Privacy Policy

1. About us

ConsentMode (consentmode.org) is an initiative of an international media group, backed by ALPHAZEN TECHNOLOGIES LIMITED, located at 27 Old Gloucester Street, London, United Kingdom, WC1N 3AX.

For the personal data described in this policy, ConsentMode is the controller, under the Brazilian General Data Protection Law (Lei 13.709/2018, the "LGPD").

Data protection officer and privacy channel: [E-MAIL DO ENCARREGADO]. This is the address you use to exercise your rights, ask questions or file complaints about how your data is processed.

2. Who this policy applies to

• People who create an account and use the portal (publishers, MCM partners, agencies and their team members).
• People who send messages through the contact page.
• People who visit the site's public pages.

3. What data we process

3.1 Registration and account

• Name, email, company, phone and site (company, phone and site are optional).
• Password: we store only a code derived from the password (hash). No one on the team can see your password.
• Sign in with Google: your Google account identifier and the email it confirmed. We don't receive your Google password.
• Account preferences (for example, monitoring frequency, time and notices) and, if you provide them, Ad Manager network codes and publisher IDs.
• Record of your acceptance of these documents: date, version accepted and IP address.
• Two-step verification setup, when you turn it on.
• Internal team notes about support for the account.

3.2 Sessions and access logs

• Login sessions: IP address, browser (user agent) and date. The session is stored as a hash, never the cookie value.
• Activity log: actions taken in the account (login, registration, plan changes, data export and similar), with date and IP address.

3.3 Contact messages

Name, email, company (optional), subject, message and language.

3.4 Billing

• Name or company name, CPF or CNPJ, billing email, phone and address (when requested).
• Plan, cycle, amounts, subscription status and invoices.

Card details are entered on the Asaas payment page. ConsentMode doesn't receive or store your card number.

3.5 Audits and reports

To generate a report, the engine opens the pages of the site you provide as an ordinary visitor and records what anyone could see: HTML, screenshots, cookies and scripts the site loads, and responses from public services (such as Google's PageSpeed Insights and Safe Browsing).

They are data public from the audited site. If a public page contains personal data (for example, the site's contact email), it may appear in the screenshots or in the HTML stored in the report. The report also records who requested the audit.

3.6 Browsing the public pages

The server receives technical data from any visit (IP address, browser, page requested), needed to deliver the page and protect the service.

4. What we use it for and the legal basis

When we rely on legitimate interest, we process only the minimum necessary and you can object through the data protection officer's channel.

We don't sell or rent personal data and we don't use it for advertising.

5. Who we share it with

We use providers (subprocessors) that process data on our behalf, only for the purposes above:

Notes:

• When loading Google fonts, Sign in with Google or Turnstile, your browser connects to these services and sends them your IP address. They also process this data under their own privacy policies.
• The Google APIs used in the audits receive the address of the audited site, not your personal data.
• We may also share data when the law requires it, by court order or request from a competent authority, or to defend ConsentMode's rights.
• Other people in the same customer workspace (for example, your team) can see the workspace's audits and reports.
• To provide support, the team may open the portal as your account in view mode, read-only, without changing anything. This access is logged.

6. International transfer

DigitalOcean's servers are in the United States and Europe, and some of the providers above also process data outside Brazil. For this reason, personal data is transferred internationally.

This transfer follows art. 33 of the LGPD and the ANPD rules, based on contractual clauses and the providers' data protection safeguards, and is necessary to provide the service you contracted.

7. Cookies and browser storage

The portal doesn't use Google Analytics, advertising pixels or tracking cookies. That's why we don't show a cookie consent banner.

Local storage stays only in your browser and isn't sent to our servers.

The third-party services mentioned in section 5 (Sign in with Google and Turnstile) may use their own technologies when they load.

8. How long we keep it

After these periods, the data is deleted or anonymized. Deleted data may remain in backups for up to 30 days, until they are overwritten.

We may keep for longer what is necessary to comply with a legal obligation or defend rights in legal proceedings, only for as long as necessary.

9. Your rights

Under the LGPD (art. 18), you can request at any time:

• confirmation that we process your data and access to it;
• correction of incomplete, inaccurate or outdated data;
• anonymization, blocking or deletion of unnecessary data or data processed in violation of the law;
• data portability;
• deletion of data processed on the basis of consent;
• information about who we share your data with;
• review of decisions made solely on the basis of automated processing;
• objection to processing based on legitimate interest, when the law is not being followed.

How to request

• Download your data: in Settings › Account › "Baixar meus dados". You immediately get a file with your account data, sessions, activities, requested audits, contact messages and billing data.
• Correct data: directly in Settings, or through the data protection officer's channel.
• Delete the account: in Settings › Account › "Excluir minha conta". The team checks for an active subscription and completes the deletion within 15 days.
• Other requests: by email [E-MAIL DO ENCARREGADO]. We reply within 15 days.

To protect you, we may ask you to confirm your identity before handling a request.

What happens on deletion

• We delete your name, email, company, phone, site, password, Google link, two-step verification and preferences.
• We end all sessions.
• We remove your email and IP from the activity logs, audits and monitors you created, and we delete your contact messages.
• We keep the billing data and invoices for the tax period (section 8), because the law requires it.
• If there are other people in the same customer workspace, the workspace's audits remain available to them, without your name.

If your subscription is active, cancel it before requesting deletion (see the Terms of Use).

You can also file a complaint with the Brazilian National Data Protection Authority (ANPD), at gov.br/anpd.

10. Security

We use technical and administrative measures suited to the service:

• connection always over HTTPS;
• passwords stored with the scrypt algorithm (salted hash), never as plain text;
• sessions stored as a hash, in HttpOnly cookies;
• two-step verification in the admin panel;
• encrypted backups;
• isolation by customer workspace: each customer only sees the audits in their own workspace;
• team access under the principle of least privilege;
• limit on login attempts and anti-robot verification.

No system is 100% secure. If a security incident occurs that may cause you relevant risk or harm, we will notify you and the ANPD, as art. 48 of the LGPD requires.

You can help too: use a strong, unique password and don't share your access.

11. The sites you audit

The reports process public data from the sites that you choose to audit. When you request an audit, you declare that you manage the site or are authorized to audit it (see the Terms of Use).

The engine only reads the pages. It doesn't access restricted areas, submit forms, click on ads or generate impressions.

12. Public badge

If you decide to publish a site's badge, the public directory shows only the domain, the badge status, the publication date and a summary of the scope. It doesn't show flaws, screenshots, contact data or the report. You can withdraw the publication whenever you want. The rules are in the Badge policy.

13. Minors

ConsentMode is a professional service for companies and people over 18 years old. We don't knowingly collect data from children or teenagers.

14. Changes to this policy

When this policy changes in a relevant way, we will notify you by email and in the portal with 30 days' notice and ask for new acceptance. The system records the version each person accepted. The date of the current version appears at the top of this document.

15. Contact

• Data protection officer and privacy: [E-MAIL DO ENCARREGADO]
• ConsentMode, an initiative of an international media group backed by ALPHAZEN TECHNOLOGIES LIMITED: 27 Old Gloucester Street, London, United Kingdom, WC1N 3AX

16. Explanatory content and official references

The explanations of the Better Ads Standards, Google policies and privacy laws published on ConsentMode are our own summaries, written in plain language. The official reference for the Better Ads Standards is the Coalition for Better Ads, at betterads.org (in English). Google's rules are in the Help Centers for AdSense, Ad Manager and Google Ads.

If in doubt, the official text prevails. ConsentMode is not affiliated with the Coalition for Better Ads or with Google.