Data Processing Agreement (DPA)

1. Who's Who

2. What Data we Process For You

When someone visits your website and interacts with your cookie banner, we store:

• Their consent choices - which cookie categories they accepted or rejected
• When they consented - timestamp of their choice
• A hashed IP address - SHA-256 hash (one-way, cannot be reversed to original IP)
• A deletion token - a random identifier stored in the visitor's own browser, so they can have their record deleted without us ever identifying them
• Which banner - which of your cookie banners they saw
• User agent - (optional) browser/device info for analytics

Why hash the IP? So a returning visitor updates their existing record instead of creating a new one. The IP address itself is never written to the database: it is hashed with a secret salt the moment the request arrives, and only the hash is stored. Treat the hash as pseudonymised personal data, not anonymous data, which is what GDPR requires.

We do not store emails, names, or other directly identifying information about your end-users, and we never use their data to build a profile or recognise them across other websites.

3. Why We Process This Data

I process consent data to:

• Store user consent choices so you can comply with GDPR
• Remember if someone already saw the banner (so it doesn't show again)
• Show you consent statistics in your dashboard
• Let you export consent records if needed

That's it. We don't use this data for anything else.

4. Where We Store Data

Sub-processors We Use:

These are the services We rely on to run Consentify:

SCCs = Standard Contractual Clauses (EU-approved contracts for data transfers outside EU)

5. How Long We Keep Data

• Consent logs: 13 months from the visitor's last decision
• After you delete your account: We delete everything within 30 days

You can also manually delete consent records anytime via the dashboard or API.

6. Security Measures

Here's how we protect data:

7. Data Breach Notification

If something goes wrong and there's a security breach affecting your end-users' data:

Your responsibility:

You decide if the breach needs to be reported to authorities (like Datatilsynet in Norway) or to your end-users. We'll give you all the information you need to make that decision and fulfill your obligations.

8. Helping You With Data Subject Rights

If one of your end-users wants to exercise their GDPR rights (access, delete, etc.), here's how we help:

• Access their data: You can export consent records via dashboard
• Delete their data: A visitor can delete their own record from your banner, which calls our delete endpoint with the token stored in their browser. If someone asks you directly instead, email us and we will delete the record for you, normally the same working day.
• Correct their data: A consent record is a log of a decision at a point in time, so it is not edited. A visitor who changes their mind makes a new decision, which replaces the old one.

If someone contacts us directly: We'll forward their request to you immediately. We won't respond to them without your instructions (since you're the controller, not us).

9. Your Instructions to Us

I only process data according to your instructions:

• What you configure in the Consentify dashboard
• These terms and this DPA
• Written instructions you send us via email

If we think your instruction would violate GDPR: we'll let you know immediately so we can figure it out together.

10. When You Delete Your Account

Here's what happens to the data:

11. Audit Rights

You have the right to verify we're following this agreement. You can:

• Ask us questions about how we protect data (we'll answer honestly)
• Request documentation about security measures
• Ask about Supabase's security certifications

For physical on-site audits: This isn't practical for a small SaaS, but we can discuss alternative ways to verify compliance if you have serious concerns.

12. International Transfers

Main rule: All your end-users' consent data stays with Supabase in London, under the UK adequacy decision. It is never transferred to a country without an adequacy decision.

Exceptions, both outside the consent data we process for you: payment data handled by Stripe, and the internal Slack notification we get when you sign up, which carries your name and email. Both rely on EU Standard Contractual Clauses.

13. Liability

Under GDPR, both you and us can be held liable to end-users for data protection violations.

My liability is limited as described in the Terms of Service(basically limited to what you've paid us in the last 12 months).

14. How Long This Agreement Lasts

This DPA is effective from when you create your Consentify account and continues as long as we process any personal data on your behalf.

It automatically ends 30 days after you delete your account (once all data is deleted).

15. Contact Us

Questions about data processing? Need help with a data subject request?

Email me: support@consentify.app

We care about doing this right. Don't hesitate to reach out!