Security and data

A consent product must be the first to respect data. Precise details, not general promises.

What a consent record holds — and what it never holds

We keep: the site, the banner version, the text fingerprint, each category's answer, the time, the country (from Cloudflare), the channel (web or app), and a random consent id in the visitor's browser.
We never keep: an IP address, a page URL, basket or product data, or anything identifying the visitor — basket-price profiling is impossible on its face, because none of it reaches us.
For stores: records can link to a pseudonymous shopper id signed by matgrk when the visitor is signed in, to follow their choices across devices — the link is erased on erasure, while the anonymous records remain proof to the end of their term.

Every hour, its records are written to OVH object storage (Gravelines, France) under compliance Object Lock: five years of no edits and no deletes, even with our administrative account.
Every batch carries a SHA-256 checksum and a chain to the one before it; a daily verifier recounts and rehashes and alerts on any difference.
An account may extend beyond five years (litigation runs long); shortening is impossible even under the lock.

The service runs in Europe (Amsterdam) behind Cloudflare, with a live copy of the database on a server we control, for restores and moving off.
Operations logs are kept 13 months in object storage, passing a redaction step before leaving the service: passwords and tokens dropped, emails and IP addresses masked.
The scanner — a browsing tool run in isolation — leaves through a gateway that refuses private network ranges and middlemen, so nobody uses it to reach inside a network.

It loads nothing from any third party before your consent: our fonts are self-hosted, there is no analytics script today — and when one is added it will not run without your consent, from our own banner.
The "Cookie settings" link at the bottom of every page reopens the choice whenever you want.
The one possible exception: our free scan loads Cloudflare's Turnstile check — only after you start typing, and only because an unthrottled scan is an abuse door.