01Who this covers
CMPStack is a consent management platform. Website owners use it to show a consent banner, record what visitors chose, and prove it later. That means we handle data in two roles.
- Controllerfor account holders, people who contact us, and the operation of this website.
- Processorfor consent records collected on our customers’ websites. The website owner is the controller for those records and decides how long to keep them.
02Account holders
When you create an account or join a workspace we hold:
- Email address, password (stored as a bcrypt hash), name, job title, and an optional avatar stored as an image data URL
- Whether your email is verified, and whether two-factor authentication is enabled. TOTP secrets and backup codes are stored hashed
- Your workspace memberships and role in each
- Session records: the browser user agent and IP address at sign-in and at each token refresh, so you can review and revoke sessions
- Notification, language, timezone and display preferences
- Billing details are held by Stripe. We keep the Stripe customer and subscription identifiers, plan and invoice status, not card numbers
We use this to run the service, secure your account, send the emails described in section 6, and bill you. The legal basis is the contract with you, and our legitimate interest in keeping accounts secure.
03Visitors to websites running the tag
When a website shows our banner, the tag sends two kinds of event to our API: that the banner was shown, and what the visitor decided. For a decision we store:
- The choice per category (analytics, marketing, preferences) and the action: accept, reject or save
- Country, taken from the CDN header, not from the IP address
- A salted SHA-256 hash of the IP address. We never store the raw IP
- A truncated browser user agent
- A snapshot of the banner version, title, description and policy URL the visitor saw at that moment
Records are append only. They are inserted and aggregated, never edited. We hold them for the website owner, who can view, filter and export them as CSV or PDF. Requests about these records should go to the website you visited; we will help them respond.
04People who contact us
The contact form stores your name, email, topic and message, together with the page you sent it from, your browser user agent and IP address, which we record on our side to detect abuse. The form is rate limited to five submissions a minute per address.
Notes and replies our team add to a submission are kept as a record of what was done. The legal basis is our legitimate interest in answering you.
06Email
Two kinds of email leave our systems.
- Transactionalmail you cannot opt out of while you hold an account: password resets, email verification, security notices such as a changed email address (sent to the old address), payment failures, access changes, and workspace suspension. These ignore the marketing suppression list, because opting out of news should never lock you out of your account.
- Optionalmail you control from notification settings: scan results, banner published, compliance alerts, the weekly summary, and product news. Each has a one-click unsubscribe header that keeps working indefinitely, and a confirmation page.
Unsubscribes are recorded against the email address, not the account, so they survive a new sign-up. Bounces and complaints reported by mailbox providers also suppress mail and cannot be reversed from a link.
07Retention
- Accountsfor as long as the account exists, then deleted with the workspace data the account owns
- Demo workspacessign-in stops when the 7-day demo ends. The data is kept for a further 7 days so paying restores it, then it is destroyed
- Consent recordsfor the retention period set on the customer’s workspace — between 12 and 120 months, 36 by default — and never longer than the workspace exists. The customer is the controller and may export or delete them
- Contact submissionsuntil closed, then for the period needed to show how we handled them
- Email send loga record that a lifecycle warning was sent is kept even after the workspace is deleted, because “we warned you before deleting” is only evidence if it outlives the deletion
08Processors and transfers
| Processor | What for |
|---|---|
| Stripe | Payments, invoices and the billing portal |
| Email delivery provider (SMTP) | Sending the emails in section 6 |
| CDN and hosting provider | Serving the tag and the API, and supplying the country header |
Where a processor is outside the UK or EEA we rely on the UK International Data Transfer Agreement or the EU Standard Contractual Clauses. A current list of processors is available on request.
09Security
- Every tenant table is protected by row-level security in the database, so one customer’s query cannot return another customer’s rows
- Passwords, refresh tokens, backup codes and every reset or verification token are stored as bcrypt hashes of a secret half. Nothing is stored that a database leak would make usable
- Reuse of a rotated refresh token revokes the whole session family
- Two-factor authentication is available on every account
- Transport is HTTPS only, with HSTS. Authorization and cookie headers are redacted from logs
- Custom banner CSS submitted by customers is sanitised before it reaches a visitor’s browser
We hold Cyber Essentials Plus, follow NCSC guidance, are PCI DSS compliant through Stripe for card handling, and are registered with the ICO.
10Your rights
Under UK GDPR and the EU GDPR you can ask for access to your data, correction, erasure, restriction, portability, and you can object to processing based on legitimate interest. For account data, most of this is available directly in account settings. For anything else, use the contact form with the topic set to other.
You can complain to the Information Commissioner’s Office at ico.org.uk, or to your local supervisory authority if you are in the EEA. We would rather hear from you first.
11Changes to this policy
We will post changes here and update the date at the top. For a material change affecting account holders we will also email you.