletion at any time during this period. After 60 days, all data is permanently deleted.

8. Intellectual property

Our IP: The ConsentPixel platform, pixel code, scanner engine, brand, and all associated intellectual property belong to ConsentPixel. These Terms grant you a limited, non-exclusive, non-transferable licence to use the Service during your subscription. Nothing in these Terms transfers ownership of our IP to you.

Your IP: Content you upload (logos, brand assets, domain information) remains yours. We use it only to deliver the Service.

Generated documents: Privacy policies, terms, and cookie policies generated by the Service for your website are yours to use on your site. You may not resell them as standalone products.

Consent log data: Visitor consent logs collected through your implementation of the Service belong to you (the website operator). We hold this data as a processor on your behalf. See our DPA for details.

9. Availability and support

• Uptime target — we target 99.9% monthly uptime for the pixel delivery CDN (Cloudflare). Portal and scanner uptime target: 99.5%. These are targets, not guarantees.
• Maintenance — planned maintenance windows will be announced at least 24 hours in advance via the portal status page at status.consentpixel.com.
• Support — email support is included on all plans. Support channels: support@consentpixel.com. Response SLA: 4 hours during business hours (Mon–Fri 9am–6pm EST). Enterprise plans include priority support SLAs.
• No phone support — support is provided by email only. This creates a documented record of all support interactions.

10. Limitation of liability

To the maximum extent permitted by applicable law:

• ConsentPixel's total liability to you for any claim arising from these Terms or the Service is limited to the amount you paid us in the 12 months preceding the claim.
• We are not liable for indirect, incidental, special, consequential, or punitive damages, including loss of profits, data loss, or business interruption, even if we were advised of the possibility of such damages.
• We are not liable for any regulatory fines, legal costs, or damages arising from your own compliance failures, including any CIPA, GDPR, or CCPA penalties.
• We are not liable for the accuracy of scan results — scans represent a point-in-time snapshot and may not reflect real-time changes to your site.

Some jurisdictions do not allow the exclusion of certain warranties or limitation of certain damages. In those jurisdictions, our liability is limited to the fullest extent permitted by law.

11. Indemnification

You agree to indemnify and hold ConsentPixel harmless from any claims, damages, costs, or expenses (including reasonable legal fees) arising from: your use of the Service in violation of these Terms; your violation of any applicable law or regulation; or your infringement of any third party's rights.

12. Termination

By you: You may terminate at any time as described in Section 7.

By us: We may suspend or terminate your account immediately if: you materially breach these Terms and fail to remedy the breach within 7 days of notice; you engage in prohibited use (Section 4); or you fail to pay charges after the grace period. We will notify you by email before termination except in cases of serious breach where immediate action is warranted.

On termination, your licence to use the Service ends immediately. Data handling on termination follows Section 7 (data retained 60 days, then permanently deleted).

13. Governing law and disputes

These Terms are governed by the laws of the State of Delaware, USA, without regard to conflict of law principles. Any dispute arising from these Terms will be resolved through binding arbitration under the rules of the American Arbitration Association (AAA), except that either party may seek injunctive relief in any court of competent jurisdiction to prevent irreparable harm.

For users in the EU or UK, mandatory consumer protection laws in your jurisdiction apply to the extent they cannot be excluded by contract. Nothing in these Terms removes rights you have under applicable EU or UK law.

14. Changes to these Terms

We may update these Terms from time to time. For material changes, we will notify you by email at least 30 days before the change takes effect. Continued use of the Service after the effective date constitutes acceptance. If you do not accept the changes, you may cancel your account before the effective date.

15. Entire agreement

These Terms, together with our Privacy Policy, DPA (if executed), and any order form or plan agreement, constitute the entire agreement between you and ConsentPixel regarding the Service and supersede all prior agreements.

1. Definitions

2. Subject matter and nature of processing

ConsentPixel processes personal data on the Controller's behalf to deliver the consent management service described in the Terms of Service. The nature of processing includes: collection of visitor consent decisions via the ConsentPixel pixel, storage of consent logs, scanning of the Controller's website for compliance assessment, and delivery of compliance alerts and reports.

3. Controller's obligations

The Controller agrees to:

• Ensure that any processing of personal data instructed to ConsentPixel has a lawful basis under applicable data protection law.
• Provide all required notices to data subjects about data processing conducted through the ConsentPixel pixel, including disclosure of ConsentPixel as a sub-processor in the Controller's own privacy policy.
• Not instruct ConsentPixel to process personal data in a way that would violate applicable law or the rights of data subjects.
• Respond to data subject requests in accordance with applicable law — ConsentPixel will provide the Controller with the technical means to locate and delete specific visitor records upon request.

4. Processor's obligations

ConsentPixel agrees to:

• Process only on instruction — process personal data only on the Controller's documented instructions, except where required by applicable law.
• Confidentiality — ensure that all personnel with access to personal data are bound by confidentiality obligations.
• Security — implement and maintain the technical and organisational security measures described in Section 6 below.
• Sub-processors — engage sub-processors only as listed in our Sub-processors page, with equivalent data protection obligations. Notify the Controller at least 30 days before adding or replacing any sub-processor.
• Data subject rights — provide reasonable technical assistance to the Controller in responding to data subject access, deletion, and portability requests.
• Data protection impact assessments — provide reasonable assistance to the Controller where required for DPIA.
• Deletion on termination — on termination of the service relationship, delete or return all personal data within 60 days unless required by law to retain it.
• Audit rights — provide the Controller with reasonable information necessary to demonstrate compliance with this DPA, and contribute to audits where required by applicable law.

5. Sub-processors

ConsentPixel uses sub-processors to deliver the Service. The current list is published and maintained at consentpixel.com/legal/#subprocessors. By accepting this DPA, the Controller provides general authorisation for ConsentPixel to use sub-processors listed there, subject to 30 days advance notice of any change.

If the Controller objects to a sub-processor change, they may notify ConsentPixel within 30 days of the notice. ConsentPixel will use reasonable efforts to accommodate the objection. If it cannot, the Controller may terminate the service with a prorated refund of any prepaid fees.

6. Security measures

7. International transfers

ConsentPixel's primary infrastructure is in the United States. Transfers of personal data from the EU/EEA to the US are made under:

• EU-US Data Privacy Framework (DPF) — for sub-processors that are DPF-certified.
• Standard Contractual Clauses (SCCs) — EU Commission Decision (EU) 2021/914, Module 2 (Controller to Processor) and Module 3 (Processor to Processor), incorporated by reference into this DPA for relevant transfers.

EU data residency is available on Agency and Enterprise plans. When enabled, consent log data is stored exclusively on EU-region Supabase instances and is not transferred to the US.

8. Breach notification

In the event ConsentPixel becomes aware of a personal data breach affecting data processed on the Controller's behalf, ConsentPixel will:

• Notify the Controller by email within 72 hours of confirming the breach, without undue delay.
• Provide the following information in the notification: nature of the breach, categories and approximate number of data subjects affected, likely consequences, measures taken or proposed to address the breach.
• Co-operate with the Controller's incident response and regulatory notification process.

9. Duration and termination

This DPA is effective for the duration of the ConsentPixel service subscription. On termination of the subscription, ConsentPixel will delete all personal data within 60 days unless the Controller requests earlier deletion or applicable law requires longer retention. The Controller may request a certificate of deletion.

10. Governing law

This DPA is governed by the laws of the State of Delaware, USA, except to the extent that EU/UK data protection law applies, in which case those provisions of the DPA are governed by the law of the relevant EU member state or England and Wales.

Infrastructure & hosting

Database & storage

Communications

Payments

Monitoring & observability

Scanner infrastructure

Notify me of changes

1. What is a cookie?

A cookie is a small text file stored in your browser by a website you visit. Cookies serve different purposes — some are essential for the website to function, others track behaviour for analytics or advertising. Not all tracking is done via cookies — pixels, fingerprinting, and cookieless analytics also exist.

2. Cookies we use on consentpixel.com

3. Analytics — Plausible (cookieless)

We use Plausible Analytics to understand how people use our website. Plausible is a privacy-first analytics tool that:

• Sets no cookies — no cookie is stored in your browser
• Collects no personal data — your IP address is never stored. Plausible uses a daily rotating hash of your IP + browser + domain to generate a unique visitor count without tracking individuals across days or sites.
• Does no cross-site tracking — data cannot be used to track you across different websites
• Is hosted in the EU — Plausible is a European company (Estonia) and processes data under GDPR
• Does not require consent under GDPR or PECR because it processes no personal data

Plausible gives us anonymous aggregate data: page views, referrer sources, country (from IP, not stored), device type, browser. That's it. View their privacy policy at plausible.io/privacy.

4. What we do NOT use

The following tracking technologies are explicitly not used on consentpixel.com:

• Google Analytics — not installed. We do not share data with Google for analytics purposes.
• Meta Pixel — not installed. We do not track visitors for Facebook/Instagram advertising.
• Any session replay tool — no Hotjar, FullStory, Clarity, Lucky Orange, or equivalent. We do not record your keystrokes, mouse movements, or screen.
• Advertising cookies — no third-party advertising cookies of any kind.
• Retargeting pixels — we do not build retargeting audiences from visitors to this site.
• Cross-site tracking — no tracking technology that follows you across websites.
• Device fingerprinting — we do not fingerprint browsers or devices.

5. Third-party cookies from embedded content

If you watch an embedded video (e.g. a product demo on YouTube), YouTube may set their own cookies. We use YouTube's privacy-enhanced embed mode (youtube-nocookie.com) where possible. We recommend checking YouTube's cookie policy for details.

The live chat widget (Intercom, if enabled) sets a session cookie for chat continuity. Intercom is only loaded after you click to open the chat widget — it does not load on page load and does not set cookies until you engage with it.

6. Managing cookies

Because we use only strictly necessary cookies and one cookieless analytics tool, there is no cookie banner required for consentpixel.com under GDPR's legitimate interest or strictly necessary exemptions. However, you have the following options:

• Browser settings — all major browsers allow you to view, block, or delete cookies. This will not affect Plausible analytics (no cookies). Blocking the __cp_session cookie will log you out of the portal.
• Opt out of Plausible — Plausible respects the navigator.doNotTrack browser setting. Enable "Do Not Track" in your browser to opt out of Plausible entirely.
• Global Privacy Control — consentpixel.com reads the GPC signal (navigator.globalPrivacyControl). California visitors with GPC enabled receive automatic opt-out treatment in line with CCPA 2026 requirements.

7. Cookies on your ConsentPixel-powered website

The ConsentPixel pixel places the following cookies on your website visitors' browsers:

These cookies are set by the ConsentPixel pixel on your domain (first-party cookies). They are described in the cookie policy we auto-generate for your site and are classified as "strictly necessary" under ICO and CNIL guidance because they are required to fulfil the user's explicit request (recording their privacy choice).

8. Changes to this policy

If we change the cookies or tracking technologies used on consentpixel.com, we will update this policy and the "Last updated" date. Material changes will be notified to account holders by email.

9. Contact

Questions about cookies or our tracking practices: privacy@consentpixel.com.