FAQ
The short answers.
Grouped by what people ask about. If yours is not here, the contact form reaches a person.
Pricing and plans
What counts as a domain?
A root domain, its www and up to two further subdomains count as one. acme.com, shop.acme.com and docs.acme.com are one domain; acme.de is a second. The consent cookie is scoped to the root domain, so subdomains share one decision.
What if a client's traffic spikes?
Nothing. There is no pageview metering anywhere in the product, so there is nothing to overage.
Is the demo the real product?
Yes, with three exceptions: branding stays on, custom CSS is off, and scans queue behind priority ones. Analytics stay on because "did the banner work" is what the seven days are for.
What happens when the demo ends?
Login is blocked the moment it expires. Pay within 7 days and the workspace, data, address and members come back exactly as they were. After that the workspace is destroyed.
Can I change plans later?
Any time through the Stripe billing portal. Consent records are kept through plan changes.
Performance
Does it really not shift layout?
Measured CLS is 0.000. The build fails in CI above a 0.10 budget, and above 4 KB gzipped. The banner renders in a shadow DOM so the host page's CSS cannot break it, and vice versa.
What does a returning visitor load?
Nothing. Their stored choice is re-applied from the cookie or localStorage mirror. The config is only fetched if they open their choices again.
How does Consent Mode v2 work here?
The tag sets denied-first defaults synchronously before any Google tag runs, then pushes an update when the visitor decides. Marketing maps to the ad signals, analytics to analytics storage, preferences to personalisation storage.
Compliance and records
What does a consent receipt contain?
Per-category grants, country, a salted IP hash, truncated user agent, and a snapshot of the banner version, title, text and policy URL the visitor saw. Rows are inserted and aggregated, never updated. Export as CSV or PDF.
Which regulations are covered?
GDPR (EU and UK), CCPA/CPRA and Google Consent Mode v2. Geo mode decides who sees the banner: EEA plus UK, everyone, or a custom list. An unknown region sees the banner.
Can I publish a banner without a Reject button?
Not with GDPR rules on. The API returns a 400. The compliance engine also scores it as critical if you turn the rule off.
Do you store visitor IP addresses?
No. Receipts hold a salted SHA-256 hash of the IP, never the raw address.
Access and team
Can clients log in?
Yes. Invite them into their own workspace as viewers or analysts. They see scores, banners and logs; they cannot change anything or see your other clients. Only owners manage billing.
What are the five roles?
Owner (everything, including billing), admin (everything except billing), editor (authors domains, banners, compliance, integrations), analyst (read plus export), viewer (read only).
Is two-factor authentication available?
Yes, TOTP with ten single-use backup codes, on every plan. Sessions can be reviewed and revoked from account settings.
Still deciding?
Seven days, every feature, unlimited domains, no card.
GDPR · UK-GDPR · CCPA · Google Consent Mode v2