Privacy Policy

This policy applies to the consent.app website at consent.app: the public pages you are reading right now. It explains what happens to personal data when you browse them.

It does not cover the consent.app web application at consent.app/portal, or the consent.app mobile apps. Those are separate products with their own privacy policies, shown to you when you create an account or install the app. Nothing on this website creates an account or collects a consent record.

This website is operated by XLCloud GmbH, Kaiserstraße 161, 76133 Karlsruhe, Germany. XLCloud GmbH is the controller for the personal data described below.

For any privacy question about this website, write to privacy@consent.app. We have not appointed a data protection officer, as we are not required to; that address reaches the people responsible.

You do not need to give us anything to read this website. This is everything that happens when you do.

• Your request itself: to send you a page, our hosting provider has to receive your request — which carries your IP address, the page you asked for, and whatever your browser reports about itself. That is how the internet works and cannot be switched off. What we have switched off is the recording of it: we do not keep access logs of this website. Google processes the request to deliver and protect the service, under its own terms as our provider, and we do not receive a log from them either.
• Storage on your own device: the site saves two small values in your browser’s local storage, namely whether you chose light or dark mode and the answer you gave to the cookie banner. Neither is sent to us. They exist so the site behaves the way you asked, and you can clear them from your browser at any time.
• Analytics: only if you say yes. Section 4 explains how.
• If you email us: when you write to an address listed on this site, we receive your message, your email address, and anything else you choose to include. We use it to answer you.

This website sets no advertising or tracking cookies. It uses one optional analytics service, which stays switched off until you turn it on.

Google Analytics 4, provided by Google Ireland Limited, tells us which pages people read and where they leave. It is not loaded at all until you accept analytics in the cookie banner. If you decline, or never answer, the analytics code is not downloaded and no analytics identifiers are created.

The strictly necessary storage described in section 3 is not covered by the banner: it exists solely to carry out what you asked for, and the site cannot honour your cookie choice without remembering it.

You can change your mind whenever you like. Open your cookie settings, or use the “Cookie settings” link at the bottom of any page. We ask again after twelve months, and whenever we add a new category.

Under the GDPR, each of the above rests on a specific legal basis.

• Handling your request, and the storage on your device: our legitimate interest in running a secure, working website (Article 6(1)(f)), and for the storage itself, the fact that it is strictly necessary to provide what you asked for.
• Analytics: your consent (Article 6(1)(a), and § 25(1) TDDDG). You can withdraw it at any time, which stops any further collection.
• Email correspondence: our legitimate interest in replying to you, or steps taken at your request before entering a contract (Article 6(1)(f) and (b)).

We do not sell personal data, share it for advertising, or build profiles of visitors. Two providers are involved in running the site:

• Google Cloud Platform: hosting and delivery of the website, which means it handles every request you make to it.
• Google Ireland Limited: analytics, and only where you have accepted it.

Each acts under a data processing agreement. We disclose data to authorities only where the law compels us to.

The files that make up this website are stored in the European Union, in Google Cloud Storage buckets in the EU multi-region, and delivered through Google’s global content delivery network — so the request itself may be answered by an edge location near you. Our providers may process data outside the European Economic Area, in particular in the United States. Where that happens, the transfer relies on the European Commission’s Standard Contractual Clauses together with additional safeguards, or on an adequacy decision such as the EU–US Data Privacy Framework where the provider is certified under it.

• Requests to the website: nothing to keep, because we do not log them. Your request is processed to serve you the page and not recorded by us afterwards.
• Analytics data: event-level data for two months. Data held against a visitor identifier is kept for two months as well, counted from that visitor’s most recent activity rather than their first, so it restarts each time the same browser returns.
• Your cookie choice and theme: on your device until you clear it. We ask again after twelve months.
• Emails: for as long as needed to deal with your enquiry, and afterwards only where commercial or tax law requires it.

In relation to the data described above, you can ask us to:

• confirm what we hold about you, and give you a copy (Article 15);
• correct anything inaccurate (Article 16);
• delete it (Article 17);
• restrict how we use it (Article 18);
• hand it over in a portable format (Article 20);
• stop processing based on legitimate interest, on grounds relating to your situation (Article 21).

Where we rely on your consent, you can withdraw it at any time without giving a reason. Processing carried out before you withdrew stays lawful.

Requests are free, and we answer within 1 month. Write to privacy@consent.app. See also our GDPR & CCPA page.

If you think we have got it wrong, you can complain to a supervisory authority. Ours is the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg. You may also complain to the authority where you live or work.

This website is aimed at organisations and the people who run them, not at children. We do not knowingly collect data from children through it. If you believe a child has sent us personal data, write to us and we will delete it.

When we change how this website handles personal data, we update this page and the date below. If a change adds anything that needs your consent, we ask you again through the cookie banner instead of updating the page quietly.