Last updated: 2026-07-17 Version: 1 (draft)
This is a navigational index only, not a substitute for the numbered sections below — if anything here appears to conflict with a numbered section, the numbered section controls.
Consentio is a product operated by Filova Ltd ("Filova", "we", "us", "our"), a company registered in England and Wales.
This policy explains how we handle personal data in two distinct roles:
dpa.md).When you create a Consentio account: name, email address, and (for paid
plans) billing details processed via our payment provider. See
organizations, memberships, and subscriptions in our schema — we store
an email/role per member of an Organization, and a payment-provider
customer/subscription reference for billing. We do not store card numbers
ourselves. (As of this draft, billing is not yet wired into the product and
the specific payment provider has not been finalized — see Section 5.)
sites).cookies) — necessary, analytics, marketing, functional.scans).banner_configs).activity_log).When a visitor to an Organization's website interacts with a Consentio
banner, we record (consent_records):
anon_id) — not a name,
email, or account identifier. It is not linked to any Consentio account.proof_hash)
of the record, so the record can be shown not to have been altered after
the fact.We do not knowingly collect or store the name, email address, or any other directly identifying information of an Organization's website visitors as part of this consent-recording function. We also do not intentionally collect any special category / sensitive personal data (such as health, racial or ethnic origin, religious belief, or sexual orientation) as part of this function.
| Data | Purpose | Legal basis (GDPR/UK GDPR Art. 6) |
|---|---|---|
| Organization account data | Provide the Consentio service, billing, support | Contract (Art. 6(1)(b)) |
| Site/cookie/banner config | Provide the scanning and banner-configuration features | Contract (Art. 6(1)(b)) |
| Consent records | Enable the Organization to demonstrate compliant consent collection; provide audit-ready proof of consent | Legitimate interest of the Organization (as controller) in complying with its own legal obligations (Art. 6(1)(f)), processed by us under contract with the Organization (Art. 6(1)(b) for our processing role) |
| Security/abuse-prevention logs (e.g., rate limiter) | Detect and prevent abuse of the service (see Security, below) | Our own legitimate interest (Art. 6(1)(f)) in protecting the service and its users |
Retention periods by data category:
consent_records) — the one exception — retained
for as long as reasonably necessary to demonstrate historical consent
decisions and to comply with applicable legal obligations. Due to the
integrity requirements of consent evidence, they are enforced append-only
and immutable at the database level by design (see Security, below, and
supabase/migrations/006_consent_immutability.sql), rather than being
deleted or altered on any fixed schedule. This exception applies only to
consent records — it does not extend to account or configuration data.| Sub-processor | Role | Location |
|---|---|---|
| Supabase | Database (Postgres) and authentication | EU (eu-central-1), with the underlying provider's own sub-processors (infrastructure, support) located in the US and Singapore |
| Vercel | Application hosting | United States (default function region) — an EU region is not currently configured for this deployment |
| Payment processor (provider not yet finalized) | Payment processing for paid plans | Not yet integrated — under evaluation; location and role (payment processor vs. Merchant of Record) will be confirmed once a provider is selected |
We do not sell personal data. We do not share consent records with any party other than the Organization that collected them and the sub-processors above, acting on our instructions, except where required to do otherwise by law applicable to us (for example, a valid court order or regulatory demand).
Our primary database infrastructure (Supabase) is hosted in the EU
(eu-central-1); our application hosting (Vercel) currently processes in
the United States by default.
Where personal data is transferred outside the UK/EEA — including to our
sub-processors' own infrastructure, and including remote access to
EU-hosted data from our UK operations — such transfers are protected by
appropriate transfer mechanisms: the European Commission's Standard
Contractual Clauses, the UK International Data Transfer Addendum, adequacy
regulations where they apply, or other legally recognised safeguards. Our
sub-processors' own data processing agreements already incorporate these
mechanisms; see dpa.md §7 for the specific mechanism relied on per
sub-processor.
As transfer volumes grow beyond our current pre-launch scale, we intend to conduct and document a formal Transfer Impact Assessment (and, for UK transfers, a Transfer Risk Assessment) consistent with post-Schrems II guidance — this is a planned improvement, not yet completed as of this draft.
Subject to applicable law (GDPR, UK GDPR, CCPA/CPRA, or other), you may have the right to:
To exercise any of these rights, contact privacy@filova.io. To protect your data, we may need to verify your identity before fulfilling a request. If your request concerns consent-record data collected via an Organization's website, we may direct you to that Organization, as they are the controller of that relationship — but we will still assist as their processor.
We implement appropriate technical and organisational measures under Article 32 GDPR, including:
consent_records are enforced append-only at the database level (triggers
reject UPDATE, DELETE, and TRUNCATE against the table and its
partitions, independent of application code) — see
supabase/migrations/006_consent_immutability.sql. Records written since
our HMAC-signing migration (supabase/migrations/009_consent_proof_scheme.sql)
carry an HMAC-SHA256 integrity signature (proof_hash) that lets tampering
by a party without the signing key be detected; a small number of earlier
records predate that migration and carry an unsigned SHA-256 hash instead
(tracked via the proof_scheme column).consent_records do not store the raw IP address or raw user-agent
string — only a derived country code and a hash, respectively. Our
infrastructure providers (e.g. Supabase, Vercel) may still transiently
process IP addresses in their own request/server logs under their own
retention policies, independent of what Consentio itself stores.Your legal basis for processing and rights are as described in Sections 3 and 7. You have the right to lodge a complaint with your local supervisory authority: in the UK, the Information Commissioner's Office (ico.org.uk); if you are in the EEA, the competent supervisory authority in your own EEA Member State.
Data Protection Officer: based on our current scale (zero live customers, pre-launch, as noted below) and the nature of our processing, we have assessed that appointment of a Data Protection Officer under GDPR Article 37 is not currently required. As with our Article 27 assessment below, this is a documented, good-faith interim position rather than a final legal determination — we will revisit it as our processing scale changes.
EU representative under GDPR Article 27: not currently appointed. As of this assessment (2026-07-17), Filova has zero live customers and processes no EU residents' personal data — our production systems hold no organizations, sites, or consent records. On that basis we assess that Article 3(2) is not yet engaged and no representative is currently required. This is a documented, good-faith interim position rather than a final legal determination: we will appoint an EU representative before onboarding our first EU-facing customer, since ongoing collection of visitor consent data at that point would no longer qualify as "occasional" under the Article 27(2)(a) exemption.
If you are in Türkiye, see our separate KVKK Aydınlatma Metni
(kvkk-aydinlatma-metni.md), which follows the disclosure format expected
under Law No. 6698.
California (CCPA/CPRA) residents have the right to know what personal
information is collected, to request deletion, and to opt out of the "sale"
or "sharing" of personal information. We do not sell personal information,
and we do not sell or share personal information for cross-context
behavioral advertising. Our banner already reads and honors the browser's Global Privacy Control
(GPC) signal (navigator.globalPrivacyControl) as an opt-out-of-sharing
signal where applicable (lib/banner/script-source.ts).
Other US states with a comprehensive privacy law in effect (a growing list that, as of this writing, includes states such as Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and others) generally give their residents similar rights: access, deletion, correction, and an opt-out of sale/targeted advertising. We honor the Global Privacy Control signal as an opt-out wherever the applicable state law requires or supports it. Note that for Organizations' website visitors, Consentio typically acts as a data processor/service provider on the Organization's behalf — if you are an end visitor, the Organization operating the website you visited is usually the right party to contact first to exercise these rights; we assist them as needed.
If you are located somewhere not named above, you may still have similar rights under your local data protection law (for example, access, correction, deletion, or objection to processing). Contact us at privacy@filova.io and we will do our best to honor a verified request under the law that applies to you, even where this policy doesn't name your jurisdiction specifically.
Consentio is a business-to-business product and is not directed at children. We do not knowingly collect personal data from anyone under the age of 13 (or the applicable minimum age of digital consent in your jurisdiction, which may be higher — for example, up to 16 in some EEA Member States).
If Filova is involved in a merger, acquisition, or sale of assets, personal
data we hold as a controller (Organization account data, site/cookie/
config data) may be transferred as part of that transaction, subject to
this policy or a policy that offers materially equivalent protections. Data
we hold as a processor on an Organization's behalf (consent records)
would only transfer to the acquiring party as a new sub-processor or
successor processor under the terms of our Data Processing Agreement with
that Organization — including the Organization's right to prior notice and
to object, per dpa.md §4.4 — not merely "subject to this policy."
We will update the "Last updated" date above when this policy changes, and for material changes, notify Organization account holders by email.
Filova Ltd, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. privacy@filova.io. Phone: +44 20 3967 8386.
Sections 4 and 6 of this policy were prepared based on official regulatory
sources (European Commission, EDPB, UK ICO, KVKK Kurumu) and the relevant
vendors' own published data processing terms, current as of the "Last
updated" date above. This is not a substitute for legal advice — see
legal/README.md for this document's overall review status.