Consentful

Privacy Policy

Last updated October 9, 2026

How The Plugins Company collects, uses and protects personal data when you use Consentful — the website, the customer dashboard and the Consentful banner on your sites. Short version: we collect what we need to run your account and licenses, we never sell data, and the banner on your site sends us no personal data about your visitors.

Who we are

Consentful is made by The Plugins Company ("we", "us"). For personal data about you as a customer — your account, billing and support — we are the controller.

For the websites where you install Consentful, you are the controller of your visitors' data. Consentful is designed so that we do not receive or store personal data about your visitors (see "Data about your website visitors" below).

Questions or requests: support@theplugins.co.

Data we collect about you

We collect only what we need to provide the service:

  • Account data: your name, email address, a hashed password (never the password itself), language and time zone, and your two-factor settings if you enable them.
  • Sign-in and security data: the IP address and browser of each sign-in, so you can see active sessions and we can alert you to new logins.
  • License data: your license keys, the domains you activate, the plan they belong to and when each domain was added or removed. When you activate a license from an editor, we record the IP address of that request to prevent abuse.
  • Billing data: your plan, subscription status and invoices. Card details are handled by our payment provider and merchant of record, Dodo Payments — we never see or store your full card number.
  • Support data: anything you send us by email or the contact form.
  • Website analytics: if — and only if — you accept analytics cookies on our website, we use PostHog to understand how the site is used (pages viewed, clicks). If you decline, no analytics are collected.

Data about your website visitors

The Consentful banner runs in your visitors' browsers. It is built to keep your visitors' data on their own device:

  • A visitor's consent choice is stored only in their own browser (a first-party cookie and local storage on your domain). It is never sent to us.
  • To decide which banner design to show, the banner asks our license service whether your domain is activated. That request contains your site's domain — not the visitor's identity, the page they are on, or any cookie. Like any web request it arrives from the visitor's IP address; we use that address only momentarily to protect the service from abuse (rate limiting) and do not store it. The WordPress plugin makes no such request: it never contacts our servers from your site.
  • The banner script itself is loaded from the jsDelivr CDN (the WordPress plugin includes its own copy, served from your site), and platform integrations may load small helper files from our servers (for example on Shopify). These are ordinary file downloads; we do not log visitor identities.
  • Consent analytics (a Pro feature) is off by default. If you turn it on and point it at a collection endpoint, the banner sends only the decision (accept, reject or custom), which categories were granted, the policy version, an A/B variant id and a coarse region such as "EU" — never an IP address, cookie, visitor id or page URL in the payload.

How we use your data

We use personal data to:

  • create and secure your account and let you sign in;
  • issue, validate and manage your licenses and the domains on them;
  • take payment and send invoices (through Dodo Payments);
  • send service emails — receipts, security alerts, license and billing notices;
  • answer support requests;
  • send product updates or newsletters, only if you ask to receive them (you can unsubscribe at any time);
  • understand and improve the website, only if you accept analytics cookies;
  • detect and prevent fraud, abuse and security incidents, and meet legal obligations such as keeping tax records.

Who we share data with

We do not sell or rent personal data, and we do not share it for cross-context behavioral advertising. We share it only with service providers that help us run the service, under contracts that limit their use of it. The current list, with what each provider does, is on our Subprocessors page.

We may also disclose data if the law requires it, to protect our rights or users, or as part of a merger or sale of the business (in which case this policy continues to apply to your data).

International transfers

Our providers may process data outside your country, including in the United States. Where data leaves the EEA or UK, we rely on the provider's safeguards such as the European Commission's Standard Contractual Clauses or an adequacy decision.

How long we keep data

  • Account and license data: for as long as your account is open. When you delete your account we delete or anonymize it within 30 days.
  • Invoices and billing records: as long as tax law requires (typically up to 7 years).
  • Sign-in and security logs: up to 12 months.
  • Support emails: up to 2 years after the conversation ends.
  • Website analytics: up to 12 months, and only if you consented.

Your rights

Depending on where you live, you can ask to access, correct, export or delete your personal data, object to or restrict how we use it, and withdraw any consent you gave. You can edit most account details and delete your account yourself from the dashboard settings. For anything else, email us — we answer within 30 days.

If you are in the EU, EEA or UK you can also complain to your local data protection authority. California residents have the rights described in the CCPA/CPRA; we do not sell or share personal information as those laws define it.

Security

We protect data with encryption in transit (HTTPS), hashed passwords, optional two-factor authentication, signed domain-locked license tokens and access limited to the people who need it. No system is perfectly secure, but we work to keep your data safe and will notify you and the authorities of a breach where the law requires.

Children

Consentful is a business tool and not intended for anyone under 16. We do not knowingly collect children's data.

Changes to this policy

If we change this policy we will update the date above, and for significant changes we will email account holders before they take effect.

Contact

Email support@theplugins.co for any privacy question or request.

Privacy Policy | Consentful