Consentmo is provided by iSense Ltd., doing business as Consentmo, UIC 112660079, VAT BG112660079, with registered address at 4 Prof. Georgi Bradistilov St., entrance A, 4th floor, 1700 Sofia, Bulgaria (“Consentmo”, “we”, “us”).
Contact for privacy matters: privacy@consentmo.com
Contact for support matters: support@consentmo.com
This Privacy Policy explains how we collect, use, store, and protect personal data when we act as a controller, that is, for visitors to our website, merchants who install and use the Consentmo app, and people who contact us.
Personal data that we process on behalf of merchants, including personal data of their store visitors, customers, data subject request submitters, and EU withdrawal request submitters, is governed by our Merchant Data Processing Agreement, as explained below.
Data we process on behalf of merchants
When Consentmo processes personal data of a merchant’s store visitors, customers, data subject request submitters, or EU withdrawal request submitters, the merchant is the controller and Consentmo acts as processor.
This processing is governed by our Merchant Data Processing Agreement, including Annex I, which describes the categories of personal data and processing activities, and our Sub-processors page.
Store visitors and customers should contact the relevant merchant directly to exercise their data protection rights, or use the compliance tools available on the merchant’s store, such as cookie preferences or the store’s privacy request pages. If we receive a request relating to a merchant’s store, we will forward or direct it to the relevant merchant where appropriate.
Information we collect as a controller
Information from Shopify upon installation
When you install the Consentmo app, we receive certain information from your Shopify account as part of the app setup. This may include your store’s .myshopify.com domain name, store name, contact email address, country, plan details, and other account information made available through Shopify.
We use this information to identify your account, provide the app, manage your subscription, communicate with you, and provide customer support. This access is visible during the app installation process on Shopify.
Required Shopify permissions
To perform its functions, the Consentmo app integrates with your Shopify store via Shopify’s API. Upon installation, the app will request certain permissions, such as access to customer and order information and the ability to manage store content.
For example, the app may need to read customer data to identify users making privacy requests, read order data for requests related to order information, and create or edit content on your store to generate compliance pages such as privacy policy or cookie policy pages. It may also require access to settings such as script tags, theme information, and locale settings to ensure the cookie consent banner and related features function correctly.
These permissions are used strictly to provide, secure, and support the Services. Personal data of your store visitors, customers, or request submitters accessed through these permissions is processed on your behalf under the Merchant DPA.
Information you provide directly
If you contact us via email, live chat, support form, or another communication channel, we process the personal data you provide, such as your name, email address, store information, and the content of your messages.
We use this information to respond to your inquiry, provide support, troubleshoot issues, improve our support operations, and maintain appropriate records of our communications.
Website visitors
When you visit consentmo.com, we may collect usage information such as pages viewed, clicks, approximate location, device and browser information, and similar website interaction data through the tools described under “Website analytics and session diagnostics” below, subject to your cookie choices.
Communication and marketing
When you install Consentmo or use our Services, we may use your contact email address to send you the following communications:
Transactional and service emails. These include essential notifications about your account, security alerts, billing reminders, important technical updates, support communications, and other messages necessary to provide the Services. These messages cannot be unsubscribed from because they are necessary for the operation of the Services.
Product and performance reports. We may send periodic emails summarizing the performance of the Consentmo app on your store, including insights, analytics, compliance summaries, or information about your use of the Services. Where these messages are not essential service communications, you may opt out.
Marketing and promotional emails. Where you have opted in, or where otherwise permitted by applicable law, we may send newsletters, product announcements, promotional offers, and information about new features or services. You can opt out at any time by clicking the “unsubscribe” link in any marketing email or by contacting privacy@consentmo.com.
We do not sell or rent your email address or personal information to third parties for their marketing purposes.
Legal bases
We process personal data on the following legal bases under the GDPR:
Performance of a contract - Art. 6(1)(b) GDPR.
We process personal data to provide the app, your account, billing functionality, support, and related Services.
Legitimate interests - Art. 6(1)(f) GDPR.
We process personal data for service communications, security and fraud prevention, troubleshooting, improving our website and Services, business-to-business communications, and marketing to existing business customers where permitted by applicable law.
Consent - Art. 6(1)(a) GDPR.
We rely on consent for non-essential cookies on our website and for marketing communications where consent is required or obtained. You may withdraw your consent at any time.
Legal obligations - Art. 6(1)(c) GDPR.
We process personal data where necessary to comply with tax, accounting, legal, regulatory, and other statutory obligations.
Cookies set by the Consentmo app on merchants’ stores
The Consentmo app may set cookies in store visitors’ browsers to remember their privacy preferences and apply the merchant’s selected consent settings.
The main app cookies are:
cookieconsent_status
This cookie stores the visitor’s choice on the cookie consent banner - for example, whether the visitor dismissed the banner, accepted all cookies, or chose a customized setting. This ensures that once a visitor makes a choice, the banner does not repeatedly reappear unnecessarily.
Duration: 1 year.
cookieconsent_preferences_disabled
This cookie stores which categories of cookies are disabled for the visitor, based on the store’s settings and the visitor’s selections. If the visitor later updates their preferences, this cookie is updated to reflect those changes.
Duration: 1 year, reset with each preference change.
These cookies are used to provide the Consentmo app functionality on the merchant’s store. They do not track users across unrelated sites and are not used by Consentmo for advertising. The related consent records are processed on the merchant’s behalf under the Merchant DPA.
Website analytics and session diagnostics
On our website, we use analytics and session-diagnostics tools, such as Google Analytics and Microsoft Clarity, to understand website usage and improve the website experience.
These tools may collect information such as pages viewed, clicks, scrolls, approximate location, device and browser information, and similar usage data. They are controlled through our cookie banner and Cookie Preferences, where required.
Sensitive fields are masked in session recordings. We also use Google reCAPTCHA to protect our forms from spam and abuse. Where technically supported and applicable, we respect supported browser privacy signals such as Global Privacy Control.
You can also opt out of Google Analytics by using Google’s official Analytics Opt-out Browser Add-on.
Service providers and other disclosures
Service providers for Consentmo’s own operations
We use trusted third-party providers to operate our website, provide support, secure our Services, and improve Consentmo. These providers only receive the information needed to perform their functions and are not permitted to use it for unrelated purposes.
These providers may include:
Shopify
Our app runs on the Shopify platform and uses Shopify’s infrastructure. Shopify may process data as necessary for the app to function, under Shopify’s own terms and policies.
Crisp and CrispAI
We provide customer support via chat on our website using Crisp. If you use the chat, the information you provide, such as your email address and messages, is processed through Crisp so we can respond. CrispAI may power AI-assisted responses in the chat. Crisp is bound by data protection obligations.
Microsoft Clarity, Google Analytics, and Google reCAPTCHA
These providers support website analytics, session diagnostics, and form protection, as described above.
Bunny CDN
Website assets such as fonts may be delivered via Bunny CDN. Bunny CDN may process technical request data, such as IP address and browser request information, solely to deliver these assets. We do not use Bunny CDN for advertising or cross-site tracking.
Sub-processors for merchant personal data
Where a third party processes personal data on behalf of merchants as part of the Consentmo app, it is listed on our Sub-processors page, which includes our change-notification mechanism.
With the merchant
As the store owner, the merchant has access to the data our app collects on the merchant’s behalf, such as consent records and privacy request records, through the Consentmo app dashboard. This data is made available to the merchant for compliance, record-keeping, and store operation purposes.
Legal disclosures
We may disclose information if required by law or in response to a valid legal request, such as a subpoena, court order, or government demand. In such cases, we will disclose only the information necessary to comply with the request. Where the law allows, we will try to notify the affected party of such requests.
Business transfers
If Consentmo or iSenseLabs is involved in a merger, acquisition, sale of assets, reorganization, or similar transaction, personal data may be transferred to the succeeding entity, subject to appropriate protections. If such a transfer results in significant changes to this Privacy Policy or our data handling practices, we will provide appropriate notice.
We do not sell personal data and we do not share merchant customer data with advertisers for their own advertising purposes.
Use of AI-assisted tools
Consentmo may use AI-assisted tools for customer support and for technical cookie and tracker classification.
AI-assisted customer support.
Our website support chat may be handled initially by an AI assistant powered by CrispAI. It may process the content you submit in the chat to generate or suggest responses. You can request a human support agent or contact us by email instead.
Cookie and tracker classification.
Our scanner identifies and categorizes cookies, trackers, scripts, pixels, and similar technologies on a merchant’s storefront using technical detection methods and AI-assisted classification. This process is used to help identify and categorize technologies on the merchant’s store. It is not used to profile store visitors. Merchants can review and adjust classifications.
AI-assisted outputs may be inaccurate and should be reviewed before being relied on. Consentmo does not use AI-assisted features to make automated decisions with legal or similarly significant effects on individuals.
Where data is stored and international transfers
Our core app infrastructure is hosted in the European Economic Area, currently in Amsterdam, the Netherlands.
Some service providers used for website analytics, support, security, billing, communications, or form protection may process personal data in other countries. Where required, we rely on appropriate safeguards such as adequacy decisions, Data Privacy Framework certification, Standard Contractual Clauses, or equivalent transfer mechanisms.
International transfers of personal data processed on behalf of merchants are governed by the Merchant DPA, including its Standard Contractual Clauses, UK Addendum, and Swiss transfer terms.
Data retention
Merchant personal data processed by the app
Retention of personal data processed on behalf of merchants is governed by the Merchant DPA. Consent and request records are generally retained for twelve (12) months unless a different retention period is agreed in writing or made available in the app. Merchants can export these records at any time.
After termination or uninstallation, such data is deleted in accordance with the Merchant DPA. Merchants should export any records they need before uninstalling the app.
Consentmo account, support, and website data
We retain merchant account, billing, support correspondence, website, and marketing data for as long as needed to provide the Services, comply with legal obligations, resolve disputes, maintain security, and operate our business.
You can request deletion of support conversation records where this is within our power and where retention is not required for legal, security, or legitimate business reasons.
After the applicable retention periods expire, we delete the personal data or anonymize it so it can no longer be associated with an individual, except where we are required by law to keep it longer.
Security
We protect personal data with appropriate technical and organisational measures, including encryption in transit and at rest, role-based access controls, access limited to personnel who need the data for their role, confidentiality obligations for our staff, and an ISO/IEC 27001-certified information security management system.
We routinely update our software and infrastructure to address vulnerabilities and regularly review our security practices. In the event of a personal data breach affecting personal data, we maintain a response process to notify affected parties and the appropriate authorities where required by law.
Further details are available on our Security page and in Annex II of the Merchant DPA.
Your rights
Under the GDPR, where applicable, you have the right to access, rectify, and erase your personal data, to restrict or object to its processing, to data portability, and to withdraw consent at any time where processing is based on consent. Withdrawal of consent does not affect the lawfulness of processing before withdrawal.
To exercise these rights in relation to personal data for which Consentmo acts as controller, contact privacy@consentmo.com. We will respond within the timelines required by law.
If your request concerns a merchant’s store, for example, data collected while you visited a store that uses Consentmo, please use the compliance tools on that store, such as cookie preferences or the store’s privacy request pages, or contact the merchant directly. The merchant is the controller of that data. If you contact us, we will direct your request to the relevant merchant where appropriate.
You also have the right to lodge a complaint with a supervisory authority, in particular the Bulgarian Commission for Personal Data Protection (CPDP, www.cpdp.bg), or the supervisory authority of your habitual residence.
Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other operational reasons. We will post the updated version on this page with a new “Last updated” date.
Where changes materially affect how we process personal data, we will provide additional notice where appropriate, such as through the app or by email.
Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or how Consentmo handles personal data, please contact us:
Consentmo Support Team
Email: support@consentmo.com
Address: Prof. Georgi Bradistilov Str. No.4, 1700 Sofia, Bulgaria.
EU Registration Number: 112660079
We will be happy to assist you and address any questions you may have.